Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- g####.####.net
- a####.####.com:8011
- aexcep####.####.com:8012
- b####.com
- and####.####.com
- r####.####.com
- aexcep####.####.com
- gl####.####.com
- a####.####.com
HTTP GET requests:
- g####.####.net/prod/upload/adunion/images/c9f/170_170_9af61a23e531aaef.png
- a####.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=...
- g####.####.net/prod/upload/adunion/images/1d8/796_415_bf390bfbeec3631d.jpeg
- g####.####.net/prod/upload/adunion/images/ac5/170_170_b752a67d821d55b6.png
- g####.####.net/prod/upload/adunion/images/ce3/796_415_7a8a3629d19df91a.jpeg
- g####.####.net/prod/upload/adunion/images/3c6/796_415_1022c28fb931c536.jpeg
- b####.com/
- g####.####.net/prod/upload/adunion/images/318/170_170_8ed7b09c44d58b50.png
- g####.####.net/prod/upload/adunion/images/0e9/170_170_fa36088b36655990.png
- g####.####.net/prod/upload/adunion/images/c28/1200_628_331eae46bcf6c847.jpeg
- g####.####.net/prod/upload/adunion/images/788/170_170_5cc4e909d179d0a0.png
- g####.####.net/prod/upload/adunion/images/ba1/170_170_c9d4041d54c3bf2c.png
- g####.####.net/prod/upload/adunion/images/3c2/170_170_c7c749e29b33b017.png
- g####.####.net/prod/upload/adunion/images/2b3/170_170_69bedb71aa3f9a5f.png
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub####&aff_sub2=####&aff_sub7=####&google_adv_id=####&aff_sub6=####&aff_sub8=####&sub_a...
- g####.####.net/prod/upload/adunion/images/182/170_170_076af440241b957c.png
- a####.####.com/adunion/rtb/fetchAd?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=####...
- g####.####.net/prod/upload/adunion/images/6f2/1200_628_261cc92a34b7ee25.jpeg
- g####.####.net/prod/upload/adunion/images/c62/170_170_46a8cbcc5c0cfb78.png
- a####.####.com/adunion/rtb/getInmobiAd?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=...
- g####.####.net/prod/upload/adunion/images/2c9/170_170_c811572aa933efcc.png
- g####.####.net/prod/upload/adunion/images/ad5/170_170_824ca4cf30e56ad9.png
- g####.####.net/prod/upload/adunion/images/77f/170_170_c9089a122720013f.png
- g####.####.net/prod/upload/adunion/images/831/170_170_3a3d0e4a05b5d45d.png
- g####.####.net/prod/upload/adunion/images/818/170_170_aebbdd8a3fd6dcef.png
- g####.####.net/prod/upload/adunion/images/860/170_170_f135d3f7f2ce0151.png
- g####.####.net/prod/upload/adunion/images/2e6/1200_628_934730c105767704.jpeg
- g####.####.net/prod/upload/adunion/images/89a/170_170_a8266ae9caf83921.png
- g####.####.net/prod/upload/adunion/images/0e4/170_170_e41753824538491a.png
- g####.####.net/prod/upload/adunion/images/ce6/170_170_ca23242ecc8fa47a.png
- g####.####.net/prod/upload/adunion/images/09a/170_170_769080f7763e1d6e.png
- g####.####.net/prod/upload/adunion/images/b4c/796_416_ee6dc30f7648c1ca.jpeg
- g####.####.net/prod/upload/adunion/images/ad7/474_248_eba8791235683cd3.jpeg
- g####.####.net/prod/upload/adunion/images/f18/170_170_25d98d687dc58ddb.png
- g####.####.net/prod/upload/adunion/images/74e/170_170_13d621603fca6863.png
- g####.####.net/prod/upload/adunion/images/265/170_170_152454708b93d029.png
- g####.####.net/prod/upload/adunion/images/b00/796_415_5f53e7671969e311.jpeg
- a####.####.com/adunion/slot/getDlAd?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=###...
- g####.####.net/prod/upload/adunion/images/0b0/1200_628_0a2f6d76d6af5ae4.jpeg
- g####.####.net/prod/upload/adunion/images/5c4/170_170_5064ecffe1743318.png
- g####.####.net/prod/upload/adunion/images/211/170_170_d150af084604cbdf.png
- g####.####.net/prod/upload/adunion/images/336/170_170_71d3fe82eecf8fee.png
- g####.####.net/prod/upload/adunion/images/ee6/1200_628_5c54d3516b0ec778.jpeg
- g####.####.net/prod/upload/adunion/images/b0f/170_170_de071cfb1816fec5.png
- g####.####.net/prod/upload/adunion/images/d80/170_170_d3fcaee03d3e14cf.png
- g####.####.net/prod/upload/adunion/images/5ed/170_170_61a4bfa47750eea5.png
- g####.####.net/prod/upload/adunion/images/87b/1200_628_f40fec8dea378fa8.jpeg
- g####.####.net/prod/upload/adunion/images/269/170_170_ac3b79c3e714545c.png
- g####.####.net/prod/upload/adunion/images/127/796_416_f73448ea86c75a8d.jpeg
HTTP POST requests:
- a####.####.com/rqd/async
- and####.####.com/rqd/async
- r####.####.com/orts/rp?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=####&ntt=####&ls...
- a####.####.com/app_logs
- r####.####.com/orts/rpb?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=####&ntt=####&l...
- a####.####.com:8011/rqd/async
- aexcep####.####.com/rqd/async
- aexcep####.####.com:8012/rqd/async
Modified file system:
Creates the following files:
- /data/data/####/files/pl.apk
- /data/data/####/files/AdjustIoPackageQueue
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/tx_shell/libshella-2.7.2.0.so
- /data/data/####/files/mobclick_agent_cached_####2806
- /data/data/####/databases/file_explorer-journal
- /data/data/####/files/pl.apk.tmp.tmp
- /data/data/####/files/AdjustIoActivityState
- /data/data/####/databases/_nohttp_cookies_db.db
- /data/data/####/databases/google_analytics_v4.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- /data/data/####/files/.imprint
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml
- /data/data/####/Plugin/com.speed.top/dalvik-cache/base-1.dex
- /data/data/####/Plugin/com.speed.top/apk/base-1.apk
- /data/data/####/mix.dex
- /data/data/####/Plugin/com.speed.top/Signature/Signature_0.key
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/databases/_nohttp_cookies_db.db-journal
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml
- /data/data/####/files/gaClientId
- /data/data/####/shared_prefs/wakeful.WakefulIntentService.xml
- /data/data/####/files/security_info
- /data/data/####/daemon.t.tmp
- /data/data/####/databases/bugly_db_legu-journal
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/files/local_crash_lock
- /data/data/####/databases/google_app_measurement.db-journal
- /data/data/####/files/native_record_lock
Sets the 'executable' attribute to the following files:
- /data/data/####/tx_shell/libshella-2.7.2.0.so
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh -c getprop ro.aa.romver
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop ro.build.version.emui
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.build.rom.id
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
