Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.1768.origin
Network activity:
Connecting to:
- b####.com
- iphoe####.com
- a####.####.com
HTTP GET requests:
- b####.com/
HTTP POST requests:
- a####.####.com/app_logs
- iphoe####.com/checkGamePermission.php
- iphoe####.com/askActivityInfo.php
- iphoe####.com/registered.php
Modified file system:
Creates the following files:
- /data/data/####/files/uu_data/o_S6HoFxxEqDcmoce0N1vQ==/proxy.apk
- /data/data/####/files/uu_data/IUzhXZvxBeEWBpe7_sDyGw==
- /data/data/####/files/uu_data/TfwdHX6qHv0AkshSW_kmmg==/app_code/lib/libuu_xx.so
- /data/data/####/.cache/libnqshieldx86.so
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/.cache/DexToLoad.apk
- /data/data/####/databases/qy_db_pay-journal
- /data/data/####/files/uu_data/o_S6HoFxxEqDcmoce0N1vQ==/fMwBszcpKUCQ_gjZ
- /data/data/####/files/mobclick_agent_cached_####4
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/nqshield_pref_file.xml.bak
- /data/data/####/files/uu_data/o_S6HoFxxEqDcmoce0N1vQ==/IvGAmCpxv64bLBwKxzNOZg==
- /data/data/####/.cache/nqdata
- /data/data/####/files/uu_data/8SGi2j11Xi44bWqDzCUmxw==
- /data/data/####/files/.imprint
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/nqshield_pref_file.xml
- /data/data/####/files/uu_data/V3Ro3erFjOIwZKru947bPA==/data.dat.tmp
- /data/data/####/files/uu_data/TfwdHX6qHv0AkshSW_kmmg==/app_code/com.yt.uu.apk
- /data/data/####/files/uu_data/TfwdHX6qHv0AkshSW_kmmg==/app_code/app_info.txt
Sets the 'executable' attribute to the following files:
- /data/data/####/.cache/libnqshieldx86.so
Miscellaneous:
Executes next shell scripts:
- chmod 755 /data/data/####/.cache/nqshell
- /system/bin/sh
- chmod 755 /data/data/####/.cache/libnqshieldx86.so
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
