Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- prelan####.net
- menpara####.mobi
- mobilep####.com
- tra####.####.com
HTTP GET requests:
- prelan####.net/adult/dating/hardcore/en/1/v1/css/app.css
- prelan####.net/adult/dating/hardcore/en/1/v1/images/logo.png
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_1.jpg
- tra####.####.com/doievropu
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_4.JPG
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/slick.css
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/ajax-loader.gif
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/slick-theme.css
- prelan####.net/adult/dating/hardcore/en/1/v1/css/jqtransform.css
- mobilep####.com/?flux_action=####&flux_f=####&flux_ffn=####
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_2.jpg
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_2_profile.png
- prelan####.net/adult/dating/hardcore/en/1/v1/bower_components/foundation...
- menpara####.mobi/?sl=####&data1=####&data2=####
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_4_profile.png
- prelan####.net/adult/dating/hardcore/en/1/v1/step2.html
- prelan####.net/adult/dating/hardcore/en/1/v1/slider/slick/slick.js
- prelan####.net/adult/dating/hardcore/en/1/v1/js/jquery.jqtransform.js
- prelan####.net/adult/dating/hardcore/en/1/v1/bower_components/jquery/dis...
- prelan####.net/adult/dating/hardcore/en/1/v1/bower_components/what-input...
- mobilep####.com/?flux_fts=####&flux_fn=####&flux_cost=####&clickID=####&...
- prelan####.net/adult/dating/hardcore/en/1/v1/featherlight/release/feathe...
- prelan####.net/adult/dating/hardcore/en/1/v1/images/girl_3.jpg
- prelan####.net/adult/dating/hardcore/en/1/v1/js/app.js
- prelan####.net/adult/dating/hardcore/en/1/v1/step1.html
Modified file system:
Creates the following files:
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-1012182921.zip
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-1843189096.zip
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
