Technical information
Malicious functions:
Removes its shortcut from the home screen.
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) 79####.iok.la:11737
DNS requests:
- 79####.iok.la
HTTP POST requests:
- 79####.iok.la:11737/?!!!DSYB####
Modified file system:
Creates the following files:
- /data/data/####/contacts2.db
- /data/data/####/mmssms.db
- <Package Folder>/files/####/config.txt
- <Package Folder>/files/####/res.db-journal
- <Package Folder>/shared_prefs/<Package>.xml
Miscellaneous:
Executes next shell scripts:
- chmod 777 <Package Folder>/files/app01
- chmod 777 <Package Folder>/files/app02
- chmod 777 <Package Folder>/files/app03
- chmod 777 <Package Folder>/files/app04
- chmod 777 <Package Folder>/files/app05
- chmod 777 <Package Folder>/files/app05/SingleGps
- chmod 777 <Package Folder>/files/ims
- logcat
- ls -l /data/data
- sh
- sqlite3 /data/data/com.android.providers.contacts/databases/contacts2.db select _id,number,duration,date,type from calls
- sqlite3 /data/data/com.android.providers.telephony/databases/mmssms.db select _id,address,date,type,replace(body,x'0a','') from sms order by date desc
- sqlite3 /data/data/com.android.providers.telephony/databases/mmssms.db select _id,address,date,type,replace(body,x'0a','') from sms
- su
Uses elevated priveleges.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
Gains access to information about incoming/outgoing calls.
Gains access to information about sent/received SMS messages.
