Technical information
Malicious functions:
Sends SMS:
- 01022843407: <IMEI>,울산
Prompts to install third-party apps.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) no####.co.kr:80
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) rr1---s####.g####.com:443
- TCP(TLS/1.0) rr3---s####.g####.com:443
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.0) pla####.google####.com:443
- TCP(TLS/1.0) 64.2####.161.94:443
- TCP(TLS/1.2) 64.2####.162.100:443
- TCP(TLS/1.2) 1####.194.73.95:443
- TCP(TLS/1.2) pla####.google####.com:443
- UDP rr2---s####.g####.com:443
- UDP www.google####.com:443
- UDP rr1---s####.g####.com:443
DNS requests:
- and####.cli####.go####.com
- and####.google####.com
- gmscomp####.google####.com
- no####.co.kr
- pla####.google####.com
- pla####.googleu####.com
- rr1---s####.g####.com
- rr1---s####.g####.com
- rr2---s####.g####.com
- rr2---s####.g####.com
- rr3---s####.g####.com
- www.google####.com
HTTP GET requests:
- no####.co.kr/ulsan/jctaxus.apk
- no####.co.kr/ulsan/onver.ini
File system changes:
Creates the following files:
- /data/data/####/7c0432e5-f2df-436c-98ee-15dba17e14f3
- /data/data/####/BackgroundLogger.db-journal
- /data/data/####/JCTAX.db-journal
- /data/data/####/accounts_valuestore.pb.lock
- /data/data/####/ad_id_valuestore.pb.lock
- /data/data/####/app_update_metadata_valuestore.pb.lock
- /data/data/####/background_counters.db-journal
- /data/data/####/background_logger_valuestore.pb
- /data/data/####/base_value_store.pb
- /data/data/####/base_value_store.pb.tmp
- /data/data/####/c75af483-23ea-4a72-bd83-602600985fab
- /data/data/####/cache_performance_summary.db-journal
- /data/data/####/counters.db-journal
- /data/data/####/data_loader_readlogs_cache_metadata_valuestore.pb.lock
- /data/data/####/dataloader_failure_valuestore.pb.lock
- /data/data/####/dataloader_streaming_info_valuestore.pb.lock
- /data/data/####/download_service-journal
- /data/data/####/download_service_preferences_key.xml
- /data/data/####/ed5527c6-f30e-483b-b207-4b3702f614b8
- /data/data/####/event_generator.xml
- /data/data/####/eventlog.store1106300716.log
- /data/data/####/eventlog.store2020660864.log
- /data/data/####/finsky.xml
- /data/data/####/frosting.db-journal
- /data/data/####/gfbfv11201383028old
- /data/data/####/gfbfv1382727270old
- /data/data/####/gfbfv1559154323old
- /data/data/####/hygiene_valuestore.pb
- /data/data/####/hygiene_valuestore.pb.tmp
- /data/data/####/installer_data_v2.db
- /data/data/####/language_split_per_app_valuestore.pb.lock
- /data/data/####/language_split_per_app_valuestore.pb.tmp
- /data/data/####/logs_upload_attempt.log
- /data/data/####/main_scheduler_preferences_valuestore.pb.tmp
- /data/data/####/multi_proc.pb.lock
- /data/data/####/p_com.android.vending1386332827.apk
- /data/data/####/p_config.en434175735.apk
- /data/data/####/p_config.x86_64487095912.apk
- /data/data/####/permission_revocation_valuestore.pb
- /data/data/####/phenotype.db
- /data/data/####/phenotype.db-shm (deleted)
- /data/data/####/phenotype.db-wal
- /data/data/####/phenotype.db-wal (deleted)
- /data/data/####/phonesky_header_valuestore.pb.lock
- /data/data/####/phonesky_header_valuestore.pb.tmp
- /data/data/####/play_metalog.log
- /data/data/####/play_module_service_shared_prefs.xml
- /data/data/####/proc_background.pb
- /data/data/####/proc_background.pb.tmp
- /data/data/####/resource_data.db
- /data/data/####/scheduler_background-journal
- /data/data/####/scheduler_main-journal
- /data/data/####/selfupdate_scheduler.xml
- /data/data/####/selfupdate_scheduler.xml.bak
- /data/data/####/streamdatastore.db-journal
- /data/data/####/system_component_update_valuestore.pb.tmp
- /data/data/####/update_checker_valuestore.pb.tmp
- /data/data/####/verify_apps.db-journal
- /data/data/####/warm_multi_proc.pb.lock
- /data/data/####/warm_multi_proc.pb.tmp
- /data/data/####/warm_proc_main.pb.tmp
- /data/media/####/jctaxus.apk
- /data/media/####/onver.ini
- /data/media/####/pdaid.txt
- /data/media/####/pdaver.txt
- /data/misc/####/primary.prof
- /data/user_de/####/com.google.android.libraries.performance.pri...ing.pb
Miscellaneous:
Accesses the ITelephony private interface.
Contains functionality for automatic SMS sending.
Gets information about phone status (number, IMEI, etc.).
Gets information about APN settings.
Gets information about active device administrators.
Gets information about installed apps.
Gets information about accounts associated with the device.
Displays its own windows over windows of other apps.
