Technical information
Malicious functions:
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) uc####.ir:80
- TCP(HTTP/1.1) ca.p####.co:80
- TCP(TLS/1.0) t####.me:443
- TCP(TLS/1.0) uc####.ir:443
- TCP(TLS/1.0) c####.tel####.pe:443
- TCP(TLS/1.0) f####.google####.com:443
DNS requests:
- c####.tel####.pe
- ca.p####.co
- f####.google####.com
- t####.me
- tele####.org
- uc####.ir
HTTP GET requests:
- uc####.ir/
- uc####.ir/forum.php
HTTP POST requests:
- ca.p####.co/api/492/store/
File system changes:
Creates the following files:
- /data/data/####/__pushe_base_lib_db-journal
- /data/data/####/co.ronash.pushe.keystore.xml
- /data/data/####/com.mohammadjv.kplus_preferences.xml
- /data/data/####/device_id.xml.xml
- /data/data/####/evernote_jobs.db-journal
- /data/data/####/evernote_jobs.xml
- /data/data/####/first_run.xml
- /data/data/####/unsent_requests
Miscellaneous:
Loads the following dynamic libraries:
- klidboard
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
