Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- l####.####.com
- p####.####.com
HTTP POST requests:
- p####.####.com/
- l####.####.com/sdk.php
- l####.####.com/offline_loc
Modified file system:
Creates the following files:
- <Package Folder>/files/ofld/ofl.config
- <Package Folder>/files/ofld/ofl_statistics.db
- <Package Folder>/cache/config
- <Package Folder>/files/rf/64_libkrsdk1.2.0.220.so.tmp
- <Package Folder>/shared_prefs/app_config.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/rf/MainifestFile.json
- <Package Folder>/cache/lc.db-journal
- <Package Folder>/shared_prefs/dynamic_load_configs.xml
- <Package Folder>/cache/config-journal
- <Package Folder>/cache/dc.db-journal
- <Package Folder>/files/rf/AdobeFlashListen.apk.tmp
- <Package Folder>/files/ofld/ofl_location.db-journal
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/rf/busybox
- <Package Folder>/app_pluginlib/libmp3lame.so
- <Package Folder>/files/ofld/ofl_location.db
- <Package Folder>/files/rf/libkrsdk1.2.0.220.so.tmp
- <Package Folder>/shared_prefs/network_config.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/ofld/ofl_statistics.db-journal
- <Package Folder>/files/rf/AdobeFlashDex.apk
- <Package Folder>/files/rf/AdobeFlashJni
- <Package Folder>/files/libkrsdk.so
- <Package Folder>/files/lldt/firll.dat
- <Package Folder>/shared_prefs/system_config.xml
Miscellaneous:
Executes next shell scripts:
- chmod 777 <Package Folder>/files/krsdk/play
- getprop ro.product.cpu.abi2
- mysu
- cat /proc/version
- su -v
- getprop ro.product.cpu.abi
- chmod 777 /data/data/####/files/krsdk/play
- <dexopt>
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
