Technical information
Malicious functions:
Prompts to install third-party applications.
Network activity:
Connecting to:
- ma####.####.com
- f####.####.com
- a####.####.net
- a####.####.com
HTTP GET requests:
- f####.####.com/mfc/thumbnail/jpeg/l260q80/["3b2/0fe2c8b8420cda6f39b56a91...
- a####.####.net/v2/user/0/network/bucket?clientId=####&imei=####&type=###...
- f####.####.com/mfc/thumbnail/png/w44q80/100/0b54810080089005a0ffaa6f1a33...
- f####.####.com/mfc/thumbnail/png/w44q80/cb6/0df18ebad6f7225f8da2d621cac7...
- f####.####.com/mfc/thumbnail/png/w44q80/b96/47fef799b61e38197bd9d08bb916...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/"dcb/647f5dcf1b8bc9c9ed7ef081d...
- a####.####.com/gapp?channel=####&clientId=####&co=####&imei=####&la=####...
- f####.####.com/mfc/thumbnail/png/w44q80/a1c/b7cfbd1fecee789977b99992af01...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/"239/a4eb7d38598f7ffba912cf0e2...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/"e13/a387931f4316a2c4a617a874e...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/"4a7/247bbda027a27e3e672825184...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/"4d2/ce59f9d9722b583987cff9484...
- f####.####.com/mfc/thumbnail/png/w44q80/758/aa72df51c8ccfbc09c40c821782f...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/"f69/6c71fb6089f1dfd7ae23d767f...
- f####.####.com/download/AppStore/07439010-455b-4053-8668-9aae6e1554ce
- f####.####.com/mfc/thumbnail/jpeg/l260q80/["9eb/15b9fce5dbb88e9d976e53cf...
- f####.####.com/mfc/thumbnail/png/w44q80/f78/15b7c17fd8e2f3be32ca088af3a1...
- f####.####.com/mfc/thumbnail/png/w44q80/244/1764f946e4d0992098af31662a80...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/"7de/cf4190d4de05c72530c6230f7...
- f####.####.com/mfc/thumbnail/png/w44q80/cf4/8630d3fc84cc3274cfceb937c42f...
- f####.####.com/mfc/thumbnail/png/w44q80/AppStore/0a956948-9c95-4801-b459...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/"4b1/39cf4db5f190f6e61f12687d4...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/["b51/1395b455817ff8d12c1b5fc6...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/"cbc/297371ba9cbbc603ea1a4c42c...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/"15a/58c4d251bab6d21cc95651581...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/"32d/ae4afd2c1dd4ffd12c1d697c3...
- f####.####.com/mfc/thumbnail/jpeg/l260q80/"2a3/364facab43659ac139c427b12...
- f####.####.com/download/AppStore/3803a956-45f0-4e34-a7fd-2054f1a07fbb
- f####.####.com/mfc/thumbnail/png/w44q80/265/8f301c631513a6e493dd6b512d2c...
- f####.####.com/mfc/thumbnail/png/w44q80/049/4364b74859d2c18a6c326e350e57...
HTTP POST requests:
- ma####.####.com/apm/updateinfo
- ma####.####.com/apm/user/device
- ma####.####.com/apm/updateinfo/v2
Modified file system:
Creates the following files:
- <Package Folder>/cache/8eb420d46abc0a0a6ca65e57a3740722
- <Package Folder>/cache/Reservoir/c5581fa73faeded13017b8635591df94.1.tmp
- <Package Folder>/cache/2d5f418b9376e0b3255493ba8c9e7b63
- <Package Folder>/cache/8d30cef1106285baa4c7e1b5e7950773
- <Package Folder>/cache/c54dc1b5d0710dd32d64b8e557144697
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/0a57098a7aa5fb934e06b65e37561704
- <Package Folder>/shared_prefs/HOST_FILE_DATA.xml
- <Package Folder>/cache/30f4add6fa0320a87c1ac0b5938e8e1a
- <Package Folder>/cache/4d864d099b875d8fbf2c525a4b913cc0
- <Package Folder>/cache/556b72ac0f0d6c855e78f50c000aedd1
- <Package Folder>/cache/875f7cfd888dc2fb9a519f654f10ffc9
- <Package Folder>/cache/fa5eaf98399977d82dfd19d22e5457ed
- <Package Folder>/cache/9a789cc9e5ed4a26c6c1e0e14d30a324
- <Package Folder>/cache/2f6b13a6054ed1a02049a9d1b1694e10
- <Package Folder>/cache/e08d61be087853df0e415e2210b41abd
- <Package Folder>/cache/a95c5300557054b51a704dcc4f6af140
- <Package Folder>/cache/a003818def488af36fd4d90d0ccd32ab
- <Package Folder>/cache/Reservoir/b4a619251c5c397f26d05c9b0e7bf97a.0.tmp
- <Package Folder>/cache/e3df4d37e55a904c66546baec43b3fb0
- <Package Folder>/cache/Reservoir/ea8f538c94b6e352418254ed6474a81f.1.tmp
- <Package Folder>/shared_prefs/HOST_API_WIFI.xml
- <Package Folder>/databases/market.db-journal
- <Package Folder>/shared_prefs/_has_set_default_values.xml
- <Package Folder>/files/timesync.apk
- <Package Folder>/cache/4f32337475d871971aabdfe96be2d0f4
- <Package Folder>/cache/5f2da2706bf74e541daf2f7edd4143ef
- <Package Folder>/cache/e78a20ff4f74c737cfa5d21c7f879d20
- <Package Folder>/cache/Reservoir/c5581fa73faeded13017b8635591df94.0.tmp
- <Package Folder>/cache/Reservoir/ea8f538c94b6e352418254ed6474a81f.0.tmp
- <Package Folder>/cache/0ef0146d673fe585791232812bce03ea
- <Package Folder>/cache/57237f7a7fcacd43bf35c4dd10d767df
- <Package Folder>/cache/Reservoir/journal.tmp
- <Package Folder>/shared_prefs/data.xml
- <Package Folder>/cache/d158b3fa4b62bb09a6ba37d357e41eb8
- <Package Folder>/files/launcher.db
- <Package Folder>/cache/Reservoir/3efe17b69670e6663f26c37cf8261a56.1
- <Package Folder>/cache/Reservoir/3efe17b69670e6663f26c37cf8261a56.0
- <Package Folder>/cache/52c1596e04becef83154583a915674bc
- <Package Folder>/cache/Reservoir/b4a619251c5c397f26d05c9b0e7bf97a.1.tmp
- <Package Folder>/shared_prefs/HOST_API_DATA.xml
- <Package Folder>/cache/fbab0b5fd36c3182078ebe210305202c
- <Package Folder>/cache/8748487f5f12375e6d091bf072235527
- <Package Folder>/cache/2f69b30bec8cd1bcfa78a7039cd17824
Miscellaneous:
Executes next shell scripts:
- ps
- cat /proc/mounts
- <su-internal:request>
- <su-internal:result>
- ls -l /data/data
- sh
- su
- adb shell
- ls /data/data/com.android.launcher/databases/launcher.db
- chmod -R 777 <Package Folder>/files/launcher.db
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
