Technical information
Malicious functions:
Sends SMS messages:
- 10086: 103
Network activity:
Connecting to:
- r####.####.net
- s####.####.net
- a####.####.net
- t####.####.net
HTTP GET requests:
- a####.####.net/banner/v4/req?s=####
- s####.####.net/stat/aos/v3/pkc?s=####
- a####.####.net/v3/get?s=####
- r####.####.net/spot/aos/v2/reqv3?s=####
- s####.####.net/stat/aos/v3/init?s=####
- a####.####.net/app/v3/dev_update?cid=####&apn=####&chn=####&ver=####&app...
- a####.####.net/v3/zip_upd?s=####
HTTP POST requests:
- t####.####.net/v1/android/packages?rt=####&sign=####
Modified file system:
Creates the following files:
- /sdcard/icon/icon3.png
- /sdcard/icon/icon2.png
- /sdcard/icon/icon6.png
- /sdcard/icon/icon13.png
- /sdcard/icon/icon17.png
- /sdcard/icon/icon16.png
- /sdcard/icon/icon52.png
- /sdcard/icon/icon42.png
- /sdcard/icon/icon36.png
- /sdcard/Android/data/.dataycache/i42d45df023jnkdd93la483f9xGFKXI
- /sdcard/icon/icon4.png
- /data/data/####/databases/OxgHkj2lz09F-journal
- /data/data/####/databases/d589535dfc7f991ec01046fe1b12553e-journal
- /data/data/####/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
- /sdcard/icon/icon11.png
- /sdcard/icon/icon15.png
- /sdcard/icon/icon55.png
- /sdcard/icon/icon54.png
- /sdcard/icon/icon35.png
- /data/data/####/databases/d589535dfc7f991ec01046fe1b12553e
- /sdcard/icon/icon48.png
- /sdcard/icon/icon41.png
- /sdcard/icon/icon37.png
- /sdcard/icon/icon60.png
- /sdcard/icon/icon7.png
- /sdcard/icon/icon47.png
- /sdcard/icon/icon1.png
- /sdcard/icon/icon39.png
- /sdcard/icon/icon58.png
- /data/data/####/databases/P15pKIjsm64m-journal
- /sdcard/icon/icon50.png
- /sdcard/icon/icon30.png
- /sdcard/icon/icon53.png
- /data/data/####/databases/wIU6pTyUBYWX-journal
- /sdcard/icon/icon9.png
- /sdcard/icon/icon23.png
- /sdcard/icon/icon31.png
- /sdcard/icon/icon51.png
- /data/data/####/databases/jqIqJYOT3JpT
- /sdcard/icon/icon26.png
- /sdcard/icon/icon5.png
- /data/data/####/databases/OxgHkj2lz09F
- /data/data/####/databases/wsUL1uCdKvjD
- /sdcard/icon/icon24.png
- /sdcard/icon/icon10.png
- /data/data/####/databases/XKwVoK0huy3R
- /sdcard/icon/icon20.png
- /data/data/####/databases/b96260ca7775dc6cc9dbaa0eaea3b618-journal
- /data/data/####/databases/XKwVoK0huy3R-journal
- /sdcard/Android/data/.dataycache/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
- /sdcard/icon/icon0.png
- /sdcard/icon/icon27.png
- /data/data/####/databases/T1oX0rhhuXWt-journal
- /sdcard/icon/icon59.png
- /sdcard/icon/icon56.png
- /sdcard/icon/icon19.png
- /sdcard/icon/icon18.png
- /data/data/####/databases/b96260ca7775dc6cc9dbaa0eaea3b618
- /data/data/####/databases/T1oX0rhhuXWt
- /sdcard/icon/icon49.png
- /sdcard/icon/icon21.png
- /sdcard/icon/icon57.png
- /sdcard/icon/icon29.png
- /sdcard/icon/icon61.png
- /sdcard/icon/icon12.png
- /data/data/####/shared_prefs/OFFERSCONFIG1.xml
- /data/data/####/databases/6d6536dcb79a1ef0210d08244aa7e45c-journal
- /sdcard/icon/icon45.png
- /sdcard/icon/icon46.png
- /data/data/####/shared_prefs/spotData.xml
- /sdcard/icon/icon14.png
- /sdcard/icon/icon44.png
- /sdcard/icon/icon34.png
- /sdcard/icon/icon28.png
- /data/data/####/databases/wIU6pTyUBYWX
- /sdcard/icon/icon25.png
- /data/data/####/databases/wsUL1uCdKvjD-journal
- /data/data/####/databases/jqIqJYOT3JpT-journal
- /sdcard/icon/icon33.png
- /sdcard/icon/icon32.png
- /data/data/####/databases/P15pKIjsm64m
- /sdcard/icon/icon22.png
- /sdcard/icon/icon43.png
- /sdcard/icon/icon8.png
- /sdcard/icon/icon38.png
- /sdcard/icon/icon40.png
Miscellaneous:
Executes next shell scripts:
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2199 --user 0
- sh
- /system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
- su
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
