Technical information
Malicious functions:
Removes app icon from the screen.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.79.153.171:8082
DNS requests:
- mt####.go####.com
- v.what####.net
File system changes:
Creates the following files:
- /data/data/####/1.zip
- /data/data/####/code_message.xml
- /data/data/####/proxy.crt
- /data/data/####/proxy.key
- /data/data/####/server
- /data/data/####/server.json
- /data/data/####/system
- /data/data/####/webview.db-journal
Miscellaneous:
Executes the following shell scripts:
- chmod 777 <Package Folder>/files/server
- chmod 777 <Package Folder>/files/system
- grep <Package>/files
- ps
- sh
- sh -c <Package Folder>/files/server -p=47121 -k=foo -m=aes-128-cfb -t=600
- sh -c chmod 777 <Package Folder>/files/server
- sh -c chmod 777 <Package Folder>/files/system
- sh -c ps | grep <Package>/files
Displays its own windows over windows of other apps.
