Android.Hidden.1904

Technical information

Malicious functions:

Removes its shortcut from the home screen.

Modified file system:

Creates the following files:

/data/data/####/shared_prefs/informator.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_42af3802-33a2-480d-b28e-289c4b436d5c_1485418488224.tap
/data/data/####/shared_prefs/TwitterAdvertisingInfoPreferences.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889B01A00BD-0001-0896-A5A577926453SessionDevice.cls_temp
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889AFF700CE-0001-0837-A5A577926453SessionApp.cls_temp
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889B01A00BD-0001-0896-A5A577926453BeginSession.cls_temp
/data/data/####/shared_prefs/####dbadfhbgdefh38y7gb.xml.bak
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889B01A00BD-0001-0896-A5A577926453SessionOS.cls_temp
/data/data/####/files/.Fabric/io.fabric.sdk.android:fabric/mpcom.crashlytics.settings.json
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889AFF700CE-0001-0837-A5A577926453BeginSession.cls_temp
/data/data/####/shared_prefs/io.fabric.sdk.android:fabric:mpio.fabric.sdk.android.Onboarding.xml
/data/data/####/shared_prefs/installTime.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889AFF700CE-0001-0837-A5A577926453SessionUser.cls_temp
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap
/data/data/####/shared_prefs/infMrkPst.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889B01A00BD-0001-0896-A5A577926453SessionApp.cls_temp
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_f9705fa4-cf43-49fb-9145-332401acb2bf_1485418488340.tap
/data/data/####/shared_prefs/mpcom.crashlytics.prefs.xml
/data/data/####/shared_prefs/com.crashlytics.sdk.android:answers:settings.xml
/data/data/####/shared_prefs/####dbadfhbgdefh38y7gb.xml
/data/data/####/shared_prefs/####.xml
/data/data/####/cls.dex
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/initialization_marker
/data/data/####/shared_prefs/####dmnkpr.xml
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889AFF700CE-0001-0837-A5A577926453SessionOS.cls_temp
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics.tap.tmp
/data/data/####/files/cls.dex
/data/data/####/shared_prefs/####dmnkpr.xml.bak
/data/data/####/files/.Fabric/com.crashlytics.sdk.android:answers/session_analytics_to_send/sa_38550077-2ddd-4a55-a7c1-ac6df28fcd95_1485418522335.tap
/data/data/####/files/.Fabric/com.crashlytics.sdk.android.crashlytics-core/5889AFF700CE-0001-0837-A5A577926453SessionDevice.cls_temp