Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- lo####.####.net
- a####.####.net
- p####.####.com
- set####.####.com
- sc####.####.com
- cdn####.####.com
- n####.####.com
- a####.####.com
- hy####.####.com
HTTP GET requests:
- hy####.####.com/offerwall/js/base64.js?v=####
- sc####.####.com/v1/scheme/placement?model=####&mcc=####&os_v=####&direct...
- hy####.####.com/offerwall/js/windvane.debug.js?v=####
- cdn####.####.com/cdn-adn/offersync/17/05/31/12/40/592e49380e08c.jpg
- a####.####.net/api/v2/template/get?slot_id=####&update_time=####
- a####.####.net/api/v2/native/get?dml=####&dt=####&nt=####&mcc=####&bast=...
- hy####.####.com/offerwall/tpl/interstital.html?unit_id=####&sdk_version=...
- a####.####.com/mpapi/ad?model=####&fomat=####&mcc=####&os_v=####&directi...
- hy####.####.com/offerwall/img/star_w.png
- cdn####.####.com/cdn-adn/offersync/17/03/13/16/14/58c654d6792d5.png
- hy####.####.com/offerwall/js/interstital.js?v=####
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&req_type=####&sign...
- hy####.####.com/offerwall/img/interstitalbg.jpg
- a####.####.net/api/v2/cache/get?dml=####&dt=####&nt=####&mcc=####&bast=#...
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&sign=####&category...
- cdn####.####.com/cdn-adn/offersync/17/03/28/18/30/58da3b5f853e1.jpg
- cdn####.####.com/cdn-adn/offersync/17/04/21/07/35/58f945a76371f.png
- sc####.####.com/v1/scheme/app?model=####&mcc=####&os_v=####&direction=##...
- set####.####.com/appwall/setting?app_id=####&sign=####&platform=####&os_...
- set####.####.com/setting?unit_ids=####&app_id=####&sign=####&platform=##...
- set####.####.com/setting?app_id=####&sign=####&platform=####&os_version=...
- hy####.####.com/offerwall/img/star.png
- n####.####.com/openapi/ad/v3?app_id=####&unit_id=####&category=####&req_...
- hy####.####.com/offerwall/js/util.js?v=####
HTTP POST requests:
- lo####.####.net/debug/v2/android
- p####.####.com/myservercb/api/1800
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/PancouCacheData_ztop.xml
- <Package Folder>/shared_prefs/ct_default.xml
- <Package Folder>/shared_prefs/postTime.xml
- <Package Folder>/shared_prefs/com.mobpower.xml.bak
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/shared_prefs/TOKEN.xml
- <Package Folder>/shared_prefs/share_date.xml
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/log/agent_log
- <Package Folder>/databases/mobvista.msdk.db-journal
- <Package Folder>/shared_prefs/mobvista.xml.bak
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/com.mobpower.xml
- <Package Folder>/shared_prefs/mobvista.xml
- <Package Folder>/databases/mobpower.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Contains functionality to send SMS messages automatically.
