Technical information
Malicious functions:
Sends SMS messages:
- 737459: 975352971
- 738902: 1
- 738902: 1010
- 738902: L
Network activity:
Connecting to:
- a####.####.net
- a023f20####.####.net
- a9036f3####.####.net
- a9ac080####.####.net
- ad44034####.####.net
- af6d20c####.####.net
- art####.####.net
- cloudfr####.####.com
- e-cha####.ir
- eng####.####.net
- google-####.com
- i####.####.net
- lib####.####.net
- s####.####.net
- t####.####.com
- trwrnv####.####.com
- tu####.####.net
HTTP GET requests:
- a####.####.net/api/Advertisment/GetCollectionByPercent?MenuPartID=####&M...
- a023f20####.####.net/test.png
- a9036f3####.####.net/test.png
- a9ac080####.####.net/test.png
- ad44034####.####.net/test.png
- af6d20c####.####.net/test.png
- art####.####.net/Base/UserLog?k=####
- cloudfr####.####.com/x.png
- e-cha####.ir/show.php
- eng####.####.net/JS/TS/1024/ArticlePage/ArticleScript.js?s=####
- google-####.com/r/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&ut...
- i####.####.net/TS/English/Green/Teb-16.gif
- lib####.####.net/image/BHrMenu.png
- s####.####.net/gen/js/plugin/CheckLoginUserNewtebyan/CheckLoginUser.pack...
- t####.####.com/2017/8/c52db5d69bba4d78aa1e853b2903f84e.gif
- trwrnv####.####.com/api/tracking/v1/android
- tu####.####.net/JS/TS/1024/ArticlePage/ArticleScript.js?seed=####
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/index
- <Package Folder>/cache/1
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
Miscellaneous:
Displays its own windows over windows of other applications.
