Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.570.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
DNS requests:
- a####.u####.com
HTTP POST requests:
- a####.u####.com/app_logs
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/000.xml
- /data/data/####/188678.jar
- /data/data/####/23.xml
- /data/data/####/23356507059351895.xml
- /data/data/####/24356507059351895.xml
- /data/data/####/25356507059351895.xml
- /data/data/####/477428.jar
- /data/data/####/70643.jar
- /data/data/####/710047.jar
- /data/data/####/YMMsg.db-journal
- /data/data/####/mobclick_agent_cached_com.lwiingensan.mperivsa.etu113
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
Miscellaneous:
Loads the following dynamic libraries:
- 0oijhy7nvcderty
- cocos2dcpp
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
