Technical information
Malicious functions:
Prompts to install third-party applications.
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- p####.####.com
- q####.####.cn
- g####.####.net
- qq####.####.com
- i####.####.com
HTTP GET requests:
- i####.####.com/features7.0/dest/font/source.svg
- q####.####.cn/
- i####.####.com/features7.0/dest/css/all.min.css
- p####.####.com/pv.GIF?t=####&u=####&r=####&pl=####&load=####&onloadtime=...
- qq####.####.com/11.png
- i####.####.com/features7.0/dest/font/source.ttf
- i####.####.com/features7.0/dest/font/tt.ttf
- q####.####.cn/favicon.ico
- i####.####.com/features7.0/dest/js/main.min.js
- g####.####.net/sendsms.xml
Modified file system:
Creates the following files:
- /sdcard/hututu/htt_bj.png
- /data/data/####/shared_prefs/UPLOAD_INFO.xml
- /sdcard/_Log/uploadinfo/log.txt
Miscellaneous:
Executes next shell scripts:
- logcat -v time
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
