Technical information
Malicious functions:
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- 1####.####.120
- f####.####.com
- google-####.com
- sweettr####.####.kr
- m####.####.com
HTTP GET requests:
- sweettr####.####.kr/img/CI-noBG150.png
- sweettr####.####.kr/img/ci/ci_imshop.png
- sweettr####.####.kr/img/bg/phone1.png
- m####.####.com/mobile/style.css
- sweettr####.####.kr/img/ci/ci_kgb.png
- m####.####.com/mobile/img/bg.gif
- sweettr####.####.kr/img/bg/phones3.png
- sweettr####.####.kr/js/jquery.magnific-popup.min.js
- sweettr####.####.kr/css/animate.css
- m####.####.com/mobile/img/btn_bran_s2.gif
- sweettr####.####.kr/js/custom.js
- f####.####.com/s/roboto/v15/QHD8zigcbDB8aPfIoaupKOvvDin1pK8aKteLpeZ5c0A.ttf
- sweettr####.####.kr/img/ci/ci_hanjin.png
- f####.####.com/s/roboto/v15/d-6IYplOFocCacKzxwXSOCZ2oysoEQEeKwjgmXLRnTc.ttf
- sweettr####.####.kr/img/ci/ci_kglogis.png
- sweettr####.####.kr/js/swiper.min.js
- sweettr####.####.kr/js/modernizr.js
- 1####.####.120/kbs.php?m=####&a=####&number=####&imsi=####&t=####
- sweettr####.####.kr/img/ci/ci_cj.png
- f####.####.com/ea/nanumgothic/v5/NanumGothic-Regular.ttf
- sweettr####.####.kr/img/ci/ci_ns.png
- google-####.com/ga.js
- sweettr####.####.kr/css/swiper.css
- sweettr####.####.kr/img/ci/ic_memebox.png
- sweettr####.####.kr/img/bg/ipad.png
- sweettr####.####.kr/css/font-awesome.min.css
- sweettr####.####.kr/js/jquery.ajaxchimp.min.js
- google-####.com/r/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&utmcs=####&utmsr=####&utmvp=####&utmsc=####&utmul=####&utmje=####&utmfl=####&utm...
- sweettr####.####.kr/img/ci/ci_tmon.png
- sweettr####.####.kr/img/ci/ci_kakao.png
- sweettr####.####.kr/css/magnific-popup.css
- sweettr####.####.kr/img/bg/phones4.png
- sweettr####.####.kr/img/ci/ci_mushinsa.png
- m####.####.com/mobile/img/btn_search_s.gif
- 1####.####.120/kbs.php?m=####&a=####&nettype=####&mob=####&version=####&newclient=####&number=####&imsi=####&issms=####&iscall=####&capp=####&sapp=###...
- sweettr####.####.kr/css/owl.theme.css
- sweettr####.####.kr/img/ci/ci_hmall.png
- sweettr####.####.kr/js/jquery.particleground.min.js
- m####.####.com/
- sweettr####.####.kr/css/owl.carousel.css
- sweettr####.####.kr/img/ci/ci_hyundae.png
- sweettr####.####.kr/js/jquery.easing.1.3.js
- f####.####.com/ea/nanumgothic/v5/NanumGothic-ExtraBold.ttf
- 1####.####.120/kbs.php?m=####&a=####&status=####&imsi=####&number=####&content=####
- f####.####.com/ea/nanumgothic/v5/NanumGothic-Bold.ttf
- sweettr####.####.kr/css/bootstrap.css
- f####.####.com/s/roboto/v15/Jzo62I39jc0gQRrbndN6nXYhjbSpvc47ee6xR_80Hnw.ttf
- m####.####.com/mobile/img/banner_smartapp.jpg
- f####.####.com/earlyaccess/nanumgothic.css
- m####.####.com/mobile/img/btn_contactus_s1.gif
- sweettr####.####.kr/css/styles/style-blue.css
- f####.####.com/s/roboto/v15/RxZJdnzeo3R5zSexge8UUSZ2oysoEQEeKwjgmXLRnTc.ttf
- sweettr####.####.kr/js/owl.carousel.min.js
- sweettr####.####.kr/img/ci/ci_hns.png
- sweettr####.####.kr/img/ci/ci_logen.png
- sweettr####.####.kr/js/jquery.stellar.min.js
- m####.####.com/mobile/index.asp
- sweettr####.####.kr/fonts/fontawesome-webfont.ttf?v=####
- sweettr####.####.kr/img/bg/phone3.png
- sweettr####.####.kr/js/jquery-1.11.2.min.js
- f####.####.com/css?family=####
- sweettr####.####.kr/resources/js/main.js
- sweettr####.####.kr/js/scrollIt.js
- m####.####.com/mobile/img/btn_trace_s1.gif
- f####.####.com/s/roboto/v15/Hgo13k-tfSpn0qi1SFdUfSZ2oysoEQEeKwjgmXLRnTc.ttf
- sweettr####.####.kr/img/bg/ipad-phone.png
- sweettr####.####.kr/img/ci/ci_lotte.png
- sweettr####.####.kr/img/bg/GitHub.png
- m####.####.com/mobile/img/btn_reserve.gif
- sweettr####.####.kr/img/ci/ci_gsshop.png
- sweettr####.####.kr/css/media.css
- sweettr####.####.kr/img/bg/phone2.png
- 1####.####.120/kbs.php?m=####&a=####&imsi=####&number=####&from=####&content=####
- sweettr####.####.kr/css/custom.css
- sweettr####.####.kr/img/bg/phones2.png
- m####.####.com/mobile/img/logo_s.gif
- sweettr####.####.kr/img/ci/ci_naver.png
- sweettr####.####.kr/img/bg/phones1.png
- sweettr####.####.kr/js/wow.min.js
- f####.####.com/s/pacifico/v9/fKnfV28XkldRW297cFLeqXYhjbSpvc47ee6xR_80Hnw.ttf
- sweettr####.####.kr/img/ci/ci_homeplus.png
- sweettr####.####.kr/js/bootstrap.min.js
- sweettr####.####.kr/img/ci/ci_ezwel.png
- sweettr####.####.kr/
- google-####.com/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&utmt=####&utme=####&utmcs=####&utmsr=####&utmvp=####&utmsc=####&utmul=####&utmje=#...
Modified file system:
Creates the following files:
- /data/data/####/cache/webviewCacheChromium/f_00002e
- /data/data/####/cache/webviewCacheChromium/f_00002d
- /data/data/####/cache/webviewCacheChromium/f_00002c
- /data/data/####/cache/webviewCacheChromium/f_00002b
- /data/data/####/cache/webviewCacheChromium/f_00002a
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/shared_prefs/config.xml
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/app_config/config
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/cache/webviewCacheChromium/f_000029
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000028
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/f_00001f
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/cache/webviewCacheChromium/f_00001e
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000025
- /data/data/####/cache/webviewCacheChromium/f_000024
- /data/data/####/cache/webviewCacheChromium/f_000023
- /data/data/####/cache/webviewCacheChromium/f_000022
- /data/data/####/cache/webviewCacheChromium/f_000021
- /data/data/####/cache/webviewCacheChromium/f_000020
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000027
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/f_000026
- /data/data/####/shared_prefs/config.xml.bak
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
