Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- bbv####.com
- t####.####.com
- clinkad####.com
- p####.####.com
- ret####.com
- n####.####.com
- club-b####.com
HTTP GET requests:
- club-b####.com/clicks
- t####.####.com/aff_r?offer_id=####&aff_id=####&url=####&urlauth=####
- n####.####.com/css_lp/style.css
- n####.####.com/javascripts/check/204.js
- n####.####.com/javascripts/main.js
- n####.####.com/bootstrap4/css/bootstrap.min.css
- n####.####.com/assets/jquery-bd7ddd393353a8d2480a622e80342adf488fb6006d6...
- club-b####.com/mob
- bbv####.com/mobi?k=####&q=####
- n####.####.com/lp/4281/css/style.css
- n####.####.com/lp/4281/img//phone.jpg
- n####.####.com/bootstrap4/css/bootstrap-theme.min.css
- n####.####.com/favicon.ico
- ret####.com/redirect.php?demand=####&offer=####&id=####&aff=####&aff_sub...
- p####.####.com/?m=####&a=####&pubid2=####&nnaaad####
- t####.####.com/aff_c?offer_id=####&aff_id=####&aff_sub2=####&aff_sub=####
- n####.####.com/lp/4281/?af=####&af_code=####&af_e=####
- clinkad####.com/tracking?camp=####&pubid=####&sid=####&subpubid=####
- club-b####.com/top
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
