Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- s####.####.com
- t####.####.com
- reso####.####.net
- a####.####.net
- 7j####.####.com
- c-h####.####.com
- l####.####.com
- m####.####.com
- a####.####.com
HTTP GET requests:
- s####.####.com/config/hz-hzv3.conf
- a####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=####&app_version_code=####&apn=####&agoo_version_code=####&imsi=####
- 7j####.####.com/tdata_jvh958
- t####.####.com/user/updateToken.do?name=####&xiaomi=####&uid=####&chid=####&pkgname=####&ver=####&andver=####
- t####.####.com/data/stat.do?channel=####&stype=####&uid=####&chid=####&pkgname=####&ver=####&andver=####
- t####.####.com/user/updateToken.do?name=####&jpush=####&uid=####&chid=####&pkgname=####&ver=####&andver=####
- t####.####.com/user/updateToken.do?name=####&umeng=####&uid=####&chid=####&pkgname=####&ver=####&andver=####
- 7j####.####.com/tdata_ZBT682
- t####.####.com/user/reg.do?imei=####&imsi=####&uid=####&chid=####&pkgname=####&ver=####&andver=####
- a####.####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####&v=####&sign=####&data=####&api=####&imsi=####
- t####.####.com/data/running.do?time=####&mid=####&appname=####&runapp=####&uid=####&chid=####&pkgname=####&ver=####&andver=####
- t####.####.com/data/stat.do?appbindid=####&stype=####&uid=####&chid=####&pkgname=####&ver=####&andver=####
- t####.####.com/user/updateToken.do?name=####&requestId=####&channelId=####&userId=####&appId=####&uid=####&chid=####&pkgname=####&ver=####&andver=####...
- a####.####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=####&v=####&sign=####&data=####&api=####&imsi=####
- t####.####.com/task/taskRequest.do?uid=####&chid=####&pkgname=####&ver=####&andver=####
- s####.####.com/wifi/getWifiInfomation.do?latitude=####&longitude=####&lastTime=####&imei=####&chid=####&version=####&pkg=####
- reso####.####.net/gslb/?ver=####&type=####&conpt=####&uuid=####&list=####&key=####
- t####.####.com/user/updateToken.do?name=####&getui=####&uid=####&chid=####&pkgname=####&ver=####&andver=####
- a####.####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=####&appKey=####&v=####&sign=####&data=####&api=####&imsi=####
HTTP POST requests:
- t####.####.com/data/allapp.do?uid=####&chid=####&pkgname=####&ver=####&andver=####
- m####.####.com/v2/register
- s####.####.com/api.php?format=####&t=####
- s####.####.com/wifi/updPasswd.do?imei=####&chid=####&version=####&pkg=####
- l####.####.com/sdk.php
- c-h####.####.com/api.php?format=####&t=####
- l####.####.com/offline_loc
- a####.####.net/ap/fa.sec
Modified file system:
Creates the following files:
- /data/data/####/files/init.pid
- /data/data/####/shared_prefs/AGOO_HOST.xml
- /data/data/####/shared_prefs/mipush_extra.xml
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/databases/MsgLogStore.db-journal
- /sdcard/data/.push_deviceid
- /data/data/####/files/ofld/ofl_location.db-journal
- /data/data/####/database/pushinfo.db
- /data/data/####/files/tdata_jvh958
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/com.baidu.pushservice.BIND_CACHE.xml
- /data/data/####/shared_prefs/####.self_push_sync.xml
- /data/data/####/shared_prefs/jpush_device_info.xml
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/shared_prefs/cn.jpush.android.user.profile.xml.bak
- /data/data/####/shared_prefs/pst.xml.bak
- /sdcard/libs/####.db
- /sdcard/system/tmp/local/tdata_ZBT682
- /data/data/####/shared_prefs/PhoneUtil.xml
- /data/data/####/files/tdata_ZBT682
- /data/data/####/shared_prefs/mipush.xml.bak
- /data/data/####/database/pushinfo.db-journal
