Technical information
Malicious functions:
Sends SMS messages:
- 0979119196: 松松我有事~看到請盡快回復
Network activity:
Connecting to:
- c####.####.com
- e####.####.com
- f####.####.com
- google-####.com
- p####.####.com
- t####.####.com
HTTP GET requests:
- c####.####.com/js/site/main-mobile.js?buildTime=####
- f####.####.com/css?family=####&subset=####
- f####.####.com/s/opensans/v14/k3k702ZOKiLJc3WVjuplzI3LH2FgLjViKkqswU-xtI...
- google-####.com/ga.js
- p####.####.com/pixel;r=2116686795;labels=l0%2Cu55350359.u55350359s951273...
- t####.####.com/files/mobile/theme/concrete.png?149164####
HTTP POST requests:
- e####.####.com/com.snowplowanalytics.snowplow/tp2
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/shared_prefs/TextingState.xml
- <Package Folder>/shared_prefs/multidex.version.xml
