Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- c####.####.com
- s####.####.com
- g####.####.com
- h####.####.com
HTTP GET requests:
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####<=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####&...
- g####.####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/7aef1cfa-9b7a-4b76-9e14-f724cca61e2c.jpeg@f_webp%7Cq_90%7Ch_152%7Cc_1,w_228
- c####.####.com/log.gif?site_id=####&event_id=####&session_id=####&rsession_id=####&app_id=####&channel_id=####&sub_channel_id=####&entry=####&log_type...
- g####.####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/50cf9e68-5a69-4648-86e2-700d168501dd.jpeg@f_webp%7Cq_90%7Ch_152%7Cc_1,w_228
- g####.####.com/9aQTbzqaKgQFm2e88IuM_a/static/2017020382105/css/default/detail.css
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####<=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####
- g####.####.com/9aQTbzqaKgQFm2e88IuM_a/static/2017020382105/js/common/coreMobile.js
- g####.####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/image/cms/d2ac905f7e827e45610b6c677e3bef55.JPEG@q_90,w_750
- g####.####.com/9aQTbzqaKgQFm2e88IuM_a/static/2017020382105/img/icons.png
- c####.####.com/1022/a93c73fd/i/detail/23599806/news
- g####.####.com/9aQTbzqaKgQFm2e88IuM_a/static/2017020382105/js/default/detail-entry.js
- c####.####.com/1032/a93c73fd
- c####.####.com/cpro/ui/uijs.php?en=####&adx=####&c=####&ctk=####&fv=####&kdi0=####&kdi1=####&kdi2=####&kdi3=####&kdi4=####&kdi5=####&lukid=####&mscf=#...
- g####.####.com/9aQTbzqaKgQFm2e88IuM_a/static/2017020382105/js/common/videojs/dist/video.js
- g####.####.com/9aQTbzqaKgQFm2e88IuM_a/static/2017020382105/js/common/etpl.js
- c####.####.com/log.gif?site_id=####&session_id=####&rsession_id=####&entry=####&from=####&log_type=####&req_id=####&view_url=####&title=####&pv_id=###...
- g####.####.com/9aQTbzqaKgQFm2e88IuM_a/static/2017020382105/img/image_default.jpg
- h####.####.com/hm.js?7e45c71####
- c####.####.com/1022/a93c73fd/i?chk=####
- g####.####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/c02cd374-692c-4853-b066-8744508fdcad.jpeg@f_webp%7Cq_90%7Cw_228%7Cc_1,h_152
- c####.####.com/1022/a93c73fd/i
- g####.####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/dc16d795-d63c-44ae-b654-bcb41b4a3172.jpeg@f_webp%7Cq_90%7Cw_228%7Cc_1,h_152
- g####.####.com/5K1IcD3801kUm2zgoZyCKT6zgBYnreHg-_/a047070d-caa6-4965-9366-9482939f4eaf.jpeg@f_webp%7Cq_90%7Cw_228%7Cc_1,h_152
- g####.####.com/9aQTbzqaKgQFm2e88IuM_a/static/2017020382105/css/default/list.css
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####
- g####.####.com/9aQTbzqaKgQFm2e88IuM_a/static/2017020382105/js/widget/newslist-unstash.js
- c####.####.com/1022/a93c73fd/menu
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja=####&ln=####&lo=####<=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####
- s####.####.com/common/openjs/openBox.js
- c####.####.com/log.gif?site_id=####&session_id=####&rsession_id=####&entry=####&log_type=####&req_id=####&view_url=####&title=####&pv_id=####&app_type...
- c####.####.com/1022/a93c73fd/i/detail/23693448/news?focusid=####
- g####.####.com/9aQTbzqaKgQFm2e88IuM_a/static/2017020382105/js/stat/st.js
- c####.####.com/log.gif?site_id=####&session_id=####&rsession_id=####&entry=####&log_type=####&req_id=####&view_url=####&title=####&pv_id=####&last_pv_...
- c####.####.com/1032/a93c73fd?chk=####
HTTP POST requests:
- c####.####.com/1022/a93c73fd/i/recommend/list
- c####.####.com/1022/a93c73fd/i/ads/23693448/news?focusid=####
- c####.####.com/1022/a93c73fd/i/ads/23599806/news
Modified file system:
Creates the following files:
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /sdcard/.Eyrweirweyrihff.txt
- /data/data/####/databases/cc/cc.db
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/files/hbrto
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Contains functionality to send SMS messages automatically.
