Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Banker.1427
Prompts to install third-party applications.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 8####.pro:80
- TCP(TLS/1.0) s####.appsf####.com:443
- TCP(TLS/1.0) t.appsf####.com:443
DNS requests:
- 8####.pro
- s####.appsf####.com
- t.appsf####.com
HTTP GET requests:
- 8####.pro/androidupdate.apk
Modified file system:
Creates the following files:
- /data/data/####/com.main.xml
- /data/data/####/ebjdb.jar
- /data/data/####/iDataBase.db-journal
- <Package Folder>/files/cls.dex
- <Package Folder>/files/lllllllllllllllllllllllllllllllllllllllll.zip
- <Package Folder>/shared_prefs/appsflyer-data.xml
- <SD-Card>/Android/####/android_update.apk
Miscellaneous:
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
