Android.Hidden.3404

Technical information

Malicious functions:

Removes its shortcut from the home screen.

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

appo####.####.com
d####.####.com
i####.####.com
m####.####.com
r####.####.com
startap####.com

HTTP GET requests:

appo####.####.com/ap/index.html
d####.####.com/static/images/fullpage_dynamite_bomb/explosion.png
i####.####.com/InApp/resources/info_l.png
m####.####.com/
r####.####.com/1.4/gethtmlad?productId=####&os=####&sdkVersion=####&flav...
startap####.com/1.4/trackdownload?productId=####&os=####&sdkVersion=####...

Modified file system:

Creates the following files:

<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/f_000009
<Package Folder>/cache/####/f_00000a
<Package Folder>/cache/####/f_00000b
<Package Folder>/cache/####/f_00000c
<Package Folder>/cache/####/f_00000d
<Package Folder>/cache/####/f_00000e
<Package Folder>/cache/####/f_00000f
<Package Folder>/cache/####/f_000010
<Package Folder>/cache/####/f_000011
<Package Folder>/cache/####/f_000012
<Package Folder>/cache/####/f_000013
<Package Folder>/cache/####/f_000014
<Package Folder>/cache/####/f_000015
<Package Folder>/cache/####/f_000016
<Package Folder>/cache/####/f_000017
<Package Folder>/cache/####/index
<Package Folder>/cache/1478228129219.dex
<Package Folder>/cache/1478228129219.jar
<Package Folder>/cache/1478228129219.tmp
<Package Folder>/cache/ApplicationCache.db-journal
<Package Folder>/cache/ApplicationCache.db-journal (deleted)
<Package Folder>/databases/####/https_googleads.g.doubleclick.net_0.localstorage-journal (deleted)
<Package Folder>/databases/OneSignal.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/StartappAdInfoMetadata
<Package Folder>/files/StartappBannerMetadata
<Package Folder>/files/StartappCacheMetadata
<Package Folder>/files/StartappMetadata
<Package Folder>/files/StartappSplashMetadata
<Package Folder>/files/back_.png
<Package Folder>/files/back_dark.png
<Package Folder>/files/browser_icon_dark.png
<Package Folder>/files/close_button.png
<Package Folder>/files/empty_star.png
<Package Folder>/files/filled_star.png
<Package Folder>/files/forward_.png
<Package Folder>/files/forward_dark.png
<Package Folder>/files/half_star.png
<Package Folder>/files/logo.png
<Package Folder>/files/shared_prefs_sdk_ad_prefs
<Package Folder>/files/x_dark.png
<Package Folder>/shared_prefs/<Package>.xml
<Package Folder>/shared_prefs/APPFIREWORKS.xml
<Package Folder>/shared_prefs/OneSignal.xml
<Package Folder>/shared_prefs/admob.xml
<Package Folder>/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml
<Package Folder>/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml.bak
<Package Folder>/shared_prefs/com.startapp.android.publish.xml
<Package Folder>/shared_prefs/com.startapp.android.publish.xml.bak