Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Plague.1.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) and####.bc####.com:80
- TCP(HTTP/1.1) www.a####.co.in:80
- TCP(HTTP/1.1) a.v####.mobi:80
- TCP(TLS/1.0) and####.bc####.com:443
DNS requests:
- a.v####.mobi
- and####.bc####.com
- bz.o####.com
- bz1.o####.com
- bz2.o####.com
- www.a####.co.in
HTTP GET requests:
- a.v####.mobi/delivery/adapi.php?zoneid=####&ua=####&app=####&aid=####&im...
- www.a####.co.in/Ads/AppOnAds.xml
HTTP POST requests:
- and####.bc####.com/api/v4/mobile_apps/5047035c9b77d20b00000049/fullscree...
- and####.bc####.com/api/v4/mobile_apps/5047035c9b77d20b00000049/install.j...
Modified file system:
Creates the following files:
- /data/data/####/classes.jar
- /data/data/####/dbwhl-journal
Miscellaneous:
Uses the following algorithms to encrypt data:
- DES-ECB-PKCS5Padding
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
