Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- tr####.####.com
HTTP POST requests:
- tr####.####.com/update.xxdd
Modified file system:
Creates the following files:
- <Package Folder>/app_baidu/xpodg
- <Package Folder>/files/kgibt
- <SD-Card>/.mkcong
- <SD-Card>/6ce1453df5ccbb63afa2692291934e06.jar
Miscellaneous:
Executes next shell scripts:
- /data/data/com.jircb.arrq/app_baidu/xpodg -p com.jircb.arrq -r am start --user 0 -n com.jircb.arrq/ktod.mbwx.jesd -a ktod.mbwx.jesd -i 2059
- /data/data/com.jircb.arrq/app_baidu/xpodg -p com.jircb.arrq -r am start --user 0 -n com.jircb.arrq/ktod.mbwx.jesd -a ktod.mbwx.jesd -i 2218
- /data/data/com.jircb.arrq/app_baidu/xpodg -p com.jircb.arrq -r am start --user 0 -n com.jircb.arrq/ktod.mbwx.jesd -a ktod.mbwx.jesd -i 2239
- <dexopt>
- chmod 777 /data/data/com.jircb.arrq/app_baidu/xpodg
- chmod 777 <Package Folder>/app_baidu/xpodg
- sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/ktod.mbwx.jesd -a ktod.mbwx.jesd -i 2059
- sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/ktod.mbwx.jesd -a ktod.mbwx.jesd -i 2218
- sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/ktod.mbwx.jesd -a ktod.mbwx.jesd -i 2239
