Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- rubyfor####.com
- wap####.ru
- google-####.com
- oxoc####.com
- profi####.ru
- googlet####.com
- m####.####.com
HTTP GET requests:
- m####.####.com/Js/Tools.js
- googlet####.com/gtm.js?id=####
- google-####.com/analytics.js
- wap####.ru/click/10372?subid1=####&subid2=####
- m####.####.com/js/migration.json.js
- m####.####.com/fonts/centurygothic-bold.ttf
- m####.####.com/Js/Main.js
- m####.####.com/Js/maintenance.js
- m####.####.com/en/
- oxoc####.com/tds?l=####&
- rubyfor####.com/?s=####&b=####&transaction_id=####
- m####.####.com/fonts/impact.ttf
- oxoc####.com/tds?l=####
- m####.####.com/fonts/swiss921bt.ttf
- m####.####.com/Js/jquery-1.9.1.min.js
- m####.####.com/Css/Main.css
- m####.####.com/Css/maintenance.css
- oxoc####.com/aff_c?offer_id=####&aff_id=####&type=####&l=####&
HTTP POST requests:
- profi####.ru/statb2.php
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/shared_prefs/####.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/cache/webviewCacheChromium/f_000003
Miscellaneous:
Contains functionality to send SMS messages automatically.
