Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- trac####.####.com
- 3####.####.106
- lo####.####.net
- analy####.####.com
- a####.####.net
- set####.####.com
- sc####.####.com
- cdn####.####.com
- n####.####.com
- a####.####.com
- hy####.####.com
HTTP GET requests:
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/13/58c654ae23a90.png
- trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&mb_package=...
- hy####.####.com/offerwall/js/base64.js?v=####
- sc####.####.com/v1/scheme/placement?model=####&mcc=####&os_v=####&direct...
- cdn####.####.com/cdn-adn/offersync/17/05/28/00/22/5929a7b6a0c3f.jpg
- hy####.####.com/offerwall/img/star.png
- a####.####.net/api/v2/template/get?slot_id=####&update_time=####
- hy####.####.com/offerwall/js/interstital.js?v=####
- hy####.####.com/offerwall/tpl/interstital.html?unit_id=####&sdk_version=...
- a####.####.com/mpapi/ad?model=####&fomat=####&mcc=####&os_v=####&directi...
- hy####.####.com/offerwall/img/star_w.png
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/11/58c6542783f80.png
- a####.####.net/api/v2/native/get?dml=####&dt=####&nt=####&mcc=####&bast=...
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign...
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
- a####.####.net/api/v2/cache/get?dml=####&dt=####&nt=####&mcc=####&bast=#...
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&sign=####&category...
- cdn####.####.com/cdn-adn/offersync/17/05/23/00/33/592312d365d38.jpg
- cdn####.####.com/cdn-adn/offersync/17/05/26/21/35/59282f0850edd.png
- hy####.####.com/offerwall/js/windvane.debug.js?v=####
- sc####.####.com/v1/scheme/app?model=####&mcc=####&os_v=####&direction=##...
- set####.####.com/setting?unit_ids=####&app_id=####&sign=####&platform=##...
- hy####.####.com/offerwall/img/interstitalbg.jpg
- cdn####.####.com/cdn-adn/dmp/17/03/31/03/21/58dd5aa36bdcd.JPEG
- 3####.####.106/ttc?h=####&p=####&q=####
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_...
- hy####.####.com/offerwall/js/util.js?v=####
HTTP POST requests:
- lo####.####.net/debug/v2/android
- analy####.####.com/
- a####.####.com/subscribe/api/1110
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/PancouCacheData_ztop.xml
- <Package Folder>/shared_prefs/ct_default.xml
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/TOKEN.xml.bak
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/shared_prefs/TOKEN.xml
- <Package Folder>/shared_prefs/share_date.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/log/agent_log
- <Package Folder>/databases/mobvista.msdk.db-journal
- <Package Folder>/shared_prefs/postTime.xml
- <Package Folder>/shared_prefs/com.mobpower.xml
- <Package Folder>/shared_prefs/mobvista.xml
- <Package Folder>/databases/mobpower.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Contains functionality to send SMS messages automatically.
