Technical information
Malicious functions:
Sends SMS messages:
- 13840272844: <SMS Content>
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) l####.tbs.qq.com:80
DNS requests:
- l####.tbs.qq.com
- www.ao####.com
HTTP POST requests:
- l####.tbs.qq.com/ajax?c=####&k=####
Modified file system:
Creates the following files:
- <Package Folder>/app_tbs/####/core_info
- <Package Folder>/app_tbs/####/tbs_report_lock.txt
- <Package Folder>/app_tbs/####/tbslock.txt
- <Package Folder>/cache/####/WebpageIcons.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/tbs_download_stat.xml
- <Package Folder>/shared_prefs/tbs_load_stat_flag.xml
- <SD-Card>/Android/####/.nomedia
Miscellaneous:
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
Parses information from SMS messages.
Gains access to information about sent/received SMS messages.
