Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- i####.####.com
- and####.####.com
HTTP GET requests:
- i####.####.com/service/getIpInfo.php?ip=####
HTTP POST requests:
- and####.####.com/rqd/async?aid=####
Modified file system:
Creates the following files:
- /data/data/####/databases/cc/cc.db
- /data/data/####/databases/bugly_db_-journal
- /data/data/####/shared_prefs/sdk_config.xml
- /data/data/####/app_crashrecord/1004
- /data/data/####/files/security_info
- /data/data/####/databases/bugly_db_
- /data/data/####/files/INSTALLATION
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/local_crash_lock
- /data/data/####/files/pid
- /data/data/####/agencyss
- /data/data/####/shared_prefs/sdk_config.xml.bak
- /data/data/####/shared_prefs/crashrecord.xml
Sets the 'executable' attribute to the following files:
- /data/data/####/agencyss
Miscellaneous:
Executes next shell scripts:
- getprop
- /data/data/####/agencyss ####/com.google.android.advlib.service.AdvService
- dd if=/data/data/####/lib/libnativeservices.so of=/data/data/####/agencyss
- <error:2>
- /system/bin/sh -c getprop
- sh
- chmod 777 /data/data/####/agencyss
- /system/bin/sh -c type su
Contains functionality to send SMS messages automatically.
