Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Plague.1.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sf.h5####.com:80
DNS requests:
- sf.h5####.com
HTTP GET requests:
- sf.h5####.com/m/init.jsp
HTTP POST requests:
- sf.h5####.com/m/a.jsp
File system changes:
Creates the following files:
- /data/data/####/ad_installed
- /data/data/####/app_new_conf
- /data/data/####/app_settings
- /data/data/####/classes.jar
- /data/data/####/dbckdx-journal
- /data/data/####/init.conf
- /data/data/####/pendingActions
- /data/media/####/.94631404c1179a8a
- /data/media/####/.d40b7b8e2b735ccb
Miscellaneous:
Uses the following algorithms to encrypt data:
- DES-ECB-PKCS5Padding
Gets information about phone status (number, IMEI, etc.).
Gets information about running apps.
Displays its own windows over windows of other apps.
