Technical information
Malicious functions:
Sends SMS:
- +32324: ON CRT
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) contro####.viland####.com:80
- TCP(HTTP/1.1) vilandv####.top:80
- TCP(HTTP/1.1) set####.viland####.com:80
- TCP(TLS/1.0) 1####.217.17.46:443
- TCP(TLS/1.0) lh3.googleu####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
DNS requests:
- contro####.viland####.com
- fil####.apk####.com
- googl####.g.doublec####.net
- lh3.googleu####.com
- mt####.go####.com
- set####.viland####.com
- ssl.google-####.com
- vilandv####.top
HTTP GET requests:
- contro####.viland####.com/apksubs.php?&shortcode=####&keyword=####
- set####.viland####.com/demo.php
- set####.viland####.com/shotcut_setting.php?&isDelay=####&packageName=###...
- vilandv####.top/
- vilandv####.top/wp-content/plugins/wp-pagenavi/pagenavi-css.css?ver=####
- vilandv####.top/wp-content/themes/vilandvideo/css/bootstrap.min.css?ver=...
- vilandv####.top/wp-content/themes/vilandvideo/css/fixed.css?ver=####
- vilandv####.top/wp-content/themes/vilandvideo/css/layout.css?ver=####
- vilandv####.top/wp-content/themes/vilandvideo/images/bg_menu.jpg
- vilandv####.top/wp-content/themes/vilandvideo/images/logo.png
- vilandv####.top/wp-content/themes/vilandvideo/images/main_sprites.1.0.1....
- vilandv####.top/wp-content/themes/vilandvideo/js/bootstrap.min.js?ver=####
- vilandv####.top/wp-content/themes/vilandvideo/js/common.min.js?ver=####
- vilandv####.top/wp-content/themes/vilandvideo/js/jquery.js?ver=####
- vilandv####.top/wp-content/uploads/2017/12/11-12-viland-crt-video-funny-...
- vilandv####.top/wp-content/uploads/2017/12/15-12-viland-crt-video-funny-...
- vilandv####.top/wp-content/uploads/2017/12/8-12-viland-crt-video-funny-m...
- vilandv####.top/wp-content/uploads/2017/12/9-12-viland-crt-video-funny-d...
- vilandv####.top/wp-content/uploads/2017/12/9-12-viland-crt-video-funny-l...
- vilandv####.top/wp-content/uploads/2017/12/9-12-viland-crt-video-funny-m...
- vilandv####.top/wp-content/uploads/2018/01/151-viland-crt-video-funny-fu...
- vilandv####.top/wp-content/uploads/2018/01/221-viland-crt-video-funny-ba...
- vilandv####.top/wp-content/uploads/2018/01/251-viland-crt-video-funny-th...
- vilandv####.top/wp-content/uploads/2018/07/187-viland-crt-videos-cooking...
- vilandv####.top/wp-content/uploads/2018/09/259viland-crt-video-makeup-ma...
- vilandv####.top/wp-content/uploads/2018/09/269-viland-crt-video-funny-fu...
- vilandv####.top/wp-content/uploads/2018/09/269-viland-crt-videos-cooking...
- vilandv####.top/wp-content/uploads/2018/09/269viland-crt-video-makeup-ma...
- vilandv####.top/wp-content/uploads/2018/09/279-viland-crt-video-funny-fu...
- vilandv####.top/wp-content/uploads/2018/09/279-viland-crt-videos-cooking...
- vilandv####.top/wp-content/uploads/2018/09/279viland-crt-video-makeup-ma...
- vilandv####.top/wp-content/uploads/2018/09/289-viland-crt-video-funny-fu...
- vilandv####.top/wp-content/uploads/2018/09/289-viland-crt-videos-cooking...
- vilandv####.top/wp-content/uploads/2018/09/289viland-crt-video-makeup-ma...
- vilandv####.top/wp-content/uploads/2018/09/299-viland-crt-video-funny-fu...
- vilandv####.top/wp-content/uploads/2018/09/299-viland-crt-videos-cooking...
- vilandv####.top/wp-content/uploads/2018/10/0210viland-crt-video-makeup-m...
- vilandv####.top/wp-content/uploads/2018/10/0310-viland-crt-video-funny-f...
- vilandv####.top/wp-content/uploads/2018/10/0310-viland-crt-videos-cookin...
- vilandv####.top/wp-content/uploads/2018/10/0510-viland-crt-video-funny-f...
- vilandv####.top/wp-content/uploads/2018/10/0510-viland-crt-videos-cookin...
- vilandv####.top/wp-content/uploads/2018/10/0510viland-crt-video-makeup-m...
- vilandv####.top/wp-content/uploads/2018/10/0910-viland-crt-video-funny-f...
- vilandv####.top/wp-content/uploads/2018/10/0910-viland-crt-videos-cookin...
- vilandv####.top/wp-content/uploads/2018/10/0910viland-crt-video-makeup-m...
- vilandv####.top/wp-content/uploads/2018/10/1210-viland-crt-video-funny-f...
- vilandv####.top/wp-content/uploads/2018/10/1210-viland-crt-videos-cookin...
- vilandv####.top/wp-content/uploads/2018/10/1210viland-crt-video-makeup-m...
- vilandv####.top/wp-content/uploads/2018/10/1610-viland-crt-video-funny-f...
- vilandv####.top/wp-content/uploads/2018/10/1610-viland-crt-videos-cookin...
- vilandv####.top/wp-content/uploads/2018/10/1610viland-crt-video-makeup-m...
- vilandv####.top/wp-content/uploads/2018/10/1910-viland-crt-video-funny-f...
- vilandv####.top/wp-content/uploads/2018/10/1910-viland-crt-videos-cookin...
- vilandv####.top/wp-content/uploads/2018/10/1910viland-crt-video-makeup-m...
- vilandv####.top/wp-content/uploads/2018/10/2310-viland-crt-video-funny-f...
- vilandv####.top/wp-content/uploads/2018/10/2310-viland-crt-videos-cookin...
- vilandv####.top/wp-content/uploads/2018/10/2310viland-crt-video-makeup-m...
- vilandv####.top/wp-content/uploads/2018/10/2510-viland-crt-videos-cookin...
- vilandv####.top/wp-content/uploads/2018/10/2610viland-crt-video-makeup-m...
- vilandv####.top/wp-includes/js/wp-embed.min.js?ver=####
- vilandv####.top/wp-includes/js/wp-emoji-release.min.js?ver=####
File system changes:
Creates the following files:
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/ads-108022441.jar
- /data/data/####/com.google.android.gms.analytics.prefs.xml
- /data/data/####/crt.all.mobomarket.v4_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/f_000032
- /data/data/####/f_000033
- /data/data/####/gaClientId
- /data/data/####/google_analytics_v4.db-journal
- /data/data/####/https_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/-524018820.tmp
- /data/media/####/.nomedia
Miscellaneous:
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
