Technical information
Malicious functions:
Overlays the screen with its own window and blocks GUI access.
Sets a lock screen password.
Threat detection based on machine learning.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.cn:80
- TCP(TLS/1.0) 1####.177.14.101:443
DNS requests:
- a####.cn
HTTP GET requests:
- a####.cn/music/光辉岁月.mp3
Miscellaneous:
Uses the following algorithms to decrypt data:
- DES
Uses administrator priveleges.
Gets information about active device administrators.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
