Technical information
Malicious functions:
Sends SMS:
- 01022843407: <IMEI>,울산
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) d####.hos####.b####.net:80
- TCP(HTTP/1.1) no####.co.kr:80
DNS requests:
- d####.hos####.b####.net
- no####.co.kr
HTTP GET requests:
- d####.hos####.b####.net/infomail/error/message04.html
- no####.co.kr/0269880246.kna
- no####.co.kr/<IMEI>.kna
- no####.co.kr/ulsan/jctaxus.apk
- no####.co.kr/ulsan/onver.ini
File system changes:
Creates the following files:
- /data/data/####/JCTAX.db
- /data/data/####/JCTAX.db-journal
- /data/data/####/jcpref.xml
- /data/media/####/0269880246.kna
- /data/media/####/356507059351895.kna
- /data/media/####/jctaxus.apk
- /data/media/####/onver.ini
- /data/media/####/pdaid.txt
- /data/media/####/pdaver.txt
Miscellaneous:
Contains functionality for automatic SMS sending.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
