Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google Host>
- TCP(Google Services) <Google Host>
- TCP(Google Services) <Google Host>
- TCP(HTTP/1.1) x####.tv:80
- TCP(HTTP/1.1) mynewro####.com:80
- TCP(HTTP/1.1) bonga####.com:80
- TCP(HTTP/1.1) hy####.com:80
- TCP(HTTP/1.1) p.axc####.store:80
- TCP(HTTP/1.1) w####.d.ybos####.us:80
- TCP(HTTP/1.1) t####.bruce####.com:80
- TCP(HTTP/1.1) syndica####.exoc####.com:80
- TCP(HTTP/1.1) koolm####.info:80
- TCP(HTTP/1.1) l####.adsbt####.com:80
- TCP(HTTP/1.1) t####.bonga####.com:80
- TCP(TLS/1.1) syndica####.exoc####.com:443
- TCP(TLS/1.1) www.go####.com:443
- TCP(TLS/1.1) www.google-####.com:443
- TCP(TLS/1.1) mobioff####.com:443
- TCP(TLS/1.1) i.bonga####.com:443
- TCP(TLS/1.1) d5nxst8####.cloudf####.net:443
- TCP(TLS/1.1) nl.bonga####.com:443
- TCP(TLS/1.1) bonga####.com:443
- TCP(TLS/1.1) s####.i8.bonga####.net:443
- TCP(TLS/1.1) d31qbv1####.cloudf####.net:443
DNS requests:
- bonga####.com
- d31qbv1####.cloudf####.net
- d5nxst8####.cloudf####.net
- hy####.com
- i.bonga####.com
- i1.bonga####.com
- i2.bonga####.com
- i3.bonga####.com
- koolm####.info
- mobioff####.com
- mynewro####.com
- n####.instada####.club
- nl.bonga####.com
- p.axc####.store
- syndica####.exoc####.com
- t####.bonga####.com
- t####.bruce####.com
- w####.c.ybos####.us
- w####.d.ybos####.us
- www.go####.com
- www.google-####.com
- x####.tv
- y####.instagi####.com
HTTP GET requests:
- hy####.com/28c88/4acA/76MQ/t-9Gs6VqQqhPDf90kuSEkwfUilazdHh9y49YpYOEnDUQz...
- hy####.com/33E10/a7_L/f7yG/e7GXXqk/KfTABPVZJ-di6XI8hUUwNXp1W83vMWCTx0tBV...
- l####.adsbt####.com/c/679efeecdc3b4d07?&ijykJHsadL5=####&click_id=####&s...
- l####.adsbt####.com/c/da57dc555e50572d?s1=####&s2=####&s3=####&click_i####
- p.axc####.store/?vr=####
- syndica####.exoc####.com/ads-priv.php?i=####
- syndica####.exoc####.com/splash.php?cat=####&idzone=####&type=####&p=###...
- w####.d.ybos####.us/?vr=####
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/index
- <Package Folder>/databases/music_db
- <Package Folder>/databases/music_db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
Miscellaneous:
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
Uses administrator priveleges.
Displays its own windows over windows of other applications.
