Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- 5####.####.com
- ap####.mobi
- f####.####.gdn
- wap####.ru
- b####.com
- profi####.ru
- datat####.com
- oxoc####.com
- namet####.com
HTTP GET requests:
- b####.com/rms/BingCore.Bundle/cj,nj/4ec5679f/05acd042.js?bu=####
- b####.com/rms/rms%20answers%20Shared%20BingCore$Animation/cj,nj/c9ce19fd...
- b####.com/rms/MobileSiteBase/cc,nc/8d0342e9/e3492d89.css?bu=####
- b####.com/rms/rms%20answers%20Identity%20Mobile$HamburgerMenuOnClick/cj,...
- b####.com/notifications/render?bnptrigger=####&IG=####&IID=####
- wap####.ru/click/10372?subid1=####&subid2=####
- 5####.####.com/?kw=####&s2=####
- datat####.com/d/6686958121d9ae5ef0?sub=####&sub2=####&do=####&test=####
- b####.com/?id=####&ip=####&ua=####&r=####
- b####.com/rms/rms%20answers%20Shared%20BingCore$fadeAnimation/cj,nj/8c49...
- oxoc####.com/tds?l=####&
- ap####.mobi/red/e03f908b-9ce6-11e6-8b9b-0cc47a44dbaa/?alg=####&clickid=#...
- f####.####.gdn/?sov=####&hid=####&&redid=####&gsid=####&campaign_id=####...
- namet####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####&sub...
- oxoc####.com/tds?l=####
- b####.com/rms/AutoSug/cj,nj/5d4a1743/724a3e06.js?bu=####
- namet####.com/d/6686958121d9ae5ef0?sub=####&sub2=####
- b####.com/rms/Framework/cj,nj/f0fe13d0/9101d3f2.js?bu=####
- f####.####.gdn/TES672bingALL.html
- oxoc####.com/aff_c?offer_id=####&aff_id=####&type=####&l=####&
HTTP POST requests:
- b####.com/fd/ls/lsp.aspx?
- profi####.ru/statb2.php
- b####.com/fd/ls/lsp.aspx
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/shared_prefs/####.xml
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/data_1
Miscellaneous:
Contains functionality to send SMS messages automatically.
