Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) plat####.twi####.com:80
- TCP(HTTP/1.1) waws-pr####.vip.azurewe####.####.net:80
- TCP(HTTP/1.1) g####.gl:80
- TCP(HTTP/1.1) stat####.face####.com:80
- TCP(HTTP/1.1) az41####.vo.ms####.net:80
- TCP(HTTP/1.1) con####.face####.net:80
- TCP(TLS/1.0) plat####.twi####.com:443
- TCP(TLS/1.0) im####.a####.com.####.net:443
- TCP(TLS/1.0) stat####.face####.com:443
- TCP(TLS/1.0) celebsl####.b####.c####.####.net:443
- TCP(TLS/1.0) applegl####.ad####.net:443
- TCP(TLS/1.0) it####.a####.com.####.net:443
- TCP(TLS/1.0) mzst####.com.edg####.net:443
- TCP(TLS/1.0) 2####.58.212.206:443
- TCP(TLS/1.0) syndica####.twi####.com:443
- TCP(TLS/1.0) www.a####.com.####.net:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) web-exp####.it####.a####.####.net:443
- TCP(TLS/1.0) a####.ms:443
DNS requests:
- a####.ms
- az41####.vo.ms####.net
- celebsl####.b####.c####.####.net
- con####.face####.net
- g####.gl
- im####.a####.com
- is1####.mzst####.com
- is2####.mzst####.com
- is3####.mzst####.com
- is4####.mzst####.com
- is5####.mzst####.com
- it####.a####.com
- plat####.twi####.com
- securem####.a####.com
- stat####.face####.com
- syndica####.twi####.com
- web-exp####.it####.a####.com
- www.a####.com
- www.celebs####.me
- www.face####.com
HTTP GET requests:
- az41####.vo.ms####.net/scripts/a/ai.0.js
- con####.face####.net/en_US/sdk.js
- g####.gl/W3kMXh
- plat####.twi####.com/widgets.js
- stat####.face####.com/connect/xd_arbiter/r/Nh1oH0K63yz.js?version=####
- waws-pr####.vip.azurewe####.####.net/
- waws-pr####.vip.azurewe####.####.net/Content/css?v=####
- waws-pr####.vip.azurewe####.####.net/Images/bar-mobile@2x.png
- waws-pr####.vip.azurewe####.####.net/Images/bg-banner.png
- waws-pr####.vip.azurewe####.####.net/Images/bing-logo-search-bar@2x.png
- waws-pr####.vip.azurewe####.####.net/Images/bing-logo@2x.png
- waws-pr####.vip.azurewe####.####.net/Images/icn-facebook.png
- waws-pr####.vip.azurewe####.####.net/Images/icn-facebook@2x.png
- waws-pr####.vip.azurewe####.####.net/Images/icn-twitter.png
- waws-pr####.vip.azurewe####.####.net/Images/icn-twitter@2x.png
- waws-pr####.vip.azurewe####.####.net/Images/magnifying-glass@2x.png
- waws-pr####.vip.azurewe####.####.net/Images/microsoft-rev-01.png
- waws-pr####.vip.azurewe####.####.net/Images/placeholder.png
- waws-pr####.vip.azurewe####.####.net/bundles/bootstrap?v=####
- waws-pr####.vip.azurewe####.####.net/bundles/clm?v=####
- waws-pr####.vip.azurewe####.####.net/bundles/javascript?v=####
- waws-pr####.vip.azurewe####.####.net/bundles/jquery?v=####
- waws-pr####.vip.azurewe####.####.net/bundles/modernizr?v=####
- waws-pr####.vip.azurewe####.####.net/bundles/share?v=####
Modified file system:
Creates the following files:
- <Package Folder>/databases/__pushe_base_lib_db-journal
- <Package Folder>/databases/evernote_jobs.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/unsent_requests
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/co.ronash.pushe.keystore.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/evernote_jobs.xml
Miscellaneous:
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
