Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Plague.1.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) www.angle####.com:80
- TCP(TLS/1.0) www.go####.com:443
DNS requests:
- bz.o####.com
- bz1.o####.com
- bz2.o####.com
- www.angle####.com
- www.go####.com
HTTP GET requests:
- www.angle####.com/aPdXk/terms-of-service/Terms of Service
- www.angle####.com/favicon.ico
- www.angle####.com/terms-of-service/
- www.angle####.com/terms-of-service/Terms of Service
- www.go####.com/complete/search?hl=####&client=####&q=####
Modified file system:
Creates the following files:
- <Package Folder>/app_vxhp/classes.jar
- <Package Folder>/databases/dbdprj-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml
Miscellaneous:
Uses the following algorithms to encrypt data:
- DES-ECB-PKCS5Padding
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
