Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) api.tele####.org:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) api.tele####.org:443
- TCP(TLS/1.0) acco####.go####.com:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) cale####.go####.com:443
- TCP(TLS/1.0) adser####.go####.com:443
DNS requests:
- acco####.go####.com
- adser####.go####.com
- api.tele####.org
- cale####.go####.com
- f####.gst####.com
- ssl.gst####.com
- www.go####.com
- www.go####.nl
- www.gst####.com
HTTP GET requests:
- www.go####.com/complete/search?hl=####&client=####&q=####
HTTP POST requests:
- api.tele####.org/bot475019565:AAHL_KXib6XLRifrSryofFyMVLY6dUtbDLA/sendme...
Modified file system:
Creates the following files:
- /data/data/####/1
- /data/data/####/10
- /data/data/####/2
- /data/data/####/216424171.jpg
- /data/data/####/3
- /data/data/####/4
- /data/data/####/5
- /data/data/####/6
- /data/data/####/8
- /data/data/####/9
- /data/data/####/telerat2.txt
- /data/data/####/thisapk_slm.txt
Miscellaneous:
Gains access to camera interface.
Gains access to network information.
Displays its own windows over windows of other applications.
