Technical information
Malicious functions:
Sends SMS messages:
- 1065-71090-88877: 99#<IMSI>#android#Nduo_2
Network activity:
Connecting to:
- i####.####.cn
- t####.####.cn
HTTP GET requests:
- i####.####.cn/img/tx/icon/daohang/life.gif
- t####.####.cn/in/fltin_t.jsp?type=####
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
Miscellaneous:
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
