Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- a####.####.org
- adsp####.####.com
- c####.####.net
- c####.####.ng
- chuby####.net
- f####.####.com
- i####.####.com
- kook####.net
- lol####.net
- s####.####.com
- s####.####.net
- t####.####.com
- youngte####.com
HTTP GET requests:
- a####.####.org/20temmuz17/ana.php
- adsp####.####.com/speedclicks/out.php?1=####&pid=####&siteid=####&spacei...
- c####.####.net/pop.js
- c####.####.ng/topsites/button.php?u=####
- chuby####.net/
- f####.####.com/css?family=####
- f####.####.com/s/lato/v13/MZ1aViPqjfvZwVD_tzjjkwLUuEpTyoUstqEm5AMlJo4.ttf
- i####.####.com/2016/11/16/1d935cc5-a1e7-4779-bdfa-20fd7a60724c.jpg@!640_...
- kook####.net/
- lol####.net/wp-content/themes/annina-pro/fonts/fontawesome-webfont.ttf?v...
- s####.####.com/out.php?s=####&o=####
- s####.####.net/checkInventory.php?w=####&v=####&siteId=####&minBid=####&...
- t####.####.com/mobiledirect/?aid=####&cwsid=####&subid=####
- youngte####.com/st/thumbs/614/ZLRHiftHvf.jpg
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/003c820c2bc202486bb6b18184a549e6.0.tmp
- <Package Folder>/cache/####/003c820c2bc202486bb6b18184a549e6.1.tmp
- <Package Folder>/cache/####/0edf6ba8ab32fe63a3b80adac5bbc885.0.tmp
- <Package Folder>/cache/####/0edf6ba8ab32fe63a3b80adac5bbc885.1.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal (deleted)
Miscellaneous:
Uses administrator priveleges.
Displays its own windows over windows of other applications.
