Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Hmad.2
- Android.Hmad.7.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
DNS requests:
- d1qxrv0####.cloudf####.net
- e####.7####.com
- e####.h####.com
- e####.h####.com
- e####.yh####.com
- ecup####.h####.com
- epcon####.h####.com
- epup####.h####.com
- f####.guan####.com
- hgup####.e####.com
- hgup####.h####.com
- p####.h####.com
- ve####.ip####.com
- www.b####.com
Modified file system:
Creates the following files:
- <Package Folder>/app_jc/dfp.jar
- <Package Folder>/app_jc/dfx.jar
- <Package Folder>/app_jc/tfp.jar
- <Package Folder>/app_jc/tfx.jar
- <Package Folder>/ck/ck.zip
- <Package Folder>/databases/fp.db-journal
- <Package Folder>/databases/fpdown.db-journal
- <Package Folder>/databases/fx_kit_unlock-journal
- <Package Folder>/databases/fxlock.db-journal
- <Package Folder>/files/####/libmonitor.so
- <Package Folder>/files/####/temp_monitor.so
- <Package Folder>/shared_prefs/flowapp_shared.xml.xml
- <Package Folder>/shared_prefs/fpksp.xml
- <Package Folder>/shared_prefs/fpssp.xml
- <Package Folder>/shared_prefs/fxkit.xml
- <Package Folder>/shared_prefs/fxssp.xml
- <SD-Card>/Android/####/.UUID
Miscellaneous:
Loads the following dynamic libraries:
- libmonitor
- libskin
Uses the following algorithms to decrypt data:
- DES
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
