Technical information
Malicious functions:
Removes its shortcut from the home screen.
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- a####.####.org
- artul####.com
- bonga####.com
- hornny####.com
- hotdate####.com
- i####.####.com
- ip####.com
- nakeed####.com
- p####.####.link
- prmob####.com
- syndica####.####.com
- t####.####.com
HTTP GET requests:
- a####.####.org/20temmuz17/papas2.php
- artul####.com/26C47/Mvjt/Jvug/Ivaxs1A/cLPh5ArjvQdo4RZ9yqFIfKAt8XEtk-F7MM...
- bonga####.com/track?c=####&ps=####&csurl=####&subid=####
- hornny####.com/
- hotdate####.com/cookie/js.cookie.js
- i####.####.com/00d/216/304/0ac385dd86ee6658213e1107be3dc51d_thumb_medium...
- i####.####.com/021/250/020/bd712fa9dbeb69e44e5ec1deeb25c95a_thumb_medium...
- i####.####.com/2016/11/14/a019ffc1-556c-4a85-b70c-b1b49811d577.jpg@!640_...
- i####.####.com/popunders/map/img/marker-back.png
- ip####.com/json/?lang=####
- nakeed####.com/bd/indonesia%20mms%20sex/
- p####.####.link/c/679efeecdc3b4d07?&ijykJHsadL5=####&click_id=####&s1=##...
- prmob####.com/nakeedtube.com/nvsn/direct
- syndica####.####.com/splash.php?cat=####&idzone=####&type=####&p=####&su...
- t####.####.com/hit.php?c=####&ps=####&csurl=####&subid=####
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/003c820c2bc202486bb6b18184a549e6.0.tmp
- <Package Folder>/cache/####/003c820c2bc202486bb6b18184a549e6.1.tmp
- <Package Folder>/cache/####/0edf6ba8ab32fe63a3b80adac5bbc885.0.tmp
- <Package Folder>/cache/####/0edf6ba8ab32fe63a3b80adac5bbc885.1.tmp
- <Package Folder>/cache/####/142617d2c1e7d2add6c0e2356a47b89a.0.tmp
- <Package Folder>/cache/####/142617d2c1e7d2add6c0e2356a47b89a.1.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/fa89c869eec0d46e1b0369aeb5726356.0.tmp
- <Package Folder>/cache/####/fa89c869eec0d46e1b0369aeb5726356.1.tmp
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
Miscellaneous:
Uses administrator priveleges.
Displays its own windows over windows of other applications.