Android.Hidden.3213

Technical information

Malicious functions:

Removes its shortcut from the home screen.

Network activity:

Connecting to:

an####.ru
android####.ru

HTTP GET requests:

android####.ru/file-log.html

HTTP POST requests:

an####.ru/log.php

Modified file system:

Creates the following files:

<Package Folder>/databases/SettingsDB
<Package Folder>/databases/SettingsDB-journal
<Package Folder>/databases/SettingsDB-journal (deleted)
<Package Folder>/files/####/592E792E02EA-0001-080B-1C3256FF2485BeginSession.cls_temp
<Package Folder>/files/####/592E792E02EA-0001-080B-1C3256FF2485SessionApp.cls_temp
<Package Folder>/files/####/592E792E02EA-0001-080B-1C3256FF2485SessionDevice.cls_temp
<Package Folder>/files/####/592E792E02EA-0001-080B-1C3256FF2485SessionOS.cls_temp
<Package Folder>/files/####/592E792E02EA-0001-080B-1C3256FF2485SessionUser.cls_temp
<Package Folder>/files/####/592E792E02EA-0001-080B-1C3256FF2485user.meta
<Package Folder>/files/####/592E792F0192-0001-083F-1C3256FF2485BeginSession.cls_temp
<Package Folder>/files/####/592E792F0192-0001-083F-1C3256FF2485SessionApp.cls_temp
<Package Folder>/files/####/592E792F0192-0001-083F-1C3256FF2485SessionDevice.cls_temp
<Package Folder>/files/####/592E792F0192-0001-083F-1C3256FF2485SessionOS.cls_temp
<Package Folder>/files/####/592E792F0192-0001-083F-1C3256FF2485user.meta
<Package Folder>/files/####/com.crashlytics.settings.json
<Package Folder>/files/####/crashlytics-userlog-592E792F0192-0001-083F-1C3256FF2485.temp.tmp
<Package Folder>/files/####/initialization_marker
<Package Folder>/files/####/sa_039fb492-2ac5-48fe-b086-c4a7dd5784f6_1496217902827.tap
<Package Folder>/files/####/session_analytics.tap
<Package Folder>/files/####/session_analytics.tap.tmp
<Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
<Package Folder>/shared_prefs/com.crashlytics.prefs.xml
<Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
<Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.fabric.sdk.android.Onboarding.xml
<SD-Card>/.androidmonitor/log.txt
<SD-Card>/.androidmonitor/log_.txt
<SD-Card>/.androidmonitor/log_.txt.zip
<SD-Card>/.androidmonitor/log_1496217902705.txt.zip
<SD-Card>/.androidmonitor/log_1496217903348.txt.zip
<SD-Card>/.androidmonitor/monitorchecker.apk
<SD-Card>/.androidmonitor/prog_class.name