Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.543.origin
Network activity:
Connecting to:
- l####.####.com
- b####.com
- p####.####.cn
- a####.####.com
HTTP GET requests:
- b####.com/search/error.html
- a####.####.com/apistore/aqiservice/aqi?city=####
- a####.####.com/telematics/v3/weather?location=####&ak=####
HTTP POST requests:
- a####.####.com/app_logs
- l####.####.com/sdk.php
- p####.####.cn/jzbdt/bgl/hagk/ukewz
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/dsi.xml
- /data/data/####/files/umeng_it.cache
- /sdcard/baidu/tempdata/con.dat
- /data/data/####/databases/cc.db-journal
- /sdcard/baidu/tempdata/ls.db
- /data/data/####/shared_prefs/kr.xml
- /data/data/####/databases/ua.db
- /data/data/####/files/exid.dat
- /data/data/####/databases/t_u.db-journal
- /data/data/####/files/ho.jar
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/databases/cc.db
- /sdcard/baidu/tempdata/ls.db-journal
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/files/.imprint
- /data/data/####/files/ss.jar
- /data/data/####/shared_prefs/vl.xml
- /data/data/####/databases/ua.db-journal
- /data/data/####/shared_prefs/kr.xml.bak
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 43 40 207212 /data/data/####/files/ho.jar 1250326572 -2052599480 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/frame
- /system/bin/dexopt --dex 27 40 40 207212 /data/data/####/files/ss.jar 1250326572 -2052599480 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/frame
Contains functionality to send SMS messages automatically.
