Technical information
Malicious functions:
Sends SMS messages:
- 205032: 846
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) webser####.appgost####.com:80
- TCP(HTTP/1.1) webserv####.appgost####.com:80
- TCP(HTTP/1.1) www.visi####.com:80
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
DNS requests:
- and####.cli####.go####.com
- ssl.google-####.com
- webser####.appgost####.com
- webserv####.appgost####.com
- www.visi####.com
HTTP GET requests:
- webser####.appgost####.com/images/arrow.png
HTTP POST requests:
- webser####.appgost####.com/ads.svc/le/
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_0 (deleted)
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_1 (deleted)
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_2 (deleted)
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/data_3 (deleted)
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/index (deleted)
- <Package Folder>/databases/__pushe_base_lib_db-journal
- <Package Folder>/databases/evernote_jobs.db-journal
- <Package Folder>/databases/google_analytics_v2.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/3824a830-74ca-41bd-a54c-25b901a9822a.jpg
- <Package Folder>/files/####/54884af8-33ae-431b-bcea-553d8a32039a.jpg
- <Package Folder>/files/####/61639d6b-2bb3-4178-93ae-51c9a8a6b986.jpg
- <Package Folder>/files/####/7276ae77-6ad2-49d3-a07c-975c055e6d1d.jpg
- <Package Folder>/files/####/89a1f804-ae96-4025-8369-c5cccbff3e59.jpg
- <Package Folder>/files/####/a923e6fb-393f-467d-9fb8-8c9d79a474cd.jpg
- <Package Folder>/files/####/arrow.png
- <Package Folder>/files/####/f86501f3-a487-4be2-8823-1716321edce9.jpg
- <Package Folder>/files/####/fa4cd2ff-bc61-4c71-ac94-689acebc1954.jpg
- <Package Folder>/files/####/img0.jpg
- <Package Folder>/files/####/xml.xml
- <Package Folder>/files/####/xml0.xml
- <Package Folder>/files/gaClientId
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/co.ronash.pushe.keystore.xml
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/evernote_jobs.xml
- <Package Folder>/shared_prefs/setting.xml
Miscellaneous:
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
