Technical information
Malicious functions:
Sends SMS messages:
- 17088385262: <Package>.p@4a97e108<Package>.p@4a97e108<Package>.p@4a97e108
- 17088385262: <Package>.p@4a984e78<Package>.p@4a984e78<Package>.p@4a984e78
- 17088385262: <Package>.p@4a988998<Package>.p@4a988998<Package>.p@4a988998
- 17088385262: <Package>.p@4a990a28<Package>.p@4a990a28<Package>.p@4a990a28
- 17088385262: <Package>.p@4a99fd84<Package>.p@4a99fd84<Package>.p@4a99fd84
- 17088385262: <Package>.p@4a9a21a4<Package>.p@4a9a21a4<Package>.p@4a9a21a4
- 17088385262: <Package>.p@4a9a3590<Package>.p@4a9a3590<Package>.p@4a9a3590
- 17088385262: <Package>.p@4a9a91bc<Package>.p@4a9a91bc<Package>.p@4a9a91bc
- 17088385262: <Package>.p@4a9ab6d4<Package>.p@4a9ab6d4<Package>.p@4a9ab6d4
- 17088385262: <Package>.p@4a9adb48<Package>.p@4a9adb48<Package>.p@4a9adb48
- 17088385262: <Package>.p@4a9ae7c8<Package>.p@4a9ae7c8<Package>.p@4a9ae7c8
- 17088385262: <Package>.p@4a9b7080<Package>.p@4a9b7080
- 17088385262: <Package>.p@4a9c0274<Package>.p@4a9c0274<Package>.p@4a9c0274
- 17088385262: <Package>.p@4a9c1b64<Package>.p@4a9c1b64<Package>.p@4a9c1b64
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
DNS requests:
- mt####.go####.com
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- <Package Folder>/databases/htSms.db
- <Package Folder>/databases/htSms.db-journal
Miscellaneous:
Changes volume and vibration settings.
Gains access to telephone information (number, imei, etc.).
Gains access to information about sent/received SMS messages.
