Android.Banker.1137

Technical information

Malicious functions:

Sends data on received text messages to remote host.

Network activity:

Connecting to:

ko####.####.com
o####.website
a####.####.net
trans####.####.com
instagr####.####.net

HTTP GET requests:

a####.####.net/Followers%20Manager%20&%20Tracker%20Tools%20_%20..._files/paper.css
a####.####.net/Followers%20Manager%20&%20Tracker%20Tools%20_%20..._files/jquery.fancybox.css
a####.####.net/js/magnific-popup-options.js
a####.####.net/Followers%20Manager%20&%20Tracker%20Tools%20_%20..._files/nprogress.css
a####.####.net/Followers%20Manager%20&%20Tracker%20Tools%20_%20..._files/translateelement.css
a####.####.net/js/bootstrap.min.js
a####.####.net/js/jquery.min.js
a####.####.net/css/style.css
a####.####.net/home.html
a####.####.net/Followers%20Manager%20&%20Tracker%20Tools%20_%20..._files/bootstrap-paper.min.css
a####.####.net/js/jquery.magnific-popup.min.js
a####.####.net/css/bootstrap.css
a####.####.net/assets/style/instastyle.css
a####.####.net/Followers%20Manager%20&%20Tracker%20Tools%20_%20..._files/element_main.js.indir
a####.####.net/Followers%20Manager%20&%20Tracker%20Tools%20_%20..._files/analytics.js.indir
a####.####.net/css/magnific-popup.css
a####.####.net/assets/jquery/2.2.4/jquery.min.js
a####.####.net/js/jquery.easing.1.3.js
a####.####.net/css/icomoon.css
a####.####.net/js/modernizr-2.6.2.min.js
a####.####.net/Followers%20Manager%20&%20Tracker%20Tools%20_%20..._files/lightgallery.min.css
a####.####.net/fonts/icomoon/icomoon.ttf?sr####
a####.####.net/member
a####.####.net/fonts/icomoon/icomoon.ttf?6####
trans####.####.com/translate_a/element.js?cb=####
a####.####.net/Followers%20Manager%20&%20Tracker%20Tools%20_%20..._files/font-awesome.min.css
instagr####.####.net/h1/sprites/core/d11aca.png
a####.####.net/js/jquery.countTo.js
ko####.####.com/check.php?code=####&package=####&product=####
a####.####.net/images/img_bg_1.jpg
o####.website/
a####.####.net/Followers%20Manager%20&%20Tracker%20Tools%20_%20..._files/main.js.indir
a####.####.net/images/work_1.png
a####.####.net/js/jquery.waypoints.min.js
a####.####.net/js/main.js
a####.####.net/css/animate.css

Modified file system:

Creates the following files:

/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/shared_prefs/OneSignal.xml.bak
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/databases/google_analytics_v4.db-journal
/data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
/data/data/####/databases/com.google.android.gms.ads.db/localstorage/http_app1.realfollowers.net_0.localstorage-journal
/data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml
/data/data/####/databases/webview.db-journal
/data/data/####/cache/1470286953684.jar
/data/data/####/cache/webviewCacheChromium/f_000001
/data/data/####/databases/OneSignal.db-journal
/data/data/####/cache/webviewCacheChromium/f_000003
/data/data/####/cache/webviewCacheChromium/f_000002
/data/data/####/cache/webviewCacheChromium/f_000005
/data/data/####/cache/webviewCacheChromium/f_000004
/data/data/####/cache/webviewCacheChromium/f_000007
/data/data/####/cache/webviewCacheChromium/f_000006
/data/data/####/files/gaClientId
/data/data/####/cache/ApplicationCache.db-journal
/data/data/####/shared_prefs/OneSignal.xml
/data/data/####/cache/webviewCacheChromium/index
/data/data/####/cache/1470286953684.tmp