Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- o####.####.com
- a####.####.com
HTTP POST requests:
- a####.####.com/app_logs
- o####.####.com/v2/get_update_time
- o####.####.com/v2/check_config_update
Modified file system:
Creates the following files:
- <Package Folder>/files/d.dex
- <Package Folder>/shared_prefs/d_gloabl.xml
- <Package Folder>/shared_prefs/d_cm.xml
- <Package Folder>/shared_prefs/emob_config.xml
- <Package Folder>/shared_prefs/d_cm.xml.bak
- <Package Folder>/shared_prefs/d_am.xml.bak
- <Package Folder>/shared_prefs/d_am.xml
- <Package Folder>/files/.imprint
- <Package Folder>/databases/milano_db.db-journal
- <Package Folder>/shared_prefs/d_f.xml
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/emob_config.xml.bak
- <Package Folder>/shared_prefs/d_f.xml.bak
- <Package Folder>/files/d.zip
- <Package Folder>/helper
- <Package Folder>/shared_prefs/d_gloabl.xml.bak
Miscellaneous:
Executes next shell scripts:
- chmod 777 <Package Folder>/helper
- dd if=<Package Folder>/lib/libhelper.so of=<Package Folder>/helper
- <dexopt>
- sh
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.emob.comp.MobiService
Contains functionality to send SMS messages automatically.
