Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- go####.com
- x####.####.com
- du####.####.online
- google-####.com
- z50j1tm####.ru
- d####.####.net
- parking####.net
- d1grtyy####.####.net
- f####.####.com
- gst####.com
- rewards####.####.co
- getsear####.com
- lookt####.com
- volumel####.com
- w####.####.com
- t####.####.info
- c####.####.net
- crea####.####.com
- b####.####.com
HTTP GET requests:
- x####.####.com/click?i=####
- gst####.com/s/productsans/v9/HYvgU2fE2nRJvZ5JFAumwZS3E-kSBmtLoNJPDtbj2Pk...
- gst####.com/domainads/images/chevron-white.png
- go####.com/policies/css/default.css
- rewards####.####.co/iphone7/nl/btest/v0505/10.jpg
- rewards####.####.co/iphone7/nl/btest/v0505/iphone6.png
- du####.####.online/flag.png
- parking####.net/privacy.html
- gst####.com/s/robotodraft/v4/u0_CMoUf3y3-4Ss4ci-VwTdGNerWpg2Hn6A-BxWgZ_I...
- d1grtyy####.####.net/scripts/js3caf.js
- google-####.com/r/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&ut...
- rewards####.####.co/iphone7/nl/btest/v0505/11.jpg
- d####.####.net/apps/domainpark/domainpark.cgi?max_radlink_len=####&r=###...
- go####.com/adsense/domains/caf.js
- w####.####.com/track.php?domain=####&caf=####&toggle=####&feed=####&uid=...
- w####.####.com/track.php?domain=####&toggle=####&uid=####
- google-####.com/ga.js
- d1grtyy####.####.net/themes/saledefault.css
- go####.com/images/branding/googlelogo/1x/googlelogo_color_116x41dp.png
- getsear####.com/site_total.php?c=####
- rewards####.####.co/iphone7/nl/btest/v0505/item3.png
- rewards####.####.co/iphone7/nl/btest/v0505/item1.png
- go####.com/policies/privacy/partners/
- rewards####.####.co/iphone7/nl/btest/v0505/index0505.html?model=####&cit...
- go####.com/js/maia.js
- gst####.com/s/robotodraft/v4/0xES5Sl_v6oyT7dAKuoniywlidHJgAgmTjOEEzwu1L8...
- gst####.com/s/robotodraft/v4/u0_CMoUf3y3-4Ss4ci-Vwd6Naowg1QhaIq8kLGtQSos...
- d1grtyy####.####.net/themes/coloredPointers_68da23f7/style.css
- rewards####.####.co/iphone7/nl/btest/v0505/like.png
- d1grtyy####.####.net/themes/coloredPointers_68da23f7/img/bottom.png
- go####.com/js/google.js
- rewards####.####.co/iphone7/nl/btest/v0505/search.png
- rewards####.####.co/iphone7/nl/btest/v0505/iphone7.jpg
- b####.####.com/attribution/25529/57941?devicetype=####&os=####&subid=###...
- gst####.com/s/poppins/v1/87Va_S9dMbGdG4LlxT5ySQLUuEpTyoUstqEm5AMlJo4.ttf
- crea####.####.com/pop-imp/25529/57941?devicetype=####&browser=####&os=##...
- f####.####.com/css?family=####
- gst####.com/s/robotodraft/v4/u0_CMoUf3y3-4Ss4ci-VwbqoDFxW0sKUoJN81ZzAEu8...
- t####.####.info/84198ae0-4038-4975-8bd2-f6aa5a4604cb?channelid=####&crea...
- go####.com/css/maia.experimental.css
- d1grtyy####.####.net/themes/assets/style.css
- rewards####.####.co/iphone7/nl/btest/v0505/index.html
- gst####.com/domainads/tracking/caf.gif?ts=####&rid=####
- rewards####.####.co/iphone7/nl/btest/v0505/ip7.png
- w####.####.com/track.php?domain=####&caf=####&toggle=####&answer=####&ui...
- getsear####.com/Look%20Search%20Trace_files/style.css
- w####.####.com/?gkwrf=####
- rewards####.####.co/iphone7/nl/btest/v0505/ip7s.png
- rewards####.####.co/iphone7/nl/btest/v0505/8.jpg
- c####.####.net/scripts/sale_form.js
- volumel####.com/distract/offer.php
- f####.####.com/css?family=####&lang=####
- rewards####.####.co/iphone7/nl/btest/v0505/9.jpg
- rewards####.####.co/iphone7/nl/btest/v0505/item2.png
HTTP POST requests:
- lookt####.com/mshow.php?id=####&aff=####&data=####&dl=####&rc=####
- z50j1tm####.ru/apk_main.php?get_hash=####
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/shared_prefs/semipref.xml
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/shared_prefs/semipref.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
