Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- l####.####.com
- 1####.####.241
- r####.####.com
HTTP POST requests:
- 1####.####.241/axs/careu/WallServiceVAD.asmx/GetIntialData_withSyncClass...
- l####.####.com/sdk.php
- l####.####.com/offline_loc
- 1####.####.241/axs/careu/WallServiceVAD.asmx/UploadNativePhoneInfo4
- r####.####.com/rqd/sync
Modified file system:
Creates the following files:
- /data/data/####/databases/bugly_db_-journal
- /data/data/####/files/ofld/ofl_statistics.db-journal
- /sdcard/baidu/tempdata/conlts.dat
- /sdcard/baidu/tempdata/ls.db
- /sdcard/test.0
- /data/data/####/files/ofld/ofl_location.db-journal
- /sdcard/baidu/tempdata/ller.dat
- /data/data/####/shared_prefs/HCAnHD8.xml
- /sdcard/baidu/tempdata/ls.db-journal
- /data/data/####/files/ofld/ofl_statistics.db
- /data/data/####/files/lldt/firll.dat
- /data/data/####/databases/bugly_db_
- /data/data/####/files/ofld/ofl.config
- /data/data/####/files/ofld/ofl_location.db
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh -c getprop ro.board.platform
- su
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
