Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- t####.####.net
- 25wfbnp####.ru
- x####.####.com
- y####.####.com
- z####.####.com
- clicksf####.com
- 5####.####.156
HTTP GET requests:
- x####.####.com/click?i=####
- clicksf####.com/redirect?aff=####&saff=####&q=####
- y####.####.com/redirect?target=####&ts=####&hash=####&rm=####
- clicksf####.com/800_number_services_structural_engineers.cfm?fm=####
- t####.####.net/zp-redirect?target=####&caid=####&zpid=####&cid=####&rt=####
- 25wfbnp####.ru/Look%20Search%20Trace_files/style.css
- 25wfbnp####.ru/site_real.php?session_param=####
- 5####.####.156/passthrough_redirect?ptru=####&ptrv=####
- z####.####.com/zcvisitor/52ed6eb0-fd4d-11e6-8c74-120595e66eb3?campaignid=####&__id__=####
HTTP POST requests:
- clicksf####.com/go?feed_id=####&sub_id=####
- 25wfbnp####.ru/apk_sub.php?get_hash=####
- 25wfbnp####.ru/cpc_v2.php?get_hash=####
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/MyPref.xml
- /data/data/####/shared_prefs/MyPref.xml.bak
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
