Technical information
Malicious functions:
Sends SMS messages:
- 10658423: mvwlan,0fd02d697a6923dceea0c7128a88d9ff,962
Removes its shortcut from the home screen.
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- cmvideo####.####.cn:8088
- s####.####.cn
HTTP GET requests:
- cmvideo####.####.cn:8088/api/videobase/getcontentid.php?adid=####&subAdi...
HTTP POST requests:
- s####.####.cn/clt30/test.jsp
Modified file system:
Creates the following files:
- <Package Folder>/databases/moviesdk.db
- <Package Folder>/databases/moviesdk.db-journal
- <Package Folder>/files/libcore.zip
- <Package Folder>/files/libyhcore.so
- <Package Folder>/shared_prefs/<Package>.xml
Miscellaneous:
Loads the following dynamic libraries:
- libyhcore
Uses the following algorithms to encrypt data:
- AES-CBC-NoPadding
- RSA-None-PKCS1Padding
Uses the following algorithms to decrypt data:
- DES
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
