Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.613.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) gd.a.s####.com:80
DNS requests:
- c####.api.zhifa####.net
- i####.api.zhifa####.net
- i####.api.zhifa####.net
- pv.s####.com
- sdk.api.zhifa####.net
- v####.api.eeric####.com
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- <Package Folder>/app_wyzf_plg/pay_plg.jar
- <Package Folder>/files/####/onib_clz.jar
- <Package Folder>/files/new_md.jar
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/shared_prefs/SP_REPLACE_CLASSLOADER_CLASS_NAME.xml
- <Package Folder>/shared_prefs/config50240.xml
- <SD-Card>/pay/<Package>_<IMSI>_20171215_pay.log
Miscellaneous:
Contains functionality to send SMS messages automatically.
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about sent/received SMS messages.
