Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- a####.####.com
- a####.####.info
HTTP GET requests:
- a####.####.info/v6/index.php?action=####&android=####&app_id=####&app_ve...
HTTP POST requests:
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- <Package Folder>/files/gaClientId
- <Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml.bak
- <Package Folder>/shared_prefs/pref_landlord.xml
Miscellaneous:
Executes next shell scripts:
- <error:2>
- <su-internal:request>
- <su-internal:result>
- chattr +i /system/priv-app/<Package>.apk
- chmod 644 /system/priv-app/<Package>.apk
- chmod 755
- mount -o remount,rw /system
- sh -c echo ttta
- sh -c mount -o remount,rw /system; cat /data/app/<Package>-1.apk > /system/priv-app/<Package>.apk; chmod 644 /system/priv-app/<Package>.apk; chattr +i /system/priv-app/<Package>.apk;
- sh -c su -c ' echo ttta'
- sh -c su -c ' mount -o remount,rw /system; cat /data/app/<Package>-1.apk > /system/priv-app/<Package>.apk; chmod 644 /system/priv-app/<Package>.apk; chattr +i /system/priv-app/<Package>.apk; '
- su -c echo ttta
- su -c mount -o remount,rw /system; cat /data/app/<Package>-1.apk > /system/priv-app/<Package>.apk; chmod 644 /system/priv-app/<Package>.apk; chattr +i /system/priv-app/<Package>.apk;
Uses elevated priveleges.
