Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- s####.####.com
- s####.####.xyz
- extreme####.pw
- f####.####.com
- syndica####.####.com
HTTP GET requests:
- extreme####.pw/wp-content/themes/detube/images/s2.png
- extreme####.pw/wp-content/uploads/2017/04/home-alone-satisfaction.jpg
- extreme####.pw/wp-content/uploads/2017/04/ben-a-handsome-straight-guy-se...
- extreme####.pw/wp-content/uploads/2017/04/hamepuraimu-oheyasagashi-manua...
- extreme####.pw/wp-content/uploads/2017/04/after-party-blonde-wants-sex.jpg
- extreme####.pw/wp-includes/js/masonry.min.js?ver=####
- extreme####.pw/wp-content/uploads/2017/04/brianna-love-enjoys-her-man.jpg
- extreme####.pw/wp-content/uploads/2017/04/babe-gets-fucked-by-a-huge-coc...
- extreme####.pw/wp-content/uploads/2017/04/double-penetration-with-massiv...
- syndica####.####.com/splash.php?idzone=####
- extreme####.pw/wp-includes/js/wp-embed.min.js?ver=####
- extreme####.pw/wp-content/uploads/2017/04/shooting-a-load-of-cum-real-qu...
- extreme####.pw/wp-content/themes/detube/images/icon-plus-24.png
- extreme####.pw/wp-content/uploads/2017/04/a093-shawns-audition.jpg
- extreme####.pw/wp-content/uploads/2017/04/hardcore-penetrate-before-fire...
- extreme####.pw/wp-content/uploads/2017/04/black-velvet-5-scene-3.jpg
- extreme####.pw/wp-content/themes/detube/js/theme.js?ver=####
- extreme####.pw/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- extreme####.pw/wp-content/themes/detube/images/nav-sep.png
- extreme####.pw/wp-content/uploads/2017/04/nice-pussy-upskirt.jpg
- extreme####.pw/wp-includes/js/jquery/jquery.js?ver=####
- extreme####.pw/wp-content/uploads/2017/04/softcore-nudes-622-60s-and-70s...
- extreme####.pw/wp-content/themes/detube/js/jquery.plugins.min.js?ver=####
- extreme####.pw/
- extreme####.pw/wp-content/uploads/2017/04/ala-pantyhose-tease.jpg
- extreme####.pw/wp-content/uploads/2017/04/club-orgy.jpg
- extreme####.pw/wp-content/uploads/2017/04/anal-copulate-with-big-black-c...
- extreme####.pw/wp-content/uploads/2017/04/livingoffyourtitaddiction.jpg
- extreme####.pw/wp-content/uploads/2017/04/take-a-trip-home.jpg
- extreme####.pw/wp-content/uploads/2017/04/two-lesiban-teens-smoke-cigare...
- s####.####.xyz/tmbuess
- extreme####.pw/wp-content/plugins/wp-pagenavi/pagenavi-css.css?ver=####
- extreme####.pw/wp-content/uploads/2017/04/transsexual-heartbreakers-11-s...
- extreme####.pw/wp-content/themes/detube/js/jquery.fitvids.js?ver=####
- extreme####.pw/wp-content/uploads/2017/04/extremetube-1.png
- extreme####.pw/wp-content/uploads/2017/04/indian-couple-from-lucknow-hon...
- extreme####.pw/wp-content/uploads/2017/04/classic-vintage-nurses-fun.jpg
- extreme####.pw/wp-content/uploads/2017/04/hypnoslavetpe1.jpg
- extreme####.pw/wp-content/themes/detube/responsive.css?ver=####
- extreme####.pw/wp-content/uploads/2017/04/big-member-jerk-off.jpg
- extreme####.pw/wp-content/themes/detube/images/view.png
- extreme####.pw/wp-content/uploads/2017/04/cute_innocent_looking_teen_in_...
- extreme####.pw/wp-content/uploads/2017/04/woox-let-me-to-wank-your-huge-...
- s####.####.com/js/300/addthis_widget.js
- extreme####.pw/wp-content/themes/detube/style.css?ver=####
- extreme####.pw/wp-content/themes/detube/images/bg-grad.png
- extreme####.pw/wp-content/uploads/2017/04/aiko-hirose-japanese-babe-give...
- extreme####.pw/wp-includes/js/imagesloaded.min.js?ver=####
- extreme####.pw/wp-content/uploads/2017/04/hot-german-mature.jpg
- extreme####.pw/wp-includes/js/wp-emoji-release.min.js?ver=####
- extreme####.pw/wp-content/themes/detube/images/bg-pattern-nav.png
- extreme####.pw/wp-content/uploads/2017/04/iamyournewreligion_windows-med...
- extreme####.pw/wp-content/themes/detube/images/bg-pattern.png
- extreme####.pw/wp-content/themes/detube/images/s.png
- extreme####.pw/wp-includes/js/jquery/jquery.masonry.min.js?ver=####
- extreme####.pw/wp-content/uploads/2017/04/horny-petite-asian-slamming-he...
- extreme####.pw/wp-content/uploads/2017/04/my-ex-squirting-for-me.jpg
- extreme####.pw/wp-content/themes/detube/js/modernizr.min.js?ver=####
- syndica####.####.com/ads-priv.php?i=####
- f####.####.com/s/opensans/v13/MTP_ySUJH_bn48VBG8sNSpS3E-kSBmtLoNJPDtbj2P...
- f####.####.com/css?family=####&ver=####
- f####.####.com/s/opensans/v13/k3k702ZOKiLJc3WVjuplzJS3E-kSBmtLoNJPDtbj2P...
Modified file system:
Creates the following files:
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/shared_prefs/Ulke10.xml
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Contains functionality to send SMS messages automatically.
