Technical information
Malicious functions:
Removes app icon from the screen.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.gst####.com:80
- TCP(HTTP/1.1) w####.a####.big####.pw:80
- TCP(HTTP/1.1) afs.googleu####.com:80
- TCP(HTTP/1.1) a####.big####.pw:80
- TCP(HTTP/1.1) d1lxhc4####.cloudf####.net:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) adser####.go####.com:443
DNS requests:
- a####.big####.pw
- adser####.go####.com
- afs.googleu####.com
- d1lxhc4####.cloudf####.net
- ssl.gst####.com
- w####.a####.big####.pw
- www.go####.com
- www.go####.nl
- www.google-####.com
- www.gst####.com
HTTP GET requests:
- a####.big####.pw/marapp2.php?bilgi=####
- afs.googleu####.com/dp-teaminternet/uni_blank1.gif
- d1lxhc4####.cloudf####.net/scripts/js3caf.js
- d1lxhc4####.cloudf####.net/themes/MobileCleanBlack_d65d912a/img/bg10.png
- d1lxhc4####.cloudf####.net/themes/MobileCleanBlack_d65d912a/style.css
- w####.a####.big####.pw/marapp2.php?bilgi=####
- w####.a####.big####.pw/track.php?domain=####&caf=####&toggle=####&answer...
- w####.a####.big####.pw/track.php?domain=####&toggle=####&uid=MTU####
- www.go####.com/adsense/domains/caf.js
- www.go####.com/afs/ads/i/iframe.html
- www.go####.com/dp/ads?max_radlink_len=40&r=m&client=dp-mobile-teamintern...
- www.google-####.com/ga.js
- www.gst####.com/domainads/tracking/caf.gif?ts=####&rid=####
File system changes:
Creates the following files:
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/index
- /data/data/####/multidex.version.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
Miscellaneous:
Displays its own windows over windows of other apps.
