Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.243.origin
- Android.Hmad.1
- Android.Hmad.1.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ip####.com:80
- TCP(HTTP/1.1) p####.apk.apt####.com:80
DNS requests:
- casho####.co
- e####.7####.com
- e####.h####.com
- ecup####.h####.com
- epup####.h####.com
- f####.guan####.com
- hgup####.e####.com
- hgup####.h####.com
- ip####.com
- p####.apk.apt####.com
- ve####.ip####.com
HTTP GET requests:
- ip####.com/json
- p####.apk.apt####.com/jonathanshef/org-sbtools-gamehack-310-5982311-c201...
Modified file system:
Creates the following files:
- <Package Folder>/app_jc/dfp.jar
- <Package Folder>/app_jc/dfp.jar (deleted)
- <Package Folder>/app_jc/dfx.jar
- <Package Folder>/app_jc/tfp.jar
- <Package Folder>/app_jc/tfp.jar (deleted)
- <Package Folder>/app_jc/tfx.jar
- <Package Folder>/databases/fp.db-journal
- <Package Folder>/databases/fpdown.db-journal
- <Package Folder>/databases/fxlock.db-journal
- <Package Folder>/er/cr.zip
- <Package Folder>/shared_prefs/flowapp_shared.xml.xml
- <Package Folder>/shared_prefs/fpksp.xml
- <Package Folder>/shared_prefs/fpssp.xml
- <Package Folder>/shared_prefs/fxkit.xml
- <Package Folder>/shared_prefs/fxssp.xml
- <SD-Card>/Android/####/.UUID
- <SD-Card>/FP.txt
Miscellaneous:
Loads the following dynamic libraries:
- skin
Uses the following algorithms to decrypt data:
- DES
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
