Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- s####.####.com
- x####.####.com
- v5w3gcn####.ru
- lookt####.com
HTTP GET requests:
- x####.####.com/click?i=####
- s####.####.com/script/packcpm.php?stamat=####
- x####.####.com/filter?q=####&i=####&t=####
- v5w3gcn####.ru/Look%20Search%20Trace_files/style.css
- s####.####.com/script/packcpm.php?stamat=####&treqn=####&rpn=####&cbrand...
- x####.####.com/click2?i=####&f=####&j=####
- v5w3gcn####.ru/site_total.php?c=####
HTTP POST requests:
- v5w3gcn####.ru/apk_main.php?get_hash=####
- lookt####.com/mshow.php?id=####&aff=####&data=####&dl=####&rc=####
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/semipref.xml.bak
- /data/data/####/shared_prefs/semipref.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
