Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- g####.####.net
- a####.####.com:8011
- aexcep####.####.com:8012
- and####.####.com
- r####.####.com
- aexcep####.####.com
- a####.####.com
HTTP GET requests:
- g####.####.net/prod/upload/adunion/images/9b4/170_170_ef50ea3c9473f531.png
- g####.####.net/prod/upload/adunion/images/0c4/800_400_0de13818fca5b05f.jpeg
- g####.####.net/prod/upload/adunion/images/eee/796_415_bc841045a9e1a9f3.jpeg
- g####.####.net/prod/upload/adunion/images/ac5/170_170_b752a67d821d55b6.png
- g####.####.net/prod/upload/adunion/images/ba1/170_170_c9d4041d54c3bf2c.png
- g####.####.net/prod/upload/adunion/images/9c5/170_170_50fdd48fea14f059.png
- g####.####.net/prod/upload/adunion/images/89a/170_170_a8266ae9caf83921.png
- g####.####.net/prod/upload/adunion/images/2e5/796_415_09d1a5a35ddfc915.jpeg
- g####.####.net/prod/upload/adunion/images/5e2/170_170_33110665d60fb5e3.png
- g####.####.net/prod/upload/adunion/images/ff9/170_170_a964e30d748dd608.png
- g####.####.net/prod/upload/adunion/images/1ef/796_415_666e59ad420a3988.jpeg
- g####.####.net/prod/upload/adunion/images/11d/1200_628_146423b46d279006.jpeg
- g####.####.net/prod/upload/adunion/images/788/170_170_5cc4e909d179d0a0.png
- g####.####.net/prod/upload/adunion/images/cf7/1200_628_abd70cc225239900.jpeg
- g####.####.net/prod/upload/adunion/images/477/170_170_acad295da29cc9aa.png
- g####.####.net/prod/upload/adunion/images/3c2/170_170_c7c749e29b33b017.png
- g####.####.net/prod/upload/adunion/images/2b3/170_170_69bedb71aa3f9a5f.png
- g####.####.net/prod/upload/adunion/images/959/1200_628_bfa1ad814b5e0b83.jpeg
- g####.####.net/prod/upload/adunion/images/d53/796_415_0074c7b981ccae75.jpeg
- g####.####.net/prod/upload/adunion/images/a42/170_170_df59cee0a6d80e5a.png
- g####.####.net/prod/upload/adunion/images/c62/170_170_46a8cbcc5c0cfb78.png
- g####.####.net/prod/upload/adunion/images/362/170_170_d1463272379bc47d.png
- a####.####.com/adunion/rtb/getInmobiAd?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=...
- g####.####.net/prod/upload/adunion/images/9ee/796_416_5f9fd7bfed86464f.jpeg
- g####.####.net/prod/upload/adunion/images/03b/796_415_1fff465f934721f7.jpeg
- g####.####.net/prod/upload/adunion/images/259/170_170_07234d3767835382.png
- g####.####.net/prod/upload/adunion/images/2e6/1200_628_934730c105767704.jpeg
- g####.####.net/prod/upload/adunion/images/6a5/170_170_0842969db820287b.png
- g####.####.net/prod/upload/adunion/images/257/170_170_97594d4eeb3e8f52.png
- g####.####.net/prod/upload/adunion/images/09e/170_170_c7806a66d60f9d24.png
- g####.####.net/prod/upload/adunion/images/fb5/170_170_08277f83edf9172d.png
- g####.####.net/prod/upload/adunion/images/32d/796_415_07ca0e59e98334a6.jpeg
- g####.####.net/prod/upload/adunion/images/1e2/234_417_361fe5510290d114.jpeg
- g####.####.net/prod/upload/adunion/images/2bf/170_170_d142c99773df83d6.png
- g####.####.net/prod/upload/adunion/images/3ad/170_170_ce1c97c2a6a249f5.png
- g####.####.net/prod/upload/adunion/images/9c9/170_170_60fd03aab1347b62.png
- a####.####.com/adunion/rtb/fetchAd?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=####...
