Technical information
Malicious functions:
Removes its shortcut from the home screen.
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) we####.ya####.ru:443
DNS requests:
- mt####.go####.com
- we####.ya####.ru
Modified file system:
Creates the following files:
- <Package Folder>/files/####/20171116_1231070HIJ8o5
- <Package Folder>/files/####/20171116_123107Bdq65r8
- <Package Folder>/files/####/20171116_123107jlgczv2
- <Package Folder>/files/####/20171116_123107mhgBYWl
- <Package Folder>/files/####/20171116_123107zgjcBY5
- <Package Folder>/files/####/20171116_123210ofUVYwl
- <Package Folder>/files/####/br
- <Package Folder>/files/####/browser.txt
- <Package Folder>/files/####/callLog.txt
- <Package Folder>/files/####/cl
- <Package Folder>/files/####/co
- <Package Folder>/files/####/contacts.txt
- <Package Folder>/files/####/sms_received.txt
- <Package Folder>/files/####/sms_sended.txt
- <Package Folder>/files/####/ssr
- <Package Folder>/files/####/ssss
- <Package Folder>/shared_prefs/settings.xml
Miscellaneous:
Executes next shell scripts:
- mu -c id
Uses the following algorithms to encrypt data:
- AES
- RSA
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
Gains access to information about incoming/outgoing calls.
Gains access to information about sent/received SMS messages.
