Technical information
Malicious functions:
Sends SMS messages:
- 8738: TG tivihd KH seokid 0
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) mo####.vn:1028
- TCP(HTTP/1.1) 1####.213.94.52:6969
- TCP(HTTP/1.1) 1####.213.94.52:8886
- TCP(TLS/1.0) 1####.217.20.78:443
DNS requests:
- mo####.vn
HTTP GET requests:
- mo####.vn:1028/datas/picture/appgame/dautruong.png
- mo####.vn:1028/datas/picture/shortcut/kiemhiep.png
- mo####.vn:1028/datas/picture/shortcut/vuibanca.png
HTTP POST requests:
- 1####.213.94.52:6969/mAds/mbn/reg.mbn?regid=####&deviceid=####&appname=#...
- 1####.213.94.52:8886/mPoli_Web/ads.mobi?poli=####
- 1####.213.94.52:8886/mPoli_Web/mbn/propoli.mbn?poli=####
- mo####.vn:1028/mbn/dl/appfree/tivihd.apk
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/com.google.android.gcm.xml
- <Package Folder>/shared_prefs/countCGfappsub.xml
- <Package Folder>/shared_prefs/shortcutdataaudio.xml
- <SD-Card>/LazyList/-149873771
- <SD-Card>/LazyList/361187267
- <SD-Card>/LazyList/70295476
Miscellaneous:
Contains functionality to send SMS messages automatically.
Displays its own windows over windows of other applications.
