Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- a####.####.org
- cider####.com
- goth####.pw
- i####.####.com
HTTP GET requests:
- a####.####.org/20temmuz17/ana.php
- cider####.com/
- goth####.pw/
- i####.####.com/2016/8/16/2adde364-9be1-4864-b4b9-0b0bcc81ef2e.jpg
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/142617d2c1e7d2add6c0e2356a47b89a.0.tmp
- <Package Folder>/cache/####/142617d2c1e7d2add6c0e2356a47b89a.1.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
Miscellaneous:
Uses administrator priveleges.
Displays its own windows over windows of other applications.
