Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- trac####.####.com
- g####.####.com
- t####.####.net
- ip####.io
- l####.####.net
- c####.####.com
- cl####.####.com
- c####.####.co
- a####.####.com
HTTP GET requests:
- trac####.####.com/click?id=####&aff=####&gaid=####&aff_sub=####&click_id=####
- cl####.####.com/tracking/click?trafficsource=####&clickid=####&offerid=####&pub_subid=####&idfa=####&gaid=####
- c####.####.co/api/v4/click?campaign_id=####&publisher_id=####&publisher_slot=####&sub_2=####&sub_1=####
- t####.####.net/click/bulk?aid=####&aaid=####&pid=####&nid=####&puid=####&affid=####&pn_u=####&pn_l=####&gaid=####&aff_sub=####&aff_sub2=####&pub_sub_i...
- trac####.####.com/aff_c?offer_id=####&aff_id=####&aff_sub=####&source=####&ios_ifa=####&google_aid=####&aff_sub2=####
- a####.####.com/pull/top_offer?id=####
- a####.####.com/tracking/index/58d01ae264868?gaid=####&imei=####&andid=####&from=####
- trac####.####.com/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
- ip####.io/json
- t####.####.net/click?id=####&aff=####&click=####&aff_sub=####&gaid=####&idfa=####&android_id=####
- c####.####.com/tracking/index/58d015f949352?gaid=####&idfa=####&andid=####&imei=####&aff_sub=####&sub_id=####
HTTP POST requests:
- l####.####.net/gkview/info/600
- a####.####.com/offerview/info/920
- g####.####.com/pilot/api/300102
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Contains functionality to send SMS messages automatically.
