Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- s####.####.com
- nanoade####.com
- b####.com
- 075been####.ru
- w####.####.com
- x####.####.com
- lookt####.com
- 3####.####.gdn
- pop####.net
HTTP GET requests:
- w####.####.com/adframe.php?pid=####&ord=####&sid=####
- x####.####.com/click?i=####
- b####.com/rms/BingCore.Bundle/cj,nj/4ec5679f/05acd042.js?bu=####
- pop####.net/world/go/34286/322169
- b####.com/rms/rms%20answers%20Shared%20BingCore$Animation/cj,nj/c9ce19fd...
- b####.com/rms/rms%20answers%20Shared%20BingCore$fadeAnimation/cj,nj/8c49...
- s####.####.com/script/packcpm.php?stamat=####
- b####.com/fd/ls/l?IG=####&CID=####&Type=####&DATA=####&P=####&DA=####
- b####.com/?r=####
- nanoade####.com/a/display.php?r=####&sub1=####
- nanoade####.com/a/display.php?r=####&sub1=####&treqn=####&runauction=###...
- b####.com/rms/rms%20serp%20Homepage$bgLogoBingTeal/ic/23b397af/f2e8bbe3....
- b####.com/rms/rms%20answers%20Homepage%20Mobile$MobileHeaderSprite2x/ic/...
- 075been####.ru/Look%20Search%20Trace_files/style.css
- pop####.net/world/sgo/34286/322169/608c9f1b33c115c6/aHR0cCUzQSUyRiUyRnds...
- s####.####.com/script/packcpm.php?stamat=####&treqn=####&rpn=####&cbrand...
- w####.####.com/adview.php?tz=####&pid=####&kid=####&wmid=####&sid=####&n...
- nanoade####.com/a/display.php?stamat=####
- b####.com/rms/Framework/cj,nj/f0fe13d0/9101d3f2.js?bu=####
- 3####.####.gdn/?v=####&KW=####&s1=####
- 075been####.ru/site_total.php?c=####
HTTP POST requests:
- b####.com/fd/ls/lsp.aspx?
- lookt####.com/mshow.php?id=####&aff=####&data=####&dl=####&rc=####
- 075been####.ru/apk_main.php?get_hash=####
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/MyPref.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
