Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) fathers####.asia:80
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) t####.me:443
- TCP(TLS/1.0) c####.tel####.pe:443
DNS requests:
- c####.tel####.pe
- f####.google####.com
- fathers####.asia
- t####.me
- tele####.org
HTTP GET requests:
- fathers####.asia/p.php?pass=####&get=####&update_id=####
- fathers####.asia/p.php?pass=####&pp=####&device_code=####
- fathers####.asia/p.php?pass=####&pp=####&update_id=####
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/<Package>.xml
Miscellaneous:
Uses administrator priveleges.
Gains access to information about active device administrators.
Displays its own windows over windows of other applications.
