Technical information
Malicious functions:
Removes app icon from the screen.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) develo####.goldc####.net:80
- TCP(HTTP/1.1) cdn.one####.xyz:80
- TCP(TLS/1.0) 2####.58.212.174:443
- TCP(TLS/1.0) api.face####.com:443
DNS requests:
- cdn.one####.xyz
- develo####.goldc####.net
- g####.face####.com
HTTP GET requests:
- cdn.one####.xyz/down/drawable.zip
HTTP POST requests:
- develo####.goldc####.net/index.php?r=####&brand=####&os=####&appId=####&...
File system changes:
Creates the following files:
- /data/data/####/25557542-33586246
- /data/data/####/AppEventsLogger.persistedevents
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.sunshline.artframe_preferences.xml
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/evernote_jobs.xml
- /data/data/####/evernote_jobs.xml (deleted)
- /data/data/####/smt.db-journal
Miscellaneous:
Gets information about network.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
