Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- 5####.####.188
- 5####.####.188:5353
HTTP GET requests:
- 5####.####.188:5353/download?n=####&i=####&r=####
- 5####.####.188/command?n=####&i=####&r=####
Modified file system:
Creates the following files:
- /data/data/####/files/cheat-journal
- /data/data/####/files/audio-journal
- /data/data/####/files/imei.dat
- /data/data/####/files/v.dat
- /data/data/####/files/tencent
- /data/data/####/files/uploadfiles-journal
- /data/data/####/files/gpsinfo
- /data/data/####/files/cheat
- /data/data/####/files/gpsinfo-journal
- /data/data/####/files/func_set
- /data/data/####/files/camera
- /data/data/####/files/dirinfo-journal
- /data/data/####/files/ad_vdinfo
- /data/data/####/files/ad_vdinfo-journal
- /sdcard/i.dat
- /data/data/####/app_bin/daemon
- /data/data/####/files/smsinfo
- /data/data/####/files/dirset
- /data/data/####/files/appinfo-journal
- /data/data/####/files/update
- /data/data/####/files/appinfo
- /data/data/####/files/calllog-journal
- /sdcard/baidu/.cuid
- /data/data/####/files/dirinfo
- /data/data/####/files/contact-journal
- /data/data/####/files/audio
- /data/data/####/files/smsinfo-journal
- /data/data/####/files/contact
- /data/data/####/files/calllog
- /data/data/####/files/func_set-journal
- /data/data/####/files/uploadfiles
- /data/data/####/files/dirset-journal
- /data/data/####/files/i.dat
- /data/data/####/files/tencent-journal
- /data/data/####/files/camera-journal
Sets the 'executable' attribute to the following files:
- /data/data/####/app_bin/daemon
Miscellaneous:
Executes next shell scripts:
- su4200 -c mount -o remount system /system
- su4200 -c mv /system/app/#### /system/app/####.apk
- su -c chmod 6777 /system/bin/update
- /data/data/####/app_bin/daemon -p #### -s ####.GoogleServer -t 120
- mount -o remount system /system;dd if=/data/data/####/files/update of=/system/bin/update;chmod 6777 /system/bin/update;
- su -c mount -o remount system /system
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2426 --user 0
- su4200 -c chmod 6777 /system/app/####
- su4200 -c dd if=/data/app/####-1.apk of=/system/app/####
- su -c dd if=/data/data/####/files/update of=/system/bin/update
- su4200 -c dd if=/data/data/####/lib/liblocSDK6a.so of=/system/lib/liblocSDK6a.so
- /system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 6777 --e
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2232 --user 0
- sh /system/bin/am startservice --user 0 -n ####/####.GoogleServer
- chmod 0755 /data/data/####/app_bin/daemon
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.