Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) offer####.online:80
- TCP(HTTP/1.1) tretras####.com:80
- TCP(HTTP/1.1) fantast####.accountant:80
- TCP(HTTP/1.1) ads.apio####.com:80
- TCP(HTTP/1.1) d.billyaf####.com:80
- TCP(HTTP/1.1) q####.k####.gdn:80
- TCP(HTTP/1.1) t####.shootfo####.com:80
- TCP(HTTP/1.1) api.l####.com:80
- TCP(HTTP/1.1) u####.o72vja0####.n####.xyz:80
- TCP(HTTP/1.1) ald####.com:80
- TCP(HTTP/1.1) cpgnrot####.com:80
- TCP(TLS/1.0) billmsc####.com:443
- TCP(TLS/1.0) digital####.com:443
DNS requests:
- ads.apio####.com
- ald####.com
- api.ki####.com
- api.l####.com
- billmsc####.com
- cpgnrot####.com
- d.billyaf####.com
- digital####.com
- fantast####.accountant
- ilv####.com
- offer####.online
- q####.k####.gdn
- t####.bruce####.com
- t####.shootfo####.com
- u####.o72vja0####.n####.xyz
HTTP GET requests:
- ads.apio####.com/sub/log?url=####
- ads.apio####.com/sub/log?url=aHR####
- ald####.com/ck.php?line_item_id=####&cid=####&site=####&_uu=####
- ald####.com/ck_jump?id=cz03####&__if=####&__type=####&__ref=####
- api.l####.com/click?tid=####
- api.l####.com/sdkOffer?s=####&u=####&rt=####&at=####&androidId=####&gaid...
- cpgnrot####.com/campaign/8741|656?tag=####&token1=####&_uu=####
- d.billyaf####.com/d/11685513e11bcfa62?sub=####&sub2=####
- d.billyaf####.com/d/11685513e11bcfa62?sub=####&sub2=####&code=####
- d.billyaf####.com/gw?url=https://billmscurlrev.com/c/0e3d3438-e3bf-11e6-...
- fantast####.accountant/10.jpg
- fantast####.accountant/11.jpg
- fantast####.accountant/7.jpg
- fantast####.accountant/8.jpg
- fantast####.accountant/9.jpg
- fantast####.accountant/?brand=####&model=####&browser=####&td=####&swim=...
- fantast####.accountant/flag.png
- fantast####.accountant/index.html
- fantast####.accountant/ip7.png
- fantast####.accountant/iphone6.jpg
- fantast####.accountant/iphone7.jpg
- fantast####.accountant/item1.png
- fantast####.accountant/item2.png
- fantast####.accountant/item3.png
- fantast####.accountant/like.png
- fantast####.accountant/search.png
- offer####.online/r/273bd1c0-e8d9-11e7-9e7f-1144d1808627/0/
- offer####.online/r/273bd1c0-e8d9-11e7-9e7f-1144d1808627/1/
- offer####.online/r/283796c2-e8d9-11e7-b1c4-1144ab93a5bd/0/
- offer####.online/r/283796c2-e8d9-11e7-b1c4-1144ab93a5bd/1/
- offer####.online/r/28af199a-e8d9-11e7-a4d9-11434cccd185/0/
- offer####.online/r/28af199a-e8d9-11e7-a4d9-11434cccd185/1/
- q####.k####.gdn/?s2=####&s3=####&kw=Qzo3####&s2=Uzox####&s1=####
- t####.shootfo####.com/11cd47e4-49c1-4fe7-8e7f-c47c97665cc1?clickid=####&...
- tretras####.com/55K39/N-7P/Oerf/YaaPe2WRVZ5lZxs3BIiYiZ7_bHHhvSwwgn5hPHpE...
- u####.o72vja0####.n####.xyz/HON949sweeps1NL.html?sov=####&hid=####&cntrl...
HTTP POST requests:
- u####.o72vja0####.n####.xyz/?sov=####&hid=####&&cntrl=####&pid=####&redi...
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/WebViewSettings.xml
Miscellaneous:
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
