Android.Hidden.3147

Technical information

Malicious functions:

Removes its shortcut from the home screen.

Network activity:

Connecting to:

ip####.com
taiho####.net

HTTP GET requests:

ip####.com/json
taiho####.net/app/com.toanhoc.admob?mobileId=####&country=####&androidVe...

Modified file system:

Creates the following files:

<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/index
<Package Folder>/cache/1459442732877.jar
<Package Folder>/cache/1459442732877.tmp
<Package Folder>/cache/ApplicationCache.db-journal
<Package Folder>/cache/ApplicationCache.db-journal (deleted)
<Package Folder>/databases/####/https_googleads.g.doubleclick.net_0.localstorage-journal (deleted)
<Package Folder>/databases/google_analytics_v4.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/59639DF50112-0001-0843-7401460C4E48BeginSession.cls_temp
<Package Folder>/files/####/59639DF50112-0001-0843-7401460C4E48SessionApp.cls_temp
<Package Folder>/files/####/59639DF50112-0001-0843-7401460C4E48SessionDevice.cls_temp
<Package Folder>/files/####/59639DF50112-0001-0843-7401460C4E48SessionOS.cls_temp
<Package Folder>/files/####/com.crashlytics.settings.json
<Package Folder>/files/####/initialization_marker (deleted)
<Package Folder>/files/####/session_analytics.tap (deleted)
<Package Folder>/files/####/session_analytics.tap.tmp
<Package Folder>/files/AppEventsLogger.persistedsessioninfo
<Package Folder>/files/gaClientId
<Package Folder>/shared_prefs/<Package>.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/FBAdPrefs.xml
<Package Folder>/shared_prefs/LioneMessi10.xml
<Package Folder>/shared_prefs/SDKIDFA.xml
<Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
<Package Folder>/shared_prefs/com.crashlytics.prefs.xml
<Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
<Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
<Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
<Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
<Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;a.a.a.a.m.xml
<Package Folder>/shared_prefs/multidex.version.xml