Android.Locker.3697

Technical information

Malicious functions:

Sets passwords on the lock screen

Network activity:

Connecting to:

a####.####.com:17209
zui####.com
a####.####.com

HTTP GET requests:

zui####.com/api/v2/kvservice/globalconfig/?openUDID=####&appVersion=####&appVersionCode=####&systemVersion=####&platform=####&packageName=####&timesta...
a####.####.com/search.php?sid=####&aid=####&udid=####&os=####&osv=####&dt=####&dml=####&dpd=####&so=####&mcc=####&mnc=####&icc=####&adnum=####&ngp=###...
a####.####.com:17209/v1/apps?page=####&size=####&sid=####&aid=####&campaign=####&version_code=####&api_level=####&os=####&osv=####&dmf=####&dml=####&d...

HTTP POST requests:

a####.####.com/app_logs

Modified file system:

Creates the following files:

/data/data/####/shared_prefs/com.pingstart.adsdk.preference.xml
/data/data/####/files/.YFlurrySenderIndex.info.AnalyticsData_4XYQWGRCQ5DQF9B2DRST_202
/data/data/####/shared_prefs/brixd.prefs.xml
/data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
/data/data/####/databases/adym_db
/data/data/####/shared_prefs/mobnativeads_preferences.xml.bak
/data/data/####/shared_prefs/com.pingstart.adsdk.preference.xml.bak
/data/data/####/databases/google_analytics_v4.db-journal
/data/data/####/databases/zuimei.lockscreen.sqlite-journal
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
/data/data/####/files/.imprint
/data/data/####/files/.yflurrydatasenderblock.fa9c134f-c415-4439-a72b-de5c9b9ddf46
/data/data/####/files/AF_INSTALLATION
/data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml
/data/data/####/databases/zuiads.db-journal
/data/data/####/files/umeng_it.cache
/data/data/####/databases/webview.db-journal
/data/data/####/shared_prefs/brixd.prefs.xml.bak
/sdcard/zuimei/lock_screen/images/journal.tmp
/data/data/####/shared_prefs/settings.pref.xml
/data/data/####/files/gaClientId
/data/data/####/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
/data/data/####/files/.YFlurrySenderIndex.info.AnalyticsMain
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/data/data/####/shared_prefs/appsflyer-data.xml.bak
/data/data/####/databases/adym_db-journal
/data/data/####/shared_prefs/mobnativeads_preferences.xml
/data/data/####/cache/volley/6578111332095007071
/data/data/####/shared_prefs/appsflyer-data.xml
/data/data/####/shared_prefs/multidex.version.xml
/data/data/####/files/.yflurryreport.42439eb95395d245