Technical information
Malicious functions:
Removes app icon from the screen.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.79.153.171:8082
- TCP(TLS/1.0) and####.cli####.go####.com:443
DNS requests:
- and####.cli####.go####.com
File system changes:
Creates the following files:
- /data/data/####/1.zip
- /data/data/####/code_message.xml
- /data/data/####/proxy.crt
- /data/data/####/proxy.key
- /data/data/####/server
- /data/data/####/server.json
- /data/data/####/system
- /data/data/####/webview.db-journal
Miscellaneous:
Executes the following shell scripts:
- chmod 777 <Package Folder>/files/server
- chmod 777 <Package Folder>/files/system
- grep <Package>/files
- ps
- sh -c chmod 777 <Package Folder>/files/server
- sh -c chmod 777 <Package Folder>/files/system
- sh -c ps | grep <Package>/files
Displays its own windows over windows of other apps.
