Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Mobifun.15.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) p####.pay####.com:80
- TCP(TLS/1.0) 1####.139.241.18:443
DNS requests:
- p####.pay####.com
HTTP GET requests:
- p####.pay####.com/s-r/38/5b96538179492
Modified file system:
Creates the following files:
- /data/data/####/.mf
- /data/data/####/46713a2f51b14273b9cb98d686d27789
- /data/data/####/base.apk
- /data/data/####/cntznvnsyutbmkcdrtycz.xml
- /data/data/####/kppqaw
- /data/data/####/tdpryq
Miscellaneous:
Loads the following dynamic libraries:
- tdpryq
Gains access to network information.
Adds tasks to the system scheduler.
