Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- l####.####.com
HTTP POST requests:
- l####.####.com/sdk.php
Modified file system:
Creates the following files:
- /data/data/####/databases/jpush_statistics.db-journal
- /sdcard/baidu/tempdata/conlts.dat
- /data/data/####/shared_prefs/statistics_config.xml
- /sdcard/data/.push_deviceid
- /data/data/####/databases/smsbak-journal
- /data/data/####/databases/jpush_statistics.db
- /data/data/####/files/PrefsFile
- /sdcard/Android/data/####/cache/smsbak/log.csv
- /data/data/####/databases/jpush_local_notification.db-journal
- /sdcard/Android/data/####/cache/smsbak/sms.csv
- /sdcard/baidu/tempdata/ls.db-journal
- /data/data/####/shared_prefs/cn.jpush.serverconfig.xml
- /data/data/####/files/lldt/firll.dat
- /data/data/####/shared_prefs/cn.jpush.serverconfig.xml.bak
- /sdcard/baidu/.cuid
- /data/data/####/databases/rep.db-journal
- /data/data/####/databases/jpush_local_notification.db
- /sdcard/baidu/tempdata/ls.db
Miscellaneous:
Executes next shell scripts:
- su
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
