Technical information
Malicious functions:
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- a####.####.cn
- gp####.####.cc
- s####.####.cn
HTTP GET requests:
- a####.####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=...
- gp####.####.cc/4651A2309E7643C071DBAED5F365C6B2A2A958E9E489AAD11A8063FEB...
HTTP POST requests:
- s####.####.cn/go.jsp
Modified file system:
Creates the following files:
- <SD-Card>/updatqc.apk
Miscellaneous:
Uses the following algorithms to encrypt data:
- DES-CBC-PKCS5Padding
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
