Technical information
Malicious functions:
Sends SMS messages:
- 13061805062: <SMS Address>: <SMS Content>
- 13061805062: 软件已安装，但未被激活
- 13061805062: 软件已激活;
Removes its shortcut from the home screen.
Intercepts incoming SMS messages and terminates the process of their transmission to handlers of other applications.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) www.go####.com:443
DNS requests:
- mt####.go####.com
- www.go####.com
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/config.xml
Miscellaneous:
Uses administrator priveleges.
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
Gains access to telephone information (number, imei, etc.).
Parses information from SMS messages.
