Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- a####.####.com
- c####.####.com
- keno####.####.tech
- secure####.com
- ssl-l####.com
- u####.####.com
HTTP GET requests:
- a####.####.com/t/lj3d1nkz38lgAwtkhA9q/?s1=####&s2=####&s3=####
- c####.####.com/assets/campaigns/iphone7/img/check.png
- keno####.####.tech/sVPVDS?utm_pakage=####
- secure####.com/?a=####&c=####&s1=?utm####&s2=####&ckmguid=####
- ssl-l####.com/?a=####&c=####&s1=?utm####&s2=####
- u####.####.com/offer/g3ydgljz/?s1=####&s2=####&s3=####&affid=####
Modified file system:
Creates the following files:
- <Package Folder>/databases/metrica_client_data.db
- <Package Folder>/databases/metrica_client_data.db-journal
- <Package Folder>/databases/metrica_data.db-journal
- <Package Folder>/files/metrica_client_data.db.lock
- <Package Folder>/shared_prefs/<Package>_boundentrypreferences.xml
- <Package Folder>/shared_prefs/<Package>_migrationpreferences.xml
- <Package Folder>/shared_prefs/<Package>_servertimeoffset.xml
- <Package Folder>/shared_prefs/<Package>_startupserviceinfopreferences.xml
Miscellaneous:
Uses administrator priveleges.
