Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- a####.####.com
- a####.####.info
HTTP GET requests:
- a####.####.info/v6/index.php?action=####&android=####&app_id=####&app_ve...
HTTP POST requests:
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- <Package Folder>/files/gaClientId
- <Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml.bak
- <Package Folder>/shared_prefs/pref_landlord.xml
Miscellaneous:
Executes next shell scripts:
- /system/bin/netcfg
- <su-internal:request>
- <su-internal:result>
- chmod 755
- sh -c echo ttta
- sh -c su -c ' echo ttta'
- su -c echo ttta
Uses elevated priveleges.
