Technical information
Malicious functions:
Sends SMS messages:
- <Phone Number>: Thank you for installing SMSReplier Lite - - powered by smsreplier.com
- <Phone Number>: You have ENABLED DriveReply, please verify GPS is enabled on phone, enjoy your drive! - null
- <Phone Number>: You have disabled DriveReply, will be automatically turned back on in 150 minutes - null
- <SMS Address>: I'm currently operating a vehicle. Is it ok if I text you when get off the road?- powered by smsreplier.com
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) smsrep####.net:80
DNS requests:
- smsrep####.net
HTTP GET requests:
- smsrep####.net/smsreply/verifyphone.php?imei=####&phoneno=####
- smsrep####.net/smsreply/xml.php
- smsrep####.net/smsreply/xmlspam.php
- smsrep####.net/smsreply/xmlspamnumbers.php
HTTP POST requests:
- smsrep####.net/smsreply/phonedatanew.php
- smsrep####.net/smsreply/test.php
Modified file system:
Creates the following files:
- <Package Folder>/databases/arebangalacoms6
- <Package Folder>/databases/arebangalacoms6-journal
- <Package Folder>/databases/argoyyalacoms5
- <Package Folder>/databases/argoyyalacoms5-journal
Miscellaneous:
Changes volume and vibration settings.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
Gains access to information about incoming/outgoing calls.
Gains access to information about sent/received SMS messages.
Gains access to information about contacts from the Contact list.
