Technical information
Malicious functions:
Sends SMS messages:
- 97605: RRR 8278881155+021=p3n66
Network activity:
Connecting to:
- a####.####.com
- a####.com
- action-####.####.com
- ad####.org
- b####.####.com
- choice####.####.com
- d####.####.net
- f####.####.com
- g####.net
- go####.com
- googl####.####.net
- gst####.com
- ins####.####.org
- like####.net
- n####.####.com
- net####.####.com
- network####.org
- o####.####.net
- op####.####.com
- p####.####.com
- prefere####.####.com
- prefmgr####.####.net
- pri####.####.com
- s####.####.com
- sy####.####.com
- tr####.com
- tubem####.com
- u####.####.net
HTTP GET requests:
- a####.####.com/ajax/libs/jquery/1.7/jquery.min.js
- a####.####.com/optout.jsp?action_id=####&participant_id=####&rd=####&noc...
- a####.####.com/optout/truste?participant_id=####&action_id=####&rd=####&...
- a####.####.com/script/jquery-1.3.1.min.js
- a####.com/nai?action_id=####&participant_id=####&rd=####&nocache=####
- action-####.####.com/orbserv/optOut?action_id=####&participant_id=####&r...
- ad####.org/css/main.css
- b####.####.com/bh/oba/aboutads/?action_id=####&participant_id=####&rd=##...
- choice####.####.com/caic?pid=####&aid=####&type=####&widget=####&action=...
- d####.####.net/static/caf/slave.html
- f####.####.com/css?family=####
- g####.net/nai/coop/?action_id=####&participant_id=####&rd=####&nocache=#...
- go####.com/adsense/domains/caf.js
- googl####.####.net/ads/preferences/naioptout?action_id=####&participant_...
- gst####.com/s/lato/v13/MZ1aViPqjfvZwVD_tzjjkwLUuEpTyoUstqEm5AMlJo4.ttf
- ins####.####.org/track/stop?action=####&nocache=####
- like####.net/img.aspx?q=L3MkW####
- n####.####.com/trueffect-nai.php?action_id=####&participant_id=####&rd=#...
- net####.####.com/daaOptOut.gif?participant_id=####&action_id=####&rd=###...
- network####.org/optout/opt_failure.gif
- o####.####.net/NAIConfirm.aspx?nocache=####
- op####.####.com/optout/nai-v2b-rm/?action_id=####&participant_id=####&rd...
- op####.####.com/optoutv2/optout?participant_id=####&action_id=####&rd=##...
- p####.####.com/api/optout/daa/1000/8532daba8ac9c9a9a1781efc46d6b331?part...
- p####.####.com/daa?participant_id=####&action_id=####&rd=####&nocache=####
- p####.####.com/oba/optout/?action_id=####&participant_id=####&rd=####&no...
- p####.####.com/optout?action_id=####&participant_id=####&rd=####&nocache...
- prefere####.####.com/images/loading.gif
- prefmgr####.####.net/cookie_js/cookie_iframe.html?parent=http://preferen...
- pri####.####.com/COOP.ashx?action_id=####&participant_id=####&rd=####&no...
- pri####.####.com/daa-coop?action_id=####&participant_id=####&rd=####&noc...
- s####.####.com/coop?participant_id=####&action_id=####&rd=####&nocache=#...
- sy####.####.com/cgi-bin/coopOptout.cgi?participant_id=####&action_id=###...
- tr####.com/
- tubem####.com/nai_optout_script.php?action_id=####&participant_id=####&r...
- u####.####.net/privacy/daa?action_id=####&participant_id=####&rd=####&no...
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/code.reg
Miscellaneous:
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
