Technical information
Malicious functions:
Sends SMS:
- 983072383: 2
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.185.77.118:80
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) 1####.217.17.46:443
- TCP(TLS/1.0) ws.b####.com:443
DNS requests:
- app-mea####.com
- ws.b####.com
File system changes:
Creates the following files:
- /data/data/####/LocalCampaignsSQLTracker.db-journal
- /data/data/####/__pushe_base_lib_db-journal
- /data/data/####/apiAnalytics.xml
- /data/data/####/ba_tr.db-journal
- /data/data/####/ba_user_profile.db-journal
- /data/data/####/bastion_kv.xml
- /data/data/####/co.ronash.pushe.keystore.xml
- /data/data/####/com.batch.optout.xml
- /data/data/####/com.google.InstanceId.properties
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/device_id.xml.xml
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/evernote_jobs.xml
- /data/data/####/google_app_measurement.db-journal
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/httpServiceQueue
- /data/data/####/unsent_requests
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Gets information about location.
Gets information about phone status (number, IMEI, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