- /data/data/####/databases/UmengLocalNotificationStore.db-journal
- /sdcard/baidu/tempdata/conlts.dat
- /data/data/####/files/appPackageNames
- /sdcard/baidu/tempdata/ls.db
- /data/data/####/files/libcuid.so
- /data/data/####/files/run.pid
- /data/data/####/databases/jpush_local_notification.db-journal
- /data/data/####/files/bdpush_modeconfig.json
- /data/data/####/files/ofld/ofl_statistics.db-journal
- /data/data/####/databases/tmpd8.db-journal
- /data/data/####/shared_prefs/Setting.xml
- /data/data/####/shared_prefs/cn.jpush.preferences.v2.xml.bak
- /data/data/####/databases/plugin-journal
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/files/init_c1.pid
- /data/data/####/databases/jpush_statistics.db-journal
- /data/data/####/files/####:pushservice
- /data/data/####/files/jpush_stat_cache_history.json
- /data/data/####/shared_prefs/####.push_sync.xml
- /data/data/####/databases/pushstat_5.2.0.db-journal
- /data/data/####/files/lldt/firll.dat
- /data/data/####/shared_prefs/wifi_request.xml
- /data/data/####/files/ofld/ofl.config
- /data/data/####/files/ofld/ofl_location.db
- /data/data/####/shared_prefs/mipush_account.xml
- /data/data/####/shared_prefs/XMPushServiceConfig.xml
- /data/data/####/shared_prefs/getui_sp.xml
- /data/data/####/files/push.pid
- /data/data/####/files/mobclick_agent_cached_####419
- /data/data/####/databases/pushsdk.db-journal
- /sdcard/baidu/tempdata/ls.db-journal
- /sdcard/backups/.SystemConfig/.cuid2
- /data/data/####/shared_prefs/AGOO_CONNECT.xml
- /data/data/####/files/gdaemon_20161017
- /data/data/####/databases/jpush_local_notification.db
- /data/data/####/shared_prefs/AppStore.xml.bak
- /data/data/####/files/tdata_jvh958.jar
- /data/data/####/files/mutex
- /data/data/####/shared_prefs/mipush.xml
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/AppStore.xml
- /data/data/####/files/agoo.pid
- /data/data/####/databases/pushg.db-journal
- /data/data/####/shared_prefs/clear_db.xml
- /data/data/####/shared_prefs/46bb8d6cd7382d82ed4f967a67af3bd9.xml
- /sdcard/system/tmp/local/tdata_jvh958
- /data/data/####/shared_prefs/bindSoftId.xml
- /data/data/####/shared_prefs/pushclient.xml
- /sdcard/test.0
- /sdcard/baidu/tempdata/ller.dat
- /data/data/####/files/DaemonServer
- /data/data/####/shared_prefs/pref_registered_pkg_names.xml
- /data/data/####/shared_prefs/commonSetting.xml
- /sdcard/libs/com.getui.sdk.deviceId.db
- /data/data/####/databases/jpush_statistics.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/databases/cc/cc.db
- /data/data/####/shared_prefs/pst.xml
- /data/data/####/databases/pushext.db-journal
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /data/data/####/shared_prefs/cn.jpush.android.user.profile.xml
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/shared_prefs/46bb8d6cd7382d82ed4f967a67af3bd9.xml.bak
- /sdcard/libs/app.db
- /data/data/####/shared_prefs/cn.jpush.preferences.v2.xml
- /sdcard/libs/####.bin
- /data/data/####/databases/pushstat_5.2.0.db
- /data/data/####/files/ofld/ofl_statistics.db
- /data/data/####/files/tdata_ZBT682.jar
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/umeng_message_state.xml
- /sdcard/backups/.SystemConfig/.cuid
Sets the 'executable' attribute to the following files:
- /data/data/####/files/gdaemon_20161017
- /data/data/####/files/DaemonServer
Miscellaneous:
Executes next shell scripts:
- chmod 700 /data/data/####/files/gdaemon_20161017
- sh
- /data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 25601 300 0
- netstat -ant
Contains functionality to send SMS messages automatically.