- a####.####.com/adunion/slot/getDlAd?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=###...
- g####.####.net/prod/upload/adunion/images/fe2/170_170_b1468d8789f42e8c.png
- a####.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=...
- g####.####.net/prod/upload/adunion/images/e29/170_170_b2ddf65a31a9c060.png
- g####.####.net/prod/upload/adunion/images/779/170_170_8f13247f01878a16.png
- g####.####.net/prod/upload/adunion/images/5ed/170_170_61a4bfa47750eea5.png
- g####.####.net/prod/upload/adunion/images/830/1200_628_09fd61e5642480b2.jpeg
- g####.####.net/prod/upload/adunion/images/211/170_170_d150af084604cbdf.png
HTTP POST requests:
- a####.####.com/rqd/async
- and####.####.com/rqd/async
- a####.####.com/rqd/async?aid=####
- a####.####.com/app_logs
- r####.####.com/orts/rpb?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=####&ntt=####&l...
- a####.####.com:8011/rqd/async
- aexcep####.####.com/rqd/async
- and####.####.com/rqd/async?aid=####
- aexcep####.####.com:8012/rqd/async
Modified file system:
Creates the following files:
- /data/data/####/files/pl.apk
- /data/data/####/shared_prefs/data.xml.bak
- /data/data/####/files/AdjustIoPackageQueue
- /data/data/####/mix.dex
- /data/data/####/tx_shell/libshella-2.7.2.0.so
- /data/data/####/files/pl.apk.tmp.tmp
- /data/data/####/files/AdjustIoActivityState
- /data/data/####/databases/_nohttp_cookies_db.db
- /data/data/####/app_crashrecord/1004
- /data/data/####/shared_prefs/data.xml
- /data/data/####/databases/gfad.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.imprint
- /data/data/####/databases/bugly_db_-journal
- /data/data/####/Plugin/com.speed.top/dalvik-cache/base-1.dex
- /data/data/####/files/mobclick_agent_cached_####1
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/Plugin/com.speed.top/Signature/Signature_0.key
- /data/data/####/daemon
- /data/data/####/databases/_nohttp_cookies_db.db-journal
- /data/data/####/Plugin/com.speed.top/apk/base-1.apk
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/security_info
- /data/data/####/shared_prefs/wakeful.WakefulIntentService.xml
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/databases/bugly_db_legu-journal
- /data/data/####/daemon.t.tmp
- /data/data/####/files/local_crash_lock
- /data/data/####/files/native_record_lock
- /data/data/####/shared_prefs/crashrecord.xml
Sets the 'executable' attribute to the following files:
- /data/data/####/daemon
- /data/data/####/tx_shell/libshella-2.7.2.0.so
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh -c getprop ro.genymotion.version
- /system/bin/sh -c getprop ro.build.fingerprint
- /system/bin/sh -c getprop ro.build.version.opporom
- /system/bin/sh -c type su
- /system/bin/sh -c getprop ro.build.rom.id
- /system/bin/sh -c getprop ro.aa.romver
- logcat -d -v threadtime
- /system/bin/sh -c getprop ro.secure
- /system/bin/sh -c getprop ro.build.nubia.rom.name
- /system/bin/sh -c getprop ro.miui.ui.version.name
- /system/bin/sh -c getprop ro.gn.gnromvernumber
- /system/bin/sh -c getprop ro.debuggable
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.vivo.os.build.display.id
- /system/bin/sh -c getprop ro.lewa.version
- /system/bin/sh -c getprop ro.meizu.product.model
- /system/bin/sh -c getprop qemu.sf.fake_camera
- /system/bin/sh -c getprop gsm.sim.state
- chmod 700 /data/data/####/tx_shell/libshella-2.7.2.0.so
- /system/bin/sh -c getprop ro.lenovo.series
- /system/bin/sh -c getprop ro.build.tyd.kbstyle_version
- /system/bin/sh -c getprop androVM.vbox_dpi
- /system/bin/sh -c getprop gsm.sim.state2
- /system/bin/sh -c getprop ro.build.version.emui
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
