Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- google-####.com
- i####.####.com
- im####.####.com
- m####.####.com
- stati####.####.com
- sup####.####.com
- up####.####.com
- xvi####.com
HTTP GET requests:
- google-####.com/ga.js
- i####.####.com/legal/repeat/
- i####.####.com/service/getIpInfo2.php?ip=####
- im####.####.com/videos/thumbs/xvideos.gif
- m####.####.com/
- stati####.####.com/v-633669ef2f4/v3/js/skins/min/default.footer.static.js
- sup####.####.com/takedown/
- up####.####.com/account/uploads
- xvi####.com/404
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/databases/Ninja3.db
- <Package Folder>/databases/Ninja3.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
