Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- 7j####.####.com
- a####.####.com
- c-h####.####.com
- m####.####.com
- s####.####.com
HTTP GET requests:
- 7j####.####.com/tdata_oGK676
- a####.####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=####&app...
- s####.####.com/config/hz-hzv3.conf
HTTP POST requests:
- c-h####.####.com/api.php?format=####&t=####
- m####.####.com/v2/register
- s####.####.com/api.php?format=####&t=####
Modified file system:
Creates the following files:
- <Package Folder>/database/pushinfo.db
- <Package Folder>/database/pushinfo.db-journal
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/MsgLogStore.db-journal
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/databases/plugin-journal
- <Package Folder>/databases/pushext.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/databases/pushstat_5.2.0.db
- <Package Folder>/databases/pushstat_5.2.0.db-journal
- <Package Folder>/databases/tmpd8.db-journal
- <Package Folder>/files/DaemonServer
- <Package Folder>/files/agoo.pid
- <Package Folder>/files/bdpush_modeconfig.json
- <Package Folder>/files/gdaemon_20161017
- <Package Folder>/files/init.pid
- <Package Folder>/files/init_c1.pid
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/mobclick_agent_cached_<Package>409
- <Package Folder>/files/push.pid
- <Package Folder>/files/run.pid
- <Package Folder>/files/tdata_Pbw496
- <Package Folder>/files/tdata_Pbw496.jar
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/<Package>.self_push_sync.xml
- <Package Folder>/shared_prefs/AGOO_CONNECT.xml
- <Package Folder>/shared_prefs/AGOO_HOST.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/shared_prefs/AppStore.xml.bak
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/PhoneUtil.xml
- <Package Folder>/shared_prefs/Setting.xml
- <Package Folder>/shared_prefs/bindSoftId.xml
- <Package Folder>/shared_prefs/clear_db.xml
- <Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml.bak
- <Package Folder>/shared_prefs/com.baidu.pushservice.BIND_CACHE.xml
- <Package Folder>/shared_prefs/mipush.xml
- <Package Folder>/shared_prefs/mipush.xml.bak
- <Package Folder>/shared_prefs/mipush_extra.xml
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/shared_prefs/pst.xml (deleted)
- <Package Folder>/shared_prefs/pst.xml.bak
- <Package Folder>/shared_prefs/pushclient.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml (deleted)
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/data/.push_deviceid
- <SD-Card>/libs/<Package>.db
- <SD-Card>/libs/app.db
- <SD-Card>/libs/com.getui.sdk.deviceId.db
- <SD-Card>/libs/com.igexin.sdk.deviceId.db
- <SD-Card>/system/####/tdata_Pbw496
Miscellaneous:
Executes next shell scripts:
- /data/data/com.uc.addon.facebook/files/gdaemon_20161017 0 com.uc.addon.facebook/com.igexin.sdk.PushService 25017 300 0
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.umeng.message.UmengService --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_android_daemon_1.1.0 -L http://agoodm.m.taobao.com/agoo/report -D %7B%22package%22%3A%22<Package>%22%2C%22appKey%22%3A%22umeng%3A578f48f267e58e16e800306b%22%2C%22utdid%22%3A%22WS6w1ecjwCoDAGdzx1Eo%2F4Dk%22%2C%22sdkVersion%22%3A%2220160215%22%7D -I agoodm.m.taobao.com -O 80 -T -Z
- <dexopt>
- am startservice --user 0 -n com.uc.addon.facebook/com.uc.addon.facebook.service.DaemonService
- app_process / <Package>.activity.Daemon --nice-name=<Package>.process
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/<Package>.service.DaemonService
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 700 /data/data/com.uc.addon.facebook/files/gdaemon_20161017
- chmod 700 <Package Folder>/files/gdaemon_20161017
- id
- sh
- sh /system/bin/am startservice --user 0 -n <Package>/<Package>.service.DaemonService
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25017 300 0
