Technical information
Malicious functions:
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) apkgame####.com:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) a####.google####.com:443
- TCP(TLS/1.0) cdn.mobve####.com:443
- TCP(TLS/1.0) js-####.pushmon####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) lo####.ogs####.com:443
- TCP(TLS/1.0) go2s####.wac.2####.####.net:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) a####.mobve####.com:443
- TCP(TLS/1.0) con####.face####.net:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) www.face####.com:443
- TCP(TLS/1.0) www.hostedf####.net:443
- TCP(TLS/1.0) bootstr####.com:443
- TCP(TLS/1.0) bam.nr-####.net:443
- TCP(TLS/1.0) c####.cloudf####.com:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) js.ogs####.com:443
- TCP(TLS/1.0) js-a####.newr####.com:443
DNS requests:
- a####.google####.com
- a####.mobve####.com
- apkgame####.com
- bam.nr-####.net
- bootstr####.com
- c####.cloudf####.com
- cdn.mobve####.com
- con####.face####.net
- f####.google####.com
- f####.gst####.com
- js-####.pushmon####.com
- js-a####.newr####.com
- js.ogs####.com
- lo####.ogs####.com
- m####.go2s####.org
- ssl.gst####.com
- www.face####.com
- www.go####.com
- www.gst####.com
- www.hostedf####.net
HTTP GET requests:
- apkgame####.com/apkredirect
Miscellaneous:
Displays its own windows over windows of other applications.
