Technical information
Malicious functions:
Sends SMS messages:
- 1065-71090-88877: 99#<IMSI>#android#Nduo_2
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- h####.####.com
- i####.####.cn
- t####.####.cn
HTTP GET requests:
- h####.####.com/h.js?0807807####
- i####.####.cn/img/login/QQ.png
- t####.####.cn/in/guest.do?returl=####
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
Miscellaneous:
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
