Technical information
Malicious functions:
Sends SMS messages:
- +13166199192: Philip, private offer for regular customers! Only one week! http://em8oi89o.net/tds/116621
- +15303512896: Wholesale prices and best quality! Delwin, please just try it! http://em1oi78o.com/tds/148039
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 6nht####.com:80
DNS requests:
- 6nht####.com
HTTP POST requests:
- 6nht####.com/api/getonduty/
- 6nht####.com/api/registration/
- 6nht####.com/api/result/
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/smshelper.xml
Miscellaneous:
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
