Technical information
Malicious functions:
Sends SMS messages:
- +439269880246: [Olala] ({793881}) is the code for you to login in 30 minutes.
Network activity:
Connecting to:
- l####.####.com
- a####.####.com
HTTP GET requests:
- l####.####.com/i?app_key=####×tamp=####&events=####&device_id=####
HTTP POST requests:
- a####.####.com/imsilogin
- a####.####.com/code
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/COUNTLY_STORE.xml.bak
- /data/data/####/shared_prefs/COUNTLY_STORE.xml
- /sdcard/TimoDL/mobi.gossiping.gspplugin.apk
- /data/data/####/databases/gossip.db-journal
- /data/data/####/shared_prefs/openudid_prefs.xml
- /sdcard/Gossip/Playmeid.cfg
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- chmod 777 /storage/emulated/0/Gossip/image/
- chmod 777 /storage/emulated/0/Gossip/chat/
- chmod 777 /storage/emulated/0/Gossip/video/
- chmod 777 /storage/emulated/0/Gossip/image/camera/
- chmod 777 /storage/emulated/0/Gossip/file/
- chmod 777 /storage/emulated/0/Gossip/image/thumb/
- chmod 777 /storage/emulated/0/Gossip/voice/
Contains functionality to send SMS messages automatically.
