Technical information
Malicious functions:
Sends SMS messages:
- 10658423: mvwlan,0fd02d697a6923dceea0c7128a88d9ff,232
- 10658423: mvwlan,0fd02d697a6923dceea0c7128a88d9ff,6845
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) s####.cmv####.cn:80
DNS requests:
- s####.cmv####.cn
HTTP POST requests:
- s####.cmv####.cn/clt30/test.jsp
Modified file system:
Creates the following files:
- <Package Folder>/files/libcore.zip
- <Package Folder>/files/libyhcore.so
- <Package Folder>/shared_prefs/<Package>.xml
Miscellaneous:
Loads the following dynamic libraries:
- libyhcore
Uses the following algorithms to encrypt data:
- RSA-None-PKCS1Padding
Uses the following algorithms to decrypt data:
- DES
Contains functionality to send SMS messages automatically.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
