Technical information
Malicious functions:
Prompts to install third-party applications.
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- s####.####.com
- i####.####.com
- b####.ly
- taitube####.com
- busi####.####.com
- up####.####.com
- ip####.io
- androi####.####.com
- mobile-####.####.com
HTTP GET requests:
- i####.####.com/public/uploads/store_7/8/4/6/0a88a7e44e10c33488f8ead0fd1b...
- up####.####.com/cgi-bin/get_mobileassist_mobile_update_info.cgi?guid=###...
- mobile-####.####.com/mbrowser/deeplink/getLinkedApps?pack=####
- i####.####.com/public/uploads/store_1/8/c/8/8c86cf406d1b60fc0650ed9949b3...
- taitube####.com/wp-content/uploads/2015/04/tubemate-224-2.jpg
- i####.####.com/public/uploads/store_5/d/3/f/d3f4c96968d3947e5e74f14ebb40...
- i####.####.com/public/uploads/store_4/7/a/1/7a103bbe47ddb34d8695960ce5e1...
- androi####.####.com/index.php/Update/UpdateDesc2?_branch=####
- i####.####.com/public/uploads/store_5/9/f/5/9f5f869c0b6a14d5132550176c76...
- i####.####.com/public/uploads/store_1/a/c/4/ac4faf9b8530fac0fca31a166c83...
- i####.####.com/public/uploads/store_8/5/f/f/9fe650dbdb39da86653477f25e94...
- b####.ly/1QCqdgl
- i####.####.com/public/uploads/store_4/c/2/d/c2d8d5b9d6504d248dc5ddb53181...
- i####.####.com/public/uploads/store_8/f/d/0/fd0c130457a063d37406b2f72da9...
- i####.####.com/public/uploads/store_7/e/8/c/e8c55394743e0abb913b50ab3b19...
- i####.####.com/public/uploads/store_4/1/f/6/1f6e7fbafcf120a783481866cf6e...
- i####.####.com/public/uploads/store_0/7/6/e/76e0376928b8393227a150fbed5d...
- b####.ly/1G6lQ7I
- ip####.io/json
- i####.####.com/public/uploads/store_5/a/9/2/a921d82b9c8ff379f0e6f4f6f026...
- androi####.####.com/index.php/ToolBox/getItems?_branch=####&picsize=####
- i####.####.com/public/uploads/store_8/a/6/9//a697fbad89e70273696f5a44fed...
- androi####.####.com/index.php/Tag/getTagDetail?group_name=####&_branch=#...
- i####.####.com/public/uploads/store_1/f/c/e//fce4f88e4488e8cf8083ce52144...
- i####.####.com/screen/android/thumb/tubemate-youtube-downloader-006.jpg
- i####.####.com/public/uploads/store_4/8/b/5//8b5c55141c16a09bee30a4897d2...
- i####.####.com/public/uploads/store_3/8/4/2/842183b9eb82c2b9df35b6a9a0fc...
- taitube####.com/wp-content/uploads/2013/11/Tubemate.jpg
- i####.####.com/public/uploads/store_2/3/3/0/33049312ab9acfabc6012a994c3f...
- i####.####.com/public/uploads/store_9/2/3/a/23a6d8e7c41b0c5cafbf6acd4614...
- i####.####.com/public/uploads/store_2/d/f/a/dfacb4fedb89e22eaef0ca2f4cf5...
- androi####.####.com/index.php/Guid/GetGuidTab?_branch=####&simCode=####
- androi####.####.com/index.php/Applist/GetAppOperationList?_branch=####&p...
- i####.####.com/public/uploads/store_0/1/f/a/1fac0445caa5e926b09297609f26...
- i####.####.com/public/uploads/store_5/d/b/c//dbc07d54319b6d83e9b5103c846...
- busi####.####.com/business/getConf?time_stamp=####&product=####
- androi####.####.com/setting/mobomarket_fb_config?_branch=####&fbVer=####
- androi####.####.com/setting/mobomarket_client_config
- androi####.####.com/index.php/Home/getHomeAppInfo?group_name=####&_branc...
- b####.ly/1NY1vd0
- s####.####.com/mbrowser/guanxing/Deeplink/js/com.baidu.browser.inter/d1c...
- i####.####.com/public/uploads/store_7/3/f/4/3f4435c35b3e35e07253e25e1310...
HTTP POST requests:
- androi####.####.com/index.php/Applist/CheckAppUpdateList?_branch=####&cp...
Modified file system:
Creates the following files:
- <Package Folder>/databases/google_analytics_v2.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/gaClientId
- <Package Folder>/shared_prefs/<Package>_preferences.xml
Miscellaneous:
Executes next shell scripts:
- /data/data/com.baidu.androidstore/files/libprocmox_v1_4.so /data/data/com.baidu.androidstore /data/app-lib/com.baidu.androidstore-1 82c73a2dd158cfeb2e534fe7688aa652 http://sync.appreport.baidu.com/cgi-bin-py-appstore/appstore_report_get_msg.cgi?type=unins
- su
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
