Technical information
Malicious functions:
Sends SMS messages:
- 09224935863: سلام (@GM_GAME)
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) tele####.me:80
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) 2####.58.211.110:443
- TCP(TLS/1.0) c####.tel####.pe:443
- TCP(TLS/1.0) f####.google####.com:443
DNS requests:
- c####.tel####.pe
- f####.google####.com
- f####.gst####.com
- tele####.me
- tele####.org
- www.google-####.com
HTTP GET requests:
- tele####.me/css/bootstrap.min.css?2####
- tele####.me/css/telegram.css?1####
- tele####.me/img/tgme/Arrow_1x.png
- tele####.me/img/tgme/LogoBig_1x.png
- tele####.me/irhack_apps
- www.google-####.com/analytics.js
Miscellaneous:
Contains functionality to send SMS messages automatically.
Displays its own windows over windows of other applications.
