Technical information
Malicious functions:
Sends SMS messages:
- +32324: ON FRI
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) fil####.apk####.com:80
- TCP(HTTP/1.1) set####.viland####.com:80
- TCP(HTTP/1.1) funn####.com:80
- TCP(TLS/1.0) lh3.googleu####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
DNS requests:
- contro####.viland####.com
- fil####.apk####.com
- funn####.com
- lh3.googleu####.com
- set####.viland####.com
- ssl.google-####.com
HTTP GET requests:
- fil####.apk####.com/games/Minecraft.apk
- funn####.com/
- funn####.com/wp-content/plugins/wp-pagenavi/pagenavi-css.css?ver=####
- funn####.com/wp-content/themes/vilandvideo1/css/bootstrap.min.css?ver=####
- funn####.com/wp-content/themes/vilandvideo1/css/clip-page.css?ver=####
- funn####.com/wp-content/themes/vilandvideo1/css/fonts.css?ver=####
- funn####.com/wp-content/themes/vilandvideo1/css/global.css?ver=####
- funn####.com/wp-content/themes/vilandvideo1/images/logo.png
- funn####.com/wp-content/themes/vilandvideo1/js/bootstrap.min.js?ver=####
- funn####.com/wp-content/themes/vilandvideo1/js/jquery.js?ver=####
- funn####.com/wp-content/uploads/2017/01/funny-football-vines-2016-43-goa...
- funn####.com/wp-content/uploads/2017/01/hilarious-baby-talking-on-the-ph...
- funn####.com/wp-content/uploads/2017/04/video-008.jpg
- funn####.com/wp-content/uploads/2017/04/video-009.jpg
- funn####.com/wp-content/uploads/2017/04/video-011.jpg
- funn####.com/wp-content/uploads/2017/04/video-014.jpg
- funn####.com/wp-content/uploads/2017/04/video-016.jpg
- funn####.com/wp-content/uploads/2017/04/video-017.jpg
- funn####.com/wp-content/uploads/2017/04/video-022-1.jpg
- funn####.com/wp-content/uploads/2017/04/video-026.jpg
- funn####.com/wp-content/uploads/2017/04/video-033.jpg
- funn####.com/wp-content/uploads/2017/04/video-042.jpg
- funn####.com/wp-content/uploads/2017/04/video-044.jpg
- funn####.com/wp-content/uploads/2017/04/video-048.jpg
- funn####.com/wp-content/uploads/2017/04/video-050-768x431.jpg
- funn####.com/wp-content/uploads/2017/04/video-054.jpg
- funn####.com/wp-content/uploads/2017/04/video-055.jpg
- funn####.com/wp-content/uploads/2017/04/video-067.jpg
- funn####.com/wp-content/uploads/2017/04/video-068.jpg
- funn####.com/wp-content/uploads/2017/04/video-069.jpg
- funn####.com/wp-content/uploads/2017/04/video-071.jpg
- funn####.com/wp-content/uploads/2017/04/video-073.jpg
- funn####.com/wp-content/uploads/2017/04/video-077.jpg
- funn####.com/wp-content/uploads/2017/04/video-078.jpg
- funn####.com/wp-includes/js/wp-embed.min.js?ver=####
- funn####.com/wp-includes/js/wp-emoji-release.min.js?ver=####
- set####.viland####.com/apksubs.php?&shortcode=####&keyword=####
- set####.viland####.com/demo.php
- set####.viland####.com/shotcut_setting.php?&isDelay=####&packageName=###...
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/index
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/gaClientId
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics....ml.bak
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <SD-Card>/Android/####/.nomedia
Miscellaneous:
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
