Technical information
Malicious functions:
Sends SMS messages:
- 000100:
- 900: баланс
- 9832974827: your_id:9783
Executes code of the following detected threats:
- Android.BankBot.144.origin
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- 1####.####.234
HTTP GET requests:
- 1####.####.234/download/database.db
- 1####.####.234/download/icons/mdpi.zip
HTTP POST requests:
- 1####.####.234/
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/V3a3i1iqN.xml.bak
- /data/data/####/files/icons/uc_browser.png
- /data/data/####/files/icons/ic_notification_failed.png
- /data/data/####/files/icons/viber.png
- /data/data/####/files/icons/messenger.png
- /data/data/####/files/icons/google_play.png
- /data/data/####/files/icons/gmail.png
- /data/data/####/files/icons/ic_notification.png
- /data/data/####/shared_prefs/V3a3i1iqN.xml
- /data/data/####/files/icons/whatsapp.png
- /data/data/####/files/databases/database.db
- /data/data/####/files/icons/facebook.png
- /data/data/####/files/icons/chrome.png
- /data/data/####/files/icons/mdpi
- /data/data/####/app_pvajnrv/dijcqtfdgc.jar
Miscellaneous:
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.