Technical information
Malicious functions:
Removes its shortcut from the home screen.
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.go####.nl:80
- TCP(HTTP/1.1) sta####.d####.net:80
- TCP(HTTP/1.1) ssl.gst####.com:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) ip.ta####.com:80
- TCP(HTTP/1.1) www.dailymo####.com:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) a####.google####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
DNS requests:
- a####.google####.com
- adser####.go####.nl
- api.d####.net
- f####.google####.com
- ip.ta####.com
- myacc####.go####.com
- s2s.no####.com
- ssl.gst####.com
- sta####.d####.net
- www.dailymo####.com
- www.go####.com
- www.go####.nl
- www.google-####.com
- www.googlet####.com
- www.gst####.com
HTTP GET requests:
- ip.ta####.com/service/getIpInfo2.php?ip=####
- ssl.gst####.com/gb/images/qi1_36e7b564.png
- sta####.d####.net/all.js
- sta####.d####.net/neon/prod/mobile.084b6db0b4729b376a20.js
- sta####.d####.net/neon/prod/mobile.6f63d93181306f80ee3d02dcb50f5538.css
- sta####.d####.net/neon/prod/vendor.084b6db0b4729b376a20.js
- sta####.d####.net/neon/prod/vendor.66bc4f798c3154d68878183c4709d1a8.css
- sta####.d####.net/playerv5/dmp.c6d3efc99c84202cb39f.js
- sta####.d####.net/playerv5/dmpmanifest.b0655e3075e9775fe4b0.js
- sta####.d####.net/playerv5/dmpvendor.121e83069e6f969678f8.js
- www.dailymo####.com/
- www.go####.com/
- www.go####.nl/?gfe_rd=####&dcr=####&ei=####
- www.go####.nl/gen_204?atyp=####&ct=####&cad=####&ogsr=####&id=####&ic=##...
- www.go####.nl/gen_204?atyp=####&ct=####&cad=####&tt=####&ei=####&zx=####
- www.go####.nl/gen_204?atyp=####&ei=####&s=####&imc=####&imn=####&imp=###...
- www.go####.nl/gen_204?atyp=####&ei=####&s=####&jsi=####&zx=####
- www.go####.nl/gen_204?atyp=####&zx=####&ei=####&ogf=####&ogrp=####&ogv=#...
- www.go####.nl/gen_204?s=####&atyp=####&ei=####&rt=####
- www.go####.nl/images/branding/googlelogo/2x/googlelogo_color_160x56dp.png
- www.go####.nl/images/hpp/gsa_super_g-64.gif
- www.go####.nl/images/nav_logo242.png
- www.go####.nl/webhp?dcr=####&output=####
- www.go####.nl/xjs/_/js/k=xjs.qs.nl._fkTQE1-2t4.O/m=RMhBfe/am=wCLZMgVCAgF...
- www.go####.nl/xjs/_/js/k=xjs.qs.nl._fkTQE1-2t4.O/m=RMhBfe/am=wCLZMl1CAgF...
- www.go####.nl/xjs/_/js/k=xjs.qs.nl._fkTQE1-2t4.O/m=sb_wiz,aa,abd,async,d...
- www.go####.nl/xjs/_/js/k=xjs.qs.nl._fkTQE1-2t4.O/m=sx,bct,cdos,elog,hsm,...
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/databases/Sky.db
- <Package Folder>/databases/Sky.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/CachedGeoposition.db
- <Package Folder>/files/CachedGeoposition.db-journal
- <Package Folder>/files/GeolocationPermissions.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml
Miscellaneous:
Uses administrator priveleges.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
