Technical information
Malicious functions:
Sends SMS messages:
- 7769: APK MOD 2@109106@aa2a6ec308bc2716cb3f429c8d2816b6
Gains access to the ITelephony private interface
Network activity:
Connecting to:
- 0ea7ce1####.####.com
- 85255de####.####.com
- a####.####.com
- a####.####.com:8080
- a####.####.me
- cou####.####.com
- d3v1lb8####.####.net
- ed7fe2b####.####.com
- i####.####.com
- r####.####.com
- w####.####.net
HTTP GET requests:
- 0ea7ce1####.####.com/com.feelingtouch.zf3d.png
- 85255de####.####.com/ADZF3D_H_1.jpg
- a####.####.com/ads-server/felad?pname=####
- a####.####.me/gkh/view.php?&id=####&refcode=####
- cou####.####.com/i?app_key=####&device_id=####×tamp=####&session_du...
- d3v1lb8####.####.net/output_static/ui/bg-applelinen-tile.png
- ed7fe2b####.####.com/banner_ad_ew_en.jpg
- i####.####.com/o903c61a/f67b44052f3ebb1fe0f3dc2f8756aad020349bf6_raw11.gif
- r####.####.com/2.0/ad?v1=####&model=####&dx=####&dy=####&accept=####&v2=...
- w####.####.net/80250F/s3videos/output/videos/hd_89462.m4v
HTTP POST requests:
- a####.####.com:8080/ads-server/loadBannerads
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/cb_previous_session_info
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/index
- <Package Folder>/databases/countly-journal
- <Package Folder>/databases/strikeforce.db-journal
- <Package Folder>/databases/supersonic_sdk.db
- <Package Folder>/databases/supersonic_sdk.db-journal
- <Package Folder>/databases/vungle-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/1.png
- <Package Folder>/files/####/10.png
- <Package Folder>/files/####/11.png
- <Package Folder>/files/####/12.png
- <Package Folder>/files/####/13.png
- <Package Folder>/files/####/14.png
- <Package Folder>/files/####/15.png
- <Package Folder>/files/####/16.png
- <Package Folder>/files/####/17.png
- <Package Folder>/files/####/18.js
- <Package Folder>/files/####/19.png
- <Package Folder>/files/####/2.png
- <Package Folder>/files/####/20.png
- <Package Folder>/files/####/21.png
- <Package Folder>/files/####/22.png
- <Package Folder>/files/####/23.m4v
- <Package Folder>/files/####/3.png
- <Package Folder>/files/####/4.png
- <Package Folder>/files/####/5.png
- <Package Folder>/files/####/6.png
- <Package Folder>/files/####/7.png
- <Package Folder>/files/####/8.png
- <Package Folder>/files/####/9.png
- <Package Folder>/files/####/iap_cache.txt
- <Package Folder>/files/####/manifest.txt
- <Package Folder>/files/####/media_info.txt
- <Package Folder>/files/####/session_info.txt
- <Package Folder>/files/####/tracking_info.txt
- <Package Folder>/files/####/zone_state.txt
- <Package Folder>/files/INSTALLATION
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/FeelingTouchUserState.xml
- <Package Folder>/shared_prefs/FyberPreferences.xml
- <Package Folder>/shared_prefs/Mediation_Shared_Preferences.xml
- <Package Folder>/shared_prefs/Mediation_Shared_Preferences.xml.bak
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/activate_prefs_abcxyz.xml
- <Package Folder>/shared_prefs/cbPrefs.xml
- <Package Folder>/shared_prefs/cbPrefs.xml.bak
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml
- <Package Folder>/shared_prefs/com.applovin.sdk.1.xml.bak
- <Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml
- <Package Folder>/shared_prefs/com.applovin.sdk.impl.postbackQueue.domain.xml.bak
- <Package Folder>/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- <Package Folder>/shared_prefs/game_ad_version_preference.xml
- <Package Folder>/shared_prefs/migration.xml
- <Package Folder>/shared_prefs/openudid_prefs.xml
- <Package Folder>/shared_prefs/supersonic_shared_preferen.xml
- <Package Folder>/shared_prefs/supersonic_shared_preferen.xml.bak
- <SD-Card>/.chartboost/####/18ca598a50bed17dcffd58d92a9de3294a898709.png
- <SD-Card>/.chartboost/####/4df637f7139064b4bce606fcee025287bf7a165c.png
- <SD-Card>/.chartboost/####/581c655ff6cd45506933ef9c_568-1478255967.mp4
- <SD-Card>/.chartboost/####/58cfb0d043150f291efb9b7e_568-1490006224.mp4
- <SD-Card>/.chartboost/####/594e220843150f4f70d960dc_568-1498292744.mp4
- <SD-Card>/.chartboost/####/595b7cf204b0165cf3f8f92f_568-1499167986.mp4
- <SD-Card>/.chartboost/####/597af73e43150f76fb1bb33d_568-1501230910.mp4
- <SD-Card>/.chartboost/####/7e265867124e773e7ee5144c9e05b36f20fe43bc.png
- <SD-Card>/.chartboost/.adId
- <SD-Card>/.gameAd/####/banner_ad_ew_en.jpg
- <SD-Card>/.gameAd/####/com.feelingtouch.empirewar.png
- <SD-Card>/.gameAd/####/com.feelingtouch.zf3d.png
- <SD-Card>/.gameAd/####/com.feelingtouch.zf3d.png (deleted)
- <SD-Card>/.gameAd/com.feelingtouch.zf3d_LANDSCAPE.jpg
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1380229154.js
- <SD-Card>/Android/####/79a285c9b99601320e4d7770dafaaea01fd8aa6f_v23_phone.mp4
- <SD-Card>/Android/####/jquery-1.9.1.min.js
- <SD-Card>/Android/####/jquery.knob.js
- <SD-Card>/Android/####/o903c61a_f67b44052f3ebb1fe0f3dc2f8756aad020349bf6_raw11.gif
- <SD-Card>/Android/####/ob13c7a6_dae078c066609e0b378b46d35863e03822759c1f_raw11.gif
- <SD-Card>/Android/####/sound_off.png
- <SD-Card>/Android/####/sound_on.png
- <SD-Card>/Android/####/tmp_mobileController.html
- <SD-Card>/Android/####/zepto-1.1.3.min.js
Miscellaneous:
Loads the following dynamic libraries:
- felapp
Gains access to network information
Gains access to telephone information (number, imei, etc.)
Displays its own windows over windows of other applications
