Technical information
Malicious functions:
Sends suspicious USSD requests.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.0) 64.2####.163.95:443
- TCP(TLS/1.0) rr6---s####.g####.com:443
- TCP(TLS/1.0) 64.2####.163.94:443
- TCP(TLS/1.2) 1####.250.74.170:443
- TCP(TLS/1.2) 1####.217.168.234:443
- TCP(TLS/1.2) 1####.194.220.113:443
- TCP(TLS/1.2) 64.2####.163.94:443
- TCP(TLS/1.2) 1####.194.163.27:443
- TCP(TLS/1.2) 1####.250.74.174:443
- TCP(TLS/1.2) 2####.58.211.10:443
- TCP(TLS/1.2) 1####.250.74.164:443
- UDP p####.google####.com:443
- UDP rr6---s####.g####.com:443
- UDP 64.2####.163.95:443
DNS requests:
- gmscomp####.google####.com
- p####.google####.com
- rr6---s####.g####.com
File system changes:
Creates the following files:
- /data/data/####/com.ppardaz.tamas_preferences.xml
Miscellaneous:
Makes phone calls to the following numbers:
- *21*09302519068#
- #21#
- *21*09372405822#
- *21*09166069499#
Displays its own windows over windows of other apps.
