Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- u####.####.com
- ser####.####.net
- 1####.####.94:8020
- s####.####.net
- ac####.####.com
- m####.####.com
- a####.####.com
HTTP GET requests:
- u####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=...
- a####.####.com/Customised/GetItemUrl
- u####.####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####&v=###...
- a####.####.com/TrashClean/GetHotInfoList
- u####.####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=####&v...
- a####.####.com//News/GetNewsList
- u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
- 1####.####.94:8020/m/umeng:53c3364556240b61020acd56/2007/Anhyrtt7eKL92gF...
- u####.####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=####&app...
- s####.####.net/upgradeApp.aspx?packname=####&ver=####&coid=####&typeid=#...
HTTP POST requests:
- a####.####.com/app_logs
- ac####.####.com//Faster/RefreshUserLoginInfo
- m####.####.com/v2/launch
- ac####.####.com/Report/ActiveStat
- ser####.####.net/Mobile/Agg/V3000/Active.aspx?
- a####.####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&sv=#...
- m####.####.com/v2/register
- ac####.####.com/NoticeInformation/GetNoticeInformationInformationList?
- ser####.####.net/Mobile/Agg/V3000/SendApkInfo.aspx?
- ac####.####.com/Report/Active?token=####&versioncode=####&versionname=##...
- ac####.####.com/activeicon/getactiveicon
- a####.####.com/rest/gc?ak=####&av=####&c=####&v=####&s=####&d=####&sv=##...
- ac####.####.com/AppKeeper/GetCommonSwitch
Modified file system:
Creates the following files:
- /data/data/####/databases/Splash.db-journal
- /data/anr/traces.txt
- /sdcard/Android/data/####/cache/uil-images/journal
- /data/data/####/databases/cc.db-journal
- /data/data/####/shared_prefs/static_pref.xml.bak
- /data/data/####/shared_prefs/####_preference.xml
- /data/data/####/shared_prefs/zxly_agg.conf.xml.bak
- /data/data/####/databases/ua.db
- /data/data/####/shared_prefs/UTMCConf-513445323.xml
- /data/data/####/shared_prefs/AGOO_HOST.xml
- /sdcard/.testf
- /data/data/####/databases/clean_db.db-journal
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/databases/cc.db
- /data/data/####/files/sllak/core/finalcore.jar
- /data/data/####/shared_prefs/AGOO_CONNECT.xml
- /data/data/####/shared_prefs/tbs_download_config.xml.bak
- /data/data/####/databases/MsgLogStore.db-journal
- /data/data/####/databases/clean_db.db
- /data/data/####/app_tbs/share/core_info
- /data/data/####/databases/ua.db-journal
- /data/data/####/shared_prefs/queen_conf.xml
- /data/data/####/databases/battery.db-journal
- /data/data/####/databases/xUtils.db-journal
- /data/data/####/shared_prefs/sdk_config.xml
- /sdcard/Angogo/com_zxly_assist/cache/crash-2017-05-02-12-42-09-1493728929357.log
- /data/data/####/shared_prefs/umeng_message_state.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/.DataStorage/ContextData.xml
- /sdcard/Android/data/####/cache/uil-images/journal.tmp
- /data/data/####/shared_prefs/AppStore.xml
- /sdcard/.sfp/.sfp
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/files/.imprint
- /sdcard/Angogo/com_zxly_assist/cache/crash-2017-05-02-12-42-05-1493728925597.log
- /data/data/####/shared_prefs/AppStore.xml.bak
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/databases/agg_app_activation.db-journal
- /data/data/####/shared_prefs/UTMCBase.xml
- /data/data/####/app_tbs/core_private/tbslock.txt
- /data/data/####/files/exid.dat
- /data/data/####/files/recovery.dat
- /data/data/####/shared_prefs/zxly_agg.conf.xml
- /data/data/####/shared_prefs/s_update.xml
- /data/data/####/databases/agg_cfglist.db-journal
- /data/data/####/shared_prefs/tbs_download_config.xml
- /data/data/####/databases/clean_db.db-wal
- /data/data/####/shared_prefs/PhoneUtil.xml
- /sdcard/Android/data/####/cache/.nomedia
- /sdcard/Android/data/####/files/tbslog/tbslog.txt
- /data/data/####/files/umeng_it.cache
- /data/data/####/databases/com.zxly.Agg.db-journal
- /data/data/####/databases/agg_classify_new.db-journal
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/databases/clean_db.db-shm
- /data/data/####/files/init_er.pid
- /sdcard/Angogo/com_zxly_assist/cache/crash-2017-05-02-12-42-12-1493728932385.log
- /data/data/####/app_tbs/core_private/tbscoreinstall.txt
- /data/data/####/shared_prefs/UTMCLog-513445323.xml
- /data/data/####/files/DaemonServer
- /data/data/####/databases/UmengLocalNotificationStore.db-journal
- /data/data/####/databases/agg_classify_new.db
- /data/data/####/shared_prefs/static_pref.xml
- /data/data/####/files/agoo.pid
Sets the 'executable' attribute to the following files:
- /data/data/####/files/recovery.dat
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/dexopt --dex 27 40 40 199468 /data/data/####/files/sllak/core/finalcore.jar 1227190644 -782264668 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
- chmod 777 /data/system/zxly
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket1946 --user 0
- chmod 777 /data/data/####/files/agg.xml
- chmod 777 /data/data/####/files/recovery.dat
- su
- getprop ro.product.cpu.abi
- /system/bin/sh
- sh
- cat /sys/class/net/wlan0/address
- chmod 500 /data/data/####/files/DaemonServer
- /data/data/####/files/DaemonServer -s /data/data/####/lib/ -n runServer -p startservice -a ####.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack #### --user 0 -f /data/data/#### -t
- /system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
- /system/bin/aggdll
- chmod 777 /data/data/####/files/busybox
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
