Technical information
Malicious functions:
Removes app icon from the screen.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) 1####.217.20.78:443
DNS requests:
- cuq####.com
- www.u####.com
File system changes:
Creates the following files:
- /data/data/####/bluesky_db
- /data/data/####/bluesky_db-journal
- /data/data/####/pref_key.xml
- /data/data/####/webview.db-journal
Miscellaneous:
Makes phone calls to the following numbers:
- //6056881556
Uses the following algorithms to decrypt data:
- AES
Contains functionality for automatic SMS sending.
Gets information about phone status (number, IMEI, etc.).
Gets information about APN settings.
Displays its own windows over windows of other apps.
Parses information from SMS.
Gets information about incoming/outgoing calls.
Gets information about sent/received SMS.
