Technical information
Malicious functions:
Prompts to install third-party apps.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 2####.180.3.193:7771
- TCP(TLS/1.0) cat####.ninja:443
DNS requests:
- cat####.ninja
HTTP GET requests:
- 2####.180.3.193:7771/ws?build_id=####&device_id=####
File system changes:
Creates the following files:
- /data/app/####/app
Miscellaneous:
Executes the following shell scripts:
- dumpsys account
- dumpsys user
- ps
Displays its own windows over windows of other apps.
