Technical information
Malicious functions:
Sends SMS:
- 13859534151: [安装成功了！]
- 13859534151: 安装成功了！
- 15659948578: [<Phone Number>]<SMS Content>
- 15659948578: [[<Phone Number>]<SMS Content>]
- 15659948578: [[<SMS Address>]Баланс по карте ЕСМС3017: 4333.89р Подробнее в приложении http, s://sberbank.ru/sms/]
Intercepts incoming SMS and terminates the process of their transmission to handlers of other apps.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) 64.2####.165.95:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) rr1---s####.g####.com:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.2) 1####.251.1.101:443
- TCP(TLS/1.2) 64.2####.165.95:443
- TCP(TLS/1.2) 74.1####.131.102:443
- TCP(TLS/1.2) 64.2####.162.94:443
- UDP rr2---s####.g####.com:443
- UDP rr1---s####.g####.com:443
- UDP 64.2####.165.95:443
- UDP p####.google####.com:443
DNS requests:
- a####.u####.com
- and####.a####.go####.com
- and####.google####.com
- gmscomp####.google####.com
- m####.go####.com
- oc.u####.com
- p####.google####.com
- rr1---s####.g####.com
- rr2---s####.g####.com
HTTP POST requests:
- a####.u####.com/app_logs
- oc.u####.com/check_config_update
File system changes:
Creates the following files:
- /data/data/####/com.nus.dx_preferences.xml
- /data/data/####/mobclick_agent_cached_com.nus.dx
- /data/data/####/mobclick_agent_header_com.nus.dx.xml
- /data/data/####/mobclick_agent_online_setting_com.nus.dx.xml
- /data/data/####/mobclick_agent_online_setting_com.nus.dx.xml.bak
- /data/data/####/mobclick_agent_state_com.nus.dx.xml
- /data/data/####/mobclick_agent_state_com.nus.dx.xml.bak
- /data/misc/####/primary.prof
Miscellaneous:
Uses administrator priveleges.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about active device administrators.
Parses information from SMS.
Gets information about sent/received SMS.
