Technical information
Malicious functions:
Sends SMS messages:
- +13473253750: Dear Thomas A! Hot pharmacy offers! Discounted prices! Real quality and faster delivery! http://cheapcanadadrug2018.top/tds/26150776
- +16788182058: Dear Melissa! Hot pharmacy offers! Discounted prices! Real quality and faster delivery! http://cheapcanadadrug2018.top/tds/26150996
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) zhr3wgm####.com:80
DNS requests:
- zhr3wgm####.com
HTTP GET requests:
- zhr3wgm####.com/api/is-up
HTTP POST requests:
- zhr3wgm####.com/api/getonduty/
- zhr3wgm####.com/api/registration/
- zhr3wgm####.com/api/result/
Modified file system:
Creates the following files:
- /data/data/####/Qb91QhR5RdoiTFb.xml
Miscellaneous:
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
