Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- bcdnup####.####.cc
- c####.####.com
- c####.####.net
- duol####.com
- go####.com
- go####.nl
- hast####.com
- i####.####.com
- i####.####.to
- im####.####.net
- l####.com
- m####.####.com
- m####.####.net
- pag####.####.com
- s####.####.com
- six####.com
- st####.####.com
- t####.####.com
- t####.####.me
- ta####.com
- u####.####.me
- z####.####.com
HTTP GET requests:
- bcdnup####.####.cc/image/5923a0b489dd3.png
- c####.####.com/9.gif?abc=####&rnd=####
- c####.####.com/core.php?web_id=####&t=####
- c####.####.net/apps/adhesion.js
- duol####.com/?ac=####&do=####&cid=####&channel=####&pagesize=####&callba...
- go####.com/search?cx=####&q=####
- go####.nl/cse?cx=####&q=####&gws_rd=####&ei=####
- hast####.com/?ac=####&cid=####&ajax=####&pagesize=####&channel=####&call...
- i####.####.com/portal/html5games/images/tmp/GetTheWeightTeaser.jpg
- i####.####.to/artist/2016/11/21/0603022e866cfa12cf9e10f53042b871-e984a36...
- im####.####.net/creatives/uwb/adc_UWB_community_300x250.gif
- l####.com/static/css/style.css
- m####.####.com/?sprefer=####
- m####.####.net/chewey?event=####&publisher=####&url=####&vsn=####
- pag####.####.com/pagead/js/r20170807/r20170110/show_ads_impl.js?2106####
- s####.####.com/z_stat.php?id=####
- six####.com/?ac=####&num=####&channel=####&callback=####&page=####&_=####
- st####.####.com/uploads/170119/20170119060358808efdd6e1b.jpg
- t####.####.com/api/locnow?callback=####&_=####
- t####.####.me/b6373d68-de13-4a7a-b659-9caf824626fb
- ta####.com/
- z####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&...
HTTP POST requests:
- u####.####.me/api/message
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/f_000032
- <Package Folder>/cache/####/f_000033
- <Package Folder>/cache/####/f_000034
- <Package Folder>/cache/####/f_000035
- <Package Folder>/cache/####/f_000036
- <Package Folder>/cache/####/f_000037
- <Package Folder>/cache/####/f_000038
- <Package Folder>/cache/####/f_000039
- <Package Folder>/cache/####/f_00003a
- <Package Folder>/cache/####/f_00003b
- <Package Folder>/cache/####/f_00003c
- <Package Folder>/cache/####/f_00003d
- <Package Folder>/cache/####/f_00003e
- <Package Folder>/cache/####/f_00003f
- <Package Folder>/cache/####/f_000040
- <Package Folder>/cache/####/f_000041
- <Package Folder>/cache/####/f_000042
- <Package Folder>/cache/####/f_000043
- <Package Folder>/cache/####/f_000044
- <Package Folder>/cache/####/f_000045
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/shared_prefs/first.xml
Miscellaneous:
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
Parses information from SMS messages.
