Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) fil####.apk####.com:80
- TCP(HTTP/1.1) contro####.viland####.com:80
- TCP(SSL/3.0) gscw####.k####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) st####.ho####.com:443
- TCP(TLS/1.0) con####.face####.net:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) js.hs-scr####.com:443
- TCP(TLS/1.0) js.hscolle####.net:443
- TCP(TLS/1.0) mscom####.vo.ms####.net:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) q.q####.com:443
- TCP(TLS/1.0) js.hs-anal####.net:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) sc####.ho####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) a.q####.com:443
- TCP(TLS/1.0) gscw####.k####.com:443
- TCP(TLS/1.0) f####.hub####.com:443
- TCP(TLS/1.0) serv####.cognito####.com:443
- TCP(TLS/1.0) www.cognito####.com:443
- TCP(TLS/1.0) s####.wpc.8####.####.net:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) geotarg####.app####.com:443
- TCP(TLS/1.0) st####.xx.f####.net:443
- TCP(TLS/1.0) sconten####.xx.f####.net:443
- TCP(TLS/1.0) wi####.many####.com:443
- TCP(TLS/1.0) insi####.ho####.com:443
- TCP(TLS/1.0) hscti####.com:443
- TCP(TLS/1.0) adc####.g.doublec####.net:443
- TCP(TLS/1.0) use.typ####.ne####.####.net:443
DNS requests:
- a####.aspne####.com
- a.q####.com
- adc####.g.doublec####.net
- cdn.iz####.com
- con####.face####.net
- contro####.viland####.com
- f####.google####.com
- f####.gst####.com
- f####.hub####.com
- fil####.apk####.com
- geotarg####.app####.com
- googl####.g.doublec####.net
- hscti####.com
- insi####.ho####.com
- js.hs-anal####.net
- js.hs-scr####.com
- js.hscolle####.net
- many####.com
- pag####.googles####.com
- q.q####.com
- s####.g.doublec####.net
- sc####.ho####.com
- sconten####.xx.f####.net
- serv####.cognito####.com
- set####.viland####.com
- ssl.google-####.com
- st####.ho####.com
- st####.xx.f####.net
- t####.hub####.com
- tpc.googles####.com
- use.typ####.net
- v####.ho####.com
- wi####.many####.com
- wid####.getsite####.com
- www.cognito####.com
- www.face####.com
- www.google-####.com
- www.googlea####.com
HTTP GET requests:
- contro####.viland####.com/apksubs.php?&shortcode=####&keyword=####
- contro####.viland####.com/demo.php
- fil####.apk####.com/games/081216/Fortnite_Mobil.apk
Modified file system:
Creates the following files:
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/ads-1233464334.jar
- /data/data/####/com.google.android.gms.analytics.prefs.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/fortnite.sublanding.vtc4541571.v4_preferences.xml
- /data/data/####/gaClientId
- /data/data/####/google_analytics_v4.db-journal
- /data/data/####/https_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/fortnite.sublanding.vtc4541571.v4.tmp
Miscellaneous:
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.