Technical information
Malicious functions:
Sends SMS messages:
- 13337675174: 软件已安装，但未被激活，回复Start开始拦截，回复Stop关闭拦截;回复#手机号#短信内容 自由发送、回复
- 13337675174: 软件已激活;
- 13337675174: 软件期限已到，请续费或重新购买
Executes code of the following detected threats:
- Android.SmsBot.53.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
DNS requests:
- mt####.go####.com
Modified file system:
Creates the following files:
- <Package Folder>/.cache/encode.dex
- <Package Folder>/shared_prefs/config.xml
Miscellaneous:
Loads the following dynamic libraries:
- ddog
Uses administrator priveleges.
Uses special library to hide executable bytecode.
Gains access to telephone information (number, imei, etc.).
