Technical information
Malicious functions:
Sends SMS messages:
- 2031: ارسال پیام رایگان اشتراک بازیک. زمان: 2017-09-10,04:21:19.192 سپاس
- 2031: ارسال پیام رایگان اشتراک بازیک. زمان: 2017-09-10,04:21:48.194 سپاس
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) cp.b####.mobi:21100
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) bazi####.wawo####.com:11101
- TCP(TLS/1.0) cp.b####.mobi:11101
- TCP(TLS/1.0) and####.cli####.go####.com:443
DNS requests:
- 2.and####.p####.####.org
- and####.cli####.go####.com
- bazi####.wawo####.com
- cp.b####.mobi
- mt####.go####.com
Modified file system:
Creates the following files:
- <Package Folder>/app_plugin/####/GameShellSDK.apk
- <Package Folder>/app_plugin/####/gameshellsdk.apk
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/index
- <Package Folder>/databases/com.doitflash.air.extension.download...ournal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/shared_prefs/session.xml
- <Package Folder>/shared_prefs/session.xml.bak
- <Package Folder>/shared_prefs/shellsession.xml
- <SD-Card>/edata/####/20170804122052.log
- <SD-Card>/edata/####/20170909235214.log
- <SD-Card>/gameshell/####/20170804122052.log
- <SD-Card>/gameshell/####/20170909235214.log
- <SD-Card>/gameshell/cache.txt
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES
Uses the following algorithms to decrypt data:
- AES
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Displays its own windows over windows of other applications.
