Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Ninebox.4.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) and####.cli####.go####.com:443
DNS requests:
- and####.cli####.go####.com
- fsr.leno####.com
- lds.leno####.com
Modified file system:
Creates the following files:
- /data/data/####/1531862082977.jar
- /data/data/####/1531862083065.dex
- /data/data/####/1531862083065.jar
- /data/data/####/1531862083794.jar
- /data/data/####/1531862083849.jar
- /data/data/####/1531862083851.jar
- /data/data/####/lenovo_reaper.db13
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
Uses the following algorithms to decrypt data:
- DES
Gains access to telephone information (number, imei, etc.).
