Technical information
Malicious functions:
Sends SMS:
- 15143290368: приложении http://sberbank.ru/sms/h1
- 15143290368: 提示：设备已安装，等待激活
- 15143290368: 提示：设备已激活
- 15143290368: 收到号码：<SMS Address>, 短信内容 :<SMS Content>
- 15143290368: 收到号码：<SMS Address>, 短信内容 :VISA6170 Баланс: 7247.47р. Подробности в мобильном
- 18769100464: приложении http://sberbank.ru/sms/h1
- 18769100464: 提示：设备已安装，等待激活
- 18769100464: 提示：设备已激活
- 18769100464: 收到号码：<SMS Address>, 短信内容 :<SMS Content>
- 18769100464: 收到号码：<SMS Address>, 短信内容 :VISA6170 Баланс: 7247.47р. Подробности в мобильном
Intercepts incoming SMS and terminates the process of their transmission to handlers of other apps.
Miscellaneous:
Uses administrator priveleges.
Contains functionality for automatic SMS sending.
Gets information about phone status (number, IMEI, etc.).
Gets information about active device administrators.
Displays its own windows over windows of other apps.
Parses information from SMS.
