Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c.parking####.net:80
- TCP(HTTP/1.1) d1lxhc4####.cloudf####.net:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) b####.ly:80
- TCP(HTTP/1.1) 1####.8.224.93:80
- TCP(HTTP/1.1) d2bfa0z####.cloudf####.net:80
- TCP(HTTP/1.1) d258j80####.cloudf####.net:80
- TCP(HTTP/1.1) afs.googleu####.com:80
- TCP(HTTP/1.1) slot####.e####.com.####.net:80
- TCP(HTTP/1.1) www.gst####.com:80
- TCP(HTTP/1.1) ww7.mobilsi####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(TLS/1.0) srv.eba####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) m.e####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) r####.e####.com:443
- TCP(TLS/1.0) ocs####.e####.com:443
- TCP(TLS/1.0) slot1####.e####.com.####.net:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) slot####.e####.com.####.net:443
- TCP(TLS/1.0) gha.e####.com:443
DNS requests:
- adser####.go####.com
- afs.googleu####.com
- b####.ly
- c.parking####.net
- d1lxhc4####.cloudf####.net
- d258j80####.cloudf####.net
- d2bfa0z####.cloudf####.net
- gha.e####.com
- i.eba####.com
- ir.ebayst####.com
- m.e####.com
- ocs####.e####.com
- p.ebayst####.com
- r####.e####.com
- s####.eba####.com
- srv.m####.eba####.com
- ssl.gst####.com
- ww7.mobilsi####.com
- www.e####.com
- www.go####.com
- www.go####.nl
- www.google-####.com
- www.gst####.com
HTTP GET requests:
- afs.googleu####.com/dp-teaminternet/uni_blank1.gif
- b####.ly/1zDHbUH
- c.parking####.net/scripts/sale_form.js
- d1lxhc4####.cloudf####.net/scripts/js3caf.js
- d1lxhc4####.cloudf####.net/themes/MobileCleanBlack_2d55d9b3/img/bg10.png
- d1lxhc4####.cloudf####.net/themes/MobileCleanBlack_2d55d9b3/img/bg10wide...
- d1lxhc4####.cloudf####.net/themes/MobileCleanBlack_2d55d9b3/style.css
- d1lxhc4####.cloudf####.net/themes/saledefaultmobile.css
- d258j80####.cloudf####.net/rmgjsc/zcFilters.js?1####
- d2bfa0z####.cloudf####.net/rmgjsc/zcFilters.js?1####
- slot####.e####.com.####.net/
- ww7.mobilsi####.com/
- ww7.mobilsi####.com/favicon.ico
- ww7.mobilsi####.com/track.php?domain=####&caf=####&toggle=####&answer=##...
- ww7.mobilsi####.com/track.php?domain=####&toggle=####&uid=MTU####
- www.go####.com/adsense/domains/caf.js
- www.go####.com/dp/ads?max_radlink_len=####&r=####&client=####&channel=##...
- www.go####.com/dp/ads?max_radlink_len=40&r=m&client=dp-mobile-teamintern...
- www.google-####.com/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&...
- www.google-####.com/ga.js
- www.google-####.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1293128478&utmhn...
- www.gst####.com/domainads/tracking/caf.gif?ts=####&rid=####
Miscellaneous:
Displays its own windows over windows of other applications.
