Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- l####.####.com
HTTP POST requests:
- l####.####.com/sdk.php
- l####.####.com/offline_loc
Modified file system:
Creates the following files:
- <Package Folder>/files/3.cfg
- <Package Folder>/files/ofld/ofl_statistics.db
- <Package Folder>/files/tmp/utd_CE31/kb4098893976588
- <Package Folder>/files/8.cfg
- <Package Folder>/files/9.cfg
- <Package Folder>/files/0.cfg
- <Package Folder>/files/tmp/utd_CE31/kb4098894142921
- <Package Folder>/files/ptg
- <Package Folder>/files/mark1
- <Package Folder>/files/tmp/1495016925007
- <Package Folder>/files/tmp/utd_CE31/kb4098893845016
- <Package Folder>/files/ofld/ofl.config
- <Package Folder>/files/tmp/dcim.cfg
- <Package Folder>/files/5.cfg
- <Package Folder>/files/tmp/1495016928029
- <Package Folder>/files/status
- <Package Folder>/files/tmp/utd_CE31/kb4098893848403
- <Package Folder>/files/1.cfg
- <Package Folder>/files/tmp/utd_CE31/kb4098893966928
- <Package Folder>/files/tmp/1495016923156
- <Package Folder>/files/2.cfg
- <Package Folder>/files/tmp/utd_CE31/kb4098894337653
- <Package Folder>/files/ofld/ofl_location.db-journal
- <Package Folder>/files/tmp/133A0D9
- <Package Folder>/files/tmp/133A0D8
- <Package Folder>/files/pwa
- <Package Folder>/files/tmp/1495016865498
- <Package Folder>/files/ofld/ofl_location.db
- <Package Folder>/files/dtl.dat
- <Package Folder>/files/tmp/1495016865512
- <Package Folder>/files/kworker
- <Package Folder>/files/tmp/1495016865517
- <Package Folder>/files/qmi
- <Package Folder>/files/sync
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/4.cfg
- <Package Folder>/files/ofld/ofl_statistics.db-journal
- <Package Folder>/files/mark300
- <Package Folder>/files/mark0
- <Package Folder>/files/tmp/utd_CE31/kb4098894328676
- <Package Folder>/files/tmp/utd_CE31/kb4098894334099
- <Package Folder>/files/lldt/firll.dat
- <Package Folder>/filestestvoice
Miscellaneous:
Executes next shell scripts:
- getprop
- sh -c chmod 6777 <Package Folder>/files/nmea
- sh -c <Package Folder>/files/qmi <Package Folder>
- su -c <Package Folder>/files/pwa <Package Folder>
- chmod 6777 <Package Folder>/files/status
- su -c chown 0:0 <Package Folder>/files/kworker
- chown 0:0 <Package Folder>/files/status
- su -c chown 0:0 <Package Folder>/files/nmea
- sh -c chmod 6777 <Package Folder>/files/sync
- id
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/.PowerDetectService
- su -c <Package Folder>/files/status <Package Folder>
- sh -c <Package Folder>/files/sync <Package Folder>
- sh -c <Package Folder>/files/status <Package Folder>
- sh -c chown 0:0 <Package Folder>/files/pwa
- sh -c chmod 6777 <Package Folder>/files/status
- su -c chown 0:0 <Package Folder>/files/qmi
- su -c <Package Folder>/files/ptg <Package Folder>
- sh -c chown 0:0 <Package Folder>/files/sync
- chmod 6777 <Package Folder>/files/qmi
- chown 0:0 <Package Folder>/files/sync
- chmod 6777 <Package Folder>/files/sync
- su -c chown 0:0 <Package Folder>/files/pwa
- chown 0:0 <Package Folder>/files/ptg
- chmod 6777 <Package Folder>/files/nmea
- chmod 6777 <Package Folder>/files/kworker
- sh -c chmod 6777 <Package Folder>/files/kworker
- sh -c chown 0:0 <Package Folder>/files/kworker
- su -c <Package Folder>/files/qmi <Package Folder>
- sh -c <Package Folder>/files/kworker <Package Folder>
- sh -c chown 0:0 <Package Folder>/files/nmea
- sh -c <Package Folder>/files/ptg <Package Folder>
- sh -c chmod 6777 <Package Folder>/files/ptg
- grep gsm.sim.state
- su -c <Package Folder>/files/sync <Package Folder>
- chown 0:0 <Package Folder>/files/qmi
- sh -c chown 0:0 <Package Folder>/files/ptg
- <su-internal:request>
- chown 0:0 <Package Folder>/files/nmea
- sh -c chmod 6777 <Package Folder>/files/qmi
- <su-internal:result>
- su -c chown 0:0 <Package Folder>/files/status
- sh -c chown 0:0 <Package Folder>/files/status
- sh -c <Package Folder>/files/pwa <Package Folder>
- sh -c getprop | grep gsm.sim.state
- <error:2>
- sh -c am startservice --user 0 -n ####/.PowerDetectService
- chmod 6777 <Package Folder>/files/pwa
- su
- su -c chown 0:0 <Package Folder>/files/ptg
- sh
- sh -c chmod 6777 <Package Folder>/files/pwa
- sh -c chown 0:0 <Package Folder>/files/qmi
- chmod 6777 <Package Folder>/files/ptg
- chown 0:0 <Package Folder>/files/pwa
- mount
- su -c chown 0:0 <Package Folder>/files/sync
- chown 0:0 <Package Folder>/files/kworker
Uses elevated priveleges.
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
