Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- tr####.####.com
HTTP POST requests:
- tr####.####.com/update.xxdd
Modified file system:
Creates the following files:
- <Package Folder>/app_baidu/xpodg
- <Package Folder>/files/mpfdn
- <SD-Card>/.mkcong
- <SD-Card>/494095256934e34f79c74628e852da8a.jar
Miscellaneous:
Executes next shell scripts:
- /data/data/com.bjd.jir/app_baidu/xpodg -p com.bjd.jir -r am start --user 0 -n com.bjd.jir/zaxx.djel.kygme.osmm.sdgh.dwqp -a zaxx.djel.kygme.osmm.sdgh.dwqp -i 2057
- /data/data/com.bjd.jir/app_baidu/xpodg -p com.bjd.jir -r am start --user 0 -n com.bjd.jir/zaxx.djel.kygme.osmm.sdgh.dwqp -a zaxx.djel.kygme.osmm.sdgh.dwqp -i 2233
- /data/data/com.bjd.jir/app_baidu/xpodg -p com.bjd.jir -r am start --user 0 -n com.bjd.jir/zaxx.djel.kygme.osmm.sdgh.dwqp -a zaxx.djel.kygme.osmm.sdgh.dwqp -i 2257
- <dexopt>
- chmod 777 /data/data/com.bjd.jir/app_baidu/xpodg
- chmod 777 <Package Folder>/app_baidu/xpodg
- sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/zaxx.djel.kygme.osmm.sdgh.dwqp -a zaxx.djel.kygme.osmm.sdgh.dwqp -i 2057
- sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/zaxx.djel.kygme.osmm.sdgh.dwqp -a zaxx.djel.kygme.osmm.sdgh.dwqp -i 2233
- sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/zaxx.djel.kygme.osmm.sdgh.dwqp -a zaxx.djel.kygme.osmm.sdgh.dwqp -i 2257
