Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.MobiDash.1.origin
Network activity:
Connecting to:
- launche####.####.com
- launche####.####.cn
- gos####.####.cn
- goup####.####.cn
- gameser####.####.com
HTTP GET requests:
- launche####.####.com/gostore/webcontent/function/getAdmobCon.jsp?country...
- launche####.####.com/guiAdmob/webcontent/function/getAdmobCon.jsp?countr...
HTTP POST requests:
- goup####.####.cn/GOClientData/DR?ptl=####&is_zip=####
- launche####.####.com/launcherwidget/remdinfo.do?rd=####
- goup####.####.cn/GOClientData/DC
- launche####.####.cn/golaunchermsg/msgservice.do?funid=####&rd=####
- gameser####.####.com/gameservice/common?funid=####&rd=####
- goup####.####.cn/GOClientData/DR?ptl=####&is_zip=####&is_response_json=#...
- launche####.####.com/guiWallpaper/common?funid=####&rd=####
- gos####.####.cn/gostore/entrance
Modified file system:
Creates the following files:
- /sdcard/GOLauncherEX/autobackup/db/androidheart.db-journal
- /sdcard/GOLauncherEX/autobackup/db/launchers.db-journal
- /sdcard/GOLauncherEX/autobackup/db/authCache-journal
- /sdcard/GOLauncherEX/messagecenter/filterinfo.txt
- /sdcard/GOLauncherEX/autobackup/preference/tutorial.xml
- /sdcard/GOLauncherEX/autobackup/db/gameapps.db-journal
- /sdcard/GOLauncherEX/screenEdit/push/cacheData/sGoDynWallpaperSaveKey
- /sdcard/GOLauncherEX/autobackup/db/gameapps.db
- /sdcard/GOLauncherEX_ThemeStore/subscription
- /sdcard/GOLauncherEX/autobackup/db/client_settings
- /sdcard/GOLauncherEX/gotheme/publicCurrentThemePkg
- /sdcard/GOLauncherEX/.nomedia
- /sdcard/GOLauncherEX/autobackup/db/gostatistics_sdk.db
- /sdcard/GOLauncherEX/autobackup/db/webview.db
- /sdcard/GOLauncherEX/autobackup/db/GetJarDBApplicationKey
- /sdcard/GOLauncherEX/autobackup/db/androidheart.db
- /sdcard/GOLauncherEX/autobackup/db/gostatistics_sdk.db-journal
- /data/data/####/shared_prefs/PersonalizationService.xml.bak
- /sdcard/GOLauncherEX/autobackup/db/GetJarDBApplicationKey-journal
- /sdcard/GOLauncherEX/autobackup/db/appgamecenter.db
- /data/data/####/shared_prefs/PersonalizationService.xml
- /sdcard/GOLauncherEX/statistics/statistics/deviceId.txt
- /sdcard/GOLauncherEX/screenEdit/push/cacheData/sGoWallpaperSaveKey
- /sdcard/GOLauncherEX/messagecenter/lastupdatetime.txt
- /sdcard/GOLauncherEX/autobackup/db/google_analytics.db
- /sdcard/.goproduct/goid
- /sdcard/GOLauncherEX/autobackup/db/client_settings-journal
- /sdcard/GOLauncherEX/autobackup/db/authCache
- /sdcard/GOLauncherEX/autobackup/db/appgamecenter.db-journal
- /sdcard/GOLauncherEX/install_stamp
- /sdcard/GOLauncherEX/autobackup/db/launchers.db
- /sdcard/GOLauncherEX/autobackup/db/webview.db-journal
- /sdcard/GOLauncherEX/autobackup/db/google_analytics.db-journal
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/dexopt --dex 27 41 40 503120 /data/data/####/code_cache/secondary-dexes/####-1.apk.classes2.zip 2168832 -694199456 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.
- /system/bin/dexopt --dex 27 56 40 1355516 /data/data/####/app_apks/shellplugin.apk 1164347513 -613945162 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
- /system/bin/dexopt --dex 27 40 40 270828 /data/data/####/app_app_apk/launcherex.dat.jar 1244898618 449528362 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syst
Contains functionality to send SMS messages automatically.
