Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- l####.####.com
HTTP POST requests:
- l####.####.com/sdk.php
- l####.####.com/offline_loc
Modified file system:
Creates the following files:
- <Package Folder>/files/3.cfg
- <Package Folder>/files/ofld/ofl_statistics.db
- <Package Folder>/files/8.cfg
- <Package Folder>/files/9.cfg
- <Package Folder>/files/0.cfg
- <Package Folder>/files/ptg
- <Package Folder>/files/mark1
- <Package Folder>/files/ofld/ofl.config
- <Package Folder>/files/tmp/1495005852709
- <Package Folder>/files/tmp/dcim.cfg
- <Package Folder>/files/5.cfg
- <Package Folder>/files/status
- <Package Folder>/files/1.cfg
- <Package Folder>/files/tmp/1495005909042
- <Package Folder>/files/2.cfg
- <Package Folder>/files/tmp/1495005852729
- <Package Folder>/files/ofld/ofl_location.db-journal
- <Package Folder>/files/tmp/133A0D9
- <Package Folder>/files/tmp/133A0D8
- <Package Folder>/files/pwa
- <Package Folder>/files/tmp/1495005852722
- <Package Folder>/files/ofld/ofl_location.db
- <Package Folder>/files/dtl.dat
- <Package Folder>/files/kworker
- <Package Folder>/files/tmp/1495005912153
- <Package Folder>/files/qmi
- <Package Folder>/files/sync
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/4.cfg
- <Package Folder>/files/ofld/ofl_statistics.db-journal
- <Package Folder>/files/tmp/1495005914977
- <Package Folder>/files/mark300
- <Package Folder>/files/mark0
- <Package Folder>/files/lldt/firll.dat
- <Package Folder>/filestestvoice
Miscellaneous:
Executes next shell scripts:
- chown 0:0 /system/lib/liblocSDK6a.so
- getprop
- sh -c chmod 6777 <Package Folder>/files/nmea
- sh -c <Package Folder>/files/qmi <Package Folder>
- sh -c <Package Folder>/files/sync <Package Folder>
- su -c <Package Folder>/files/pwa <Package Folder>
- sh -c chown 0:0 <Package Folder>/files/sync
- chmod 644 /system/lib/liblocSDK6a.so
- su -c chown 0:0 <Package Folder>/files/kworker
- chown 0:0 <Package Folder>/files/status
- su -c chown 0:0 <Package Folder>/files/nmea
- chmod 6777 <Package Folder>/files/qmi
- sh -c chmod 6777 <Package Folder>/files/sync
- id
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/.PowerDetectService
- su -c <Package Folder>/files/qmi <Package Folder>
- chmod 644 /system/app/service.apk
- sh -c chown 0:0 <Package Folder>/files/nmea
- sh -c <Package Folder>/files/status <Package Folder>
- sh -c chown 0:0 <Package Folder>/files/pwa
- sh -c chmod 6777 <Package Folder>/files/status
- chmod 644 /system/lib/libnativeLoad.so
- su -c <Package Folder>/files/sync <Package Folder>
- chmod 6777 <Package Folder>/files/status
- su -c chown 0:0 <Package Folder>/files/qmi
- chown 0:0 <Package Folder>/files/sync
- chmod 6777 <Package Folder>/files/sync
- su -c chown 0:0 <Package Folder>/files/pwa
- chown 0:0 <Package Folder>/files/ptg
- chmod 6777 <Package Folder>/files/nmea
- chmod 6777 <Package Folder>/files/kworker
- sh -c chmod 6777 <Package Folder>/files/kworker
- sh -c chown 0:0 <Package Folder>/files/kworker
- su -c <Package Folder>/files/status <Package Folder>
- <su-internal:result>
- sh -c <Package Folder>/files/kworker <Package Folder>
- su -c <Package Folder>/files/ptg <Package Folder>
- sh -c <Package Folder>/files/ptg <Package Folder>
- <su-internal:request>
- grep gsm.sim.state
- sh -c chown 0:0 <Package Folder>/files/status
- chown 0:0 <Package Folder>/files/qmi
- sh -c chown 0:0 <Package Folder>/files/ptg
- mount -o remount,rw /dev/block/sda1 /system
- chown 0:0 <Package Folder>/files/nmea
- chown 0:0 /system/lib/libnativeLoad.so
- su -c mount -o remount,rw /dev/block/sda1 /system
- su -c chown 0:0 <Package Folder>/files/status
- sh -c chmod 6777 <Package Folder>/files/ptg
- chown 0:0 /system/app/service.apk
- sh -c <Package Folder>/files/pwa <Package Folder>
- sh -c getprop | grep gsm.sim.state
- <error:2>
- mount
- chmod 6777 <Package Folder>/files/pwa
- su
- su -c chown 0:0 <Package Folder>/files/ptg
- sh
- sh -c chmod 6777 <Package Folder>/files/qmi
- sh -c chmod 6777 <Package Folder>/files/pwa
- sh -c chown 0:0 <Package Folder>/files/qmi
- chmod 6777 <Package Folder>/files/ptg
- chown 0:0 <Package Folder>/files/pwa
- sh -c am startservice --user 0 -n ####/.PowerDetectService
- su -c chown 0:0 <Package Folder>/files/sync
- chown 0:0 <Package Folder>/files/kworker
Uses elevated priveleges.
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
