Technical information
Malicious functions:
Sends SMS messages:
- 32324: ON CRT
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) fil####.apk####.com:80
- TCP(HTTP/1.1) 1####.162.12.207:80
- TCP(HTTP/1.1) vilandv####.top:80
- TCP(TLS/1.0) lh3.googleu####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
DNS requests:
- fil####.apk####.com
- lh3.googleu####.com
- ssl.google-####.com
- vilandv####.top
HTTP GET requests:
- fil####.apk####.com/games/TubeMate.apk
- vilandv####.top/
- vilandv####.top/wp-content/plugins/wp-pagenavi/pagenavi-css.css?ver=####
- vilandv####.top/wp-content/themes/vilandvideo/css/bootstrap.min.css?ver=...
- vilandv####.top/wp-content/themes/vilandvideo/css/fixed.css?ver=####
- vilandv####.top/wp-content/themes/vilandvideo/css/layout.css?ver=####
- vilandv####.top/wp-content/themes/vilandvideo/images/bg_menu.jpg
- vilandv####.top/wp-content/themes/vilandvideo/images/logo.png
- vilandv####.top/wp-content/themes/vilandvideo/images/main_sprites.1.0.1....
- vilandv####.top/wp-content/themes/vilandvideo/js/bootstrap.min.js?ver=####
- vilandv####.top/wp-content/themes/vilandvideo/js/common.min.js?ver=####
- vilandv####.top/wp-content/themes/vilandvideo/js/jquery.js?ver=####
- vilandv####.top/wp-content/uploads/2016/12/funny-cartoon-larva-full-epis...
- vilandv####.top/wp-content/uploads/2016/12/larva-2016-funny-cartoon-full...
- vilandv####.top/wp-content/uploads/2016/12/larva-cartoon-full-compilatio...
- vilandv####.top/wp-content/uploads/2016/12/larva-cartoon-full-episodes-5...
- vilandv####.top/wp-content/uploads/2016/12/larva-cartoon-new-compilation...
- vilandv####.top/wp-content/uploads/2016/12/larva-collection-2016-funny-c...
- vilandv####.top/wp-content/uploads/2016/12/larva-full-episodes-the-best-...
- vilandv####.top/wp-content/uploads/2016/12/larva-full-movie-the-best-car...
- vilandv####.top/wp-content/uploads/2016/12/larva-funny-cartoons-best-new...
- vilandv####.top/wp-content/uploads/2017/12/4-12-viland-crt-video-funny-f...
- vilandv####.top/wp-content/uploads/2017/12/4-12-viland-crt-video-funny-t...
- vilandv####.top/wp-content/uploads/2017/12/5-12-viland-crt-video-funny-f...
- vilandv####.top/wp-content/uploads/2017/12/5-12-viland-crt-video-funny-l...
- vilandv####.top/wp-content/uploads/2017/12/5-12-viland-crt-video-funny-t...
- vilandv####.top/wp-content/uploads/2017/12/6-12-viland-crt-video-funny-f...
- vilandv####.top/wp-content/uploads/2017/12/7-12-viland-crt-video-funny-a...
- vilandv####.top/wp-content/uploads/2017/12/7-12-viland-crt-video-funny-d...
- vilandv####.top/wp-includes/js/wp-embed.min.js?ver=####
- vilandv####.top/wp-includes/js/wp-emoji-release.min.js?ver=####
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/index
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/gaClientId
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <SD-Card>/<Package>.tmp
- <SD-Card>/Android/####/-524018820.tmp
- <SD-Card>/Android/####/.nomedia
Miscellaneous:
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
