Technical information
Malicious functions:
Sends SMS messages:
- 900: 01
Executes code of the following detected threats:
- Android.Locker.214.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- 1####.####.219
HTTP POST requests:
- 1####.####.219/688
- 1####.####.219/2427
- 1####.####.219/8446
- 1####.####.219/1863
- 1####.####.219/5330
- 1####.####.219/594
- 1####.####.219/8180
- 1####.####.219/304
- 1####.####.219/3811
- 1####.####.219/5287
Modified file system:
Creates the following files:
- <Package Folder>/app_fjqzlgpfv/olwenfjfc.jar
- <Package Folder>/databases/xpls-journal
- <Package Folder>/shared_prefs/com.google.android.gcm.xml
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
