Android.Hidden.2822

Technical information

Malicious functions:

Removes its shortcut from the home screen.

Network activity:

Connecting to:

st####.####.com

HTTP GET requests:

st####.####.com/sdk/131/58d8fba4dce9a.zip

Modified file system:

Creates the following files:

<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/TDCloudSettingsConfigC0AEF8D6092840EDA35D676BA769E939.xml
<Package Folder>/files/td_database0TalkingData/1495006109794_2121
<Package Folder>/files/.gmcache/api-plugin_1_105_.jar
<Package Folder>/files/td_database0TalkingData/1495006109839_2121
<Package Folder>/databases/snowplowEvents.sqlite-journal
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/cache/.gpcacache/jquery_1_6.applet
<Package Folder>/shared_prefs/TDpref_longtime.xml
<Package Folder>/shared_prefs/a.xml
<Package Folder>/files/td_database0TalkingData/1495006110325_2121
<Package Folder>/files/td_database0TalkingData/1495006110266_2121
<Package Folder>/.gmpcache/la.so
<Package Folder>/shared_prefs/TDpref_shorttime.xml
<Package Folder>/cache/.gacache/gpay_jquery_6_1_classes.jar
<Package Folder>/files/.ga/gpay_jquery_1_6.ap
<Package Folder>/files/td_database0TalkingData/1495006109723_2121
<Package Folder>/shared_prefs/TDCloudSettingsConfigC0AEF8D6092840EDA35D676BA769E939.xml.bak
<Package Folder>/files/td_database0TalkingData/1495006109706_2121
<Package Folder>/files/td_database0TalkingData/1495006109905_2121
<Package Folder>/.gmpcache/gmpclasses.jar
<Package Folder>/shared_prefs/TDpref_longtime0.xml.bak
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
<Package Folder>/files/td_database0TalkingData/1495006110305_2121
<Package Folder>/files/td_database0TalkingData/1495006109468_2121
<Package Folder>/files/td_database0TalkingData/1495006109766_2121
<Package Folder>/files/unsent_requests
<Package Folder>/files/td_database0TalkingData/1495006109525_2121
<Package Folder>/shared_prefs/TDpref_longtime0.xml
<Package Folder>/files/td_database0TalkingData/1495006109815_2121
<Package Folder>/files/td_database0TalkingData/1495006109885_2121
<Package Folder>/databases/snowplowEvents.sqlite