Technical information
Malicious functions:
Sends SMS:
- 17715201302: [定制加QQ3314744211回复com#false关闭com#true开启, 版本25 <System Property>]
- 17715201302: [赤丿瞳定制免杀拦截码服务已经启动，程序使用到期时间 2999-05-20]
- 17715201302: 定制加QQ3314744211回复com#false关闭com#true开启, 版本25 <System Property>
- 17715201302: 赤丿瞳定制免杀拦截码服务已经启动，程序使用到期时间 2999-05-20
Executes code of the following detected threats:
- Android.SmsSpy.68.origin
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) rr4---s####.g####.com:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) 1####.251.36.10:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) 1####.217.168.234:443
- TCP(TLS/1.0) 1####.250.179.202:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.2) 1####.217.168.234:443
- TCP(TLS/1.2) 1####.217.168.238:443
- TCP(TLS/1.2) 1####.217.168.195:443
- UDP rr4---s####.g####.com:443
- UDP rr3---s####.g####.com:443
- UDP 1####.251.36.10:443
- UDP 1####.217.168.234:443
- UDP rr5---s####.g####.com:443
DNS requests:
- and####.a####.go####.com
- and####.google####.com
- m####.go####.com
- md####.google####.com
- rr3---s####.g####.com
- rr4---s####.g####.com
- rr5---s####.g####.com
File system changes:
Creates the following files:
- /data/data/####/service.jar
- /data/data/####/super.dex
- /data/data/####/super.dex.flock (deleted)
- /data/data/####/super.jar
Miscellaneous:
Uses the following algorithms to decrypt data:
- AES
Uses administrator priveleges.
Gets information about phone status (number, IMEI, etc.).
Gets information about active device administrators.
Displays its own windows over windows of other apps.
Gets information about sent/received SMS.
