Technical information
Malicious functions:
Removes its shortcut from the home screen.
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- l####.####.com
HTTP POST requests:
- l####.####.com/sdk.php
Modified file system:
Creates the following files:
- <Package Folder>/files/####/firll.dat
- <SD-Card>/baidu/####/conlts.dat
- <SD-Card>/baidu/####/ls.db
- <SD-Card>/baidu/####/ls.db-journal
- <SD-Card>/baidu/.cuid
Miscellaneous:
Executes next shell scripts:
- chmod 777 /data/app/<Package>-1.apk
- sh
- su
Loads the following dynamic libraries:
- locSDK5
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses elevated priveleges.
Gains access to geolocation.
Gains access to telephone information (number, imei, etc.).
Parses information from SMS messages.
Gains access to information about sent/received SMS messages.
