Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- tra####.####.es
- woo####.com:7079
- f####.####.com
- x####.####.fr
- tra####.####.com
- 2####.####.155
- technol####.net
- p####.####.com
- c####.####.com
- d####.####.com
- woo####.com
- gl####.####.com
- x####.####.com
- p####.####.fr
- trackme####.com
- show####.xyz
- gl####.####.com:6566
- statist####.com
- a####.####.com
- pag####.####.com
HTTP GET requests:
- c####.####.com/landings/87511/1489511222/js/showhide.js?148951####
- p####.####.fr/urldynamik/wid/6189/site_id/4837/niche/52/dt/F00000NSXPMiw...
- gl####.####.com/AdRedirect.aspx?offerid=####&cid=####&affid=####&aff_sub...
- p####.####.com/?m=####&a=####&pubid2=####&nnaaad####
- a####.####.com/pool_link/1514/bmconv_20170419161522_3b6dcc29_a9da_4cdc_a...
- c####.####.com/landings/87511/1489511222/css/styles.css?148951####
- d####.####.com/d/33164576433fd4daa1?sub=####&do=####&test=####
- trackme####.com/r/97a09876-250a-11e7-977f-1141962df35e/0/
- gl####.####.com/mobiledirect/?uid=####&aid=####&back=####&push=####&soun...
- tra####.####.es/?utm_term=####&clickverify=####&utm_content=####
- c####.####.com/landings/87511/1489511222/js/steps.js?148951####
- c####.####.com/landings/87511/1489511222/js/progressButton.js?148951####
- c####.####.com/landings/87511/1489511222/js/avsc2.js?148951####
- p####.####.com/c/da57dc555e50572d?s1=####&s2=####&click_id=####
- c####.####.com/landings/87511/1489511222/js/classie.js?148951####
- x####.####.fr/urldynamik/wid/6189/site_id/4837/niche/52/dt/F00000NSXPMiw...
- trackme####.com/r/97a09876-250a-11e7-977f-1141962df35e/1/
- tra####.####.es/?utm_medium=####&utm_campaign=####&cid=####
- technol####.net/wp-content/plugins/wp-share-buttons/style/front.end.css?...
- pag####.####.com/pagead/js/adsbygoogle.js
- a####.####.com/pool_link/1514/bmconv_20170419161450_fbd9ea80_5a59_496b_8...
- c####.####.com/landings/87511/1489511222/js/modernizer.js?148951####
- p####.####.com/c/679efeecdc3b4d07?&ijykJHsadL5=####&click_id=####&s1=###...
- technol####.net/wp-includes/js/wp-emoji-release.min.js?ver=####
- d####.####.com/d/33164576433fd4daa1?sub=####
- c####.####.com/landings/87511/1489511222/css/button.css?148951####
- x####.####.com/999e28db-5eb4-419c-8c1b-91dfc6581107?subid=####&externali...
- p####.####.fr/hit/sponsor/wid=6189&site_id=4837&niche=52&dt=F00000NSXPMi...
- technol####.net/mobile/android/cortana-interface-customizable-android/?s...
- tra####.####.es/proc.php?2fbe793####
- tra####.####.com/?p=####&media_type=####&click_id=####
- show####.xyz/adult/_files/imgs/r_general1/img-4fuck.gif
- gl####.####.com:6566/AdRedirect.aspx?offerid=####&cid=####&affid=####&af...
- d####.####.com/gw?url=####&vId=####&ef=####&ch=####&nid=####&sub=####&te...
- 2####.####.155/cm-tracker/cmreqrec.do?pid=####&sysuid=####&cid=####&publ...
- c####.####.com/landings/87511/1489511222/css/bootstrap.css?148951####
- statist####.com/adv_pxl?pid=####&id=####
- f####.####.com/css?family=####&ver=####
HTTP POST requests:
- woo####.com/jsdk/ss.action?b=####
- woo####.com:7079/jsdk/ss.action?b=####
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/com.hyjt.app.spf_wap_413.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/commonsdk/update.data
- /sdcard/commonsdk/webcache/localstorage/https_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/shared_prefs/com.hyjt.app.android.india.preferrence.xml
- /data/data/####/cache/ads508900280.jar
- /data/data/####/shared_prefs/com.hyjt.app.android.india.preferrence.xml.bak
- /data/data/####/databases/webview.db-journal
- /sdcard/commonsdk/webcache/localstorage/https_googleads.g.doubleclick.net_0.localstorage
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/ApplicationCache.db-journal
- /data/data/####/shared_prefs/hideIcon.xml
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
