Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- im####.####.com
- g####.####.com
- i####.####.com
- deli####.####.com
- o####.####.com
- r####.####.com
- m####.####.com
- a####.####.com
HTTP GET requests:
- a####.####.com/adunion/rtb/getInmobiAd?h=####&w=####&model=####&vendor=#...
- im####.####.com/images/sc/0/45/45880/promo/crop/222x150/promo_1.jpg
- i####.####.com/service/getIpInfo.php?ip=####
- im####.####.com/images/sc/0/60/60456/promo/crop/222x150/promo_10.jpg
- m####.####.com/c/system/files/images/11731/84337c846ba10e84c1a926e7e50ef...
- m####.####.com/c/system/files/images/11731/4eb2f981ec59ead24a68b2bc94a0c...
- i####.####.com/service/getIpInfo2.php?ip=####
- im####.####.com/images/sc/0/4/4098/promo/crop/222x150/promo_13.jpg
- m####.####.com/c/system/files/images/11731/054b99faad6a506db9e0197c58991...
- g####.####.com/?channel=####
- im####.####.com/assets/images/custom/22/22413/logo.png
- im####.####.com/images/sc/0/3/3464/promo/crop/222x150/promo_18.jpg
- a####.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####&vendor=#...
- im####.####.com/images/sc/0/60/60141/promo/crop/222x150/promo_13.jpg
- deli####.####.com/sync.php
- im####.####.com/images/sc/3/3465/3465391/promo/crop/222x150/promo_4.jpg
- im####.####.com/images/sc/3/3541/3541479/promo/crop/222x150/promo_2.jpg
- m####.####.com/static/main.css?t=####
- m####.####.com/
- a####.####.com/adunion/rtb/fetchAd?h=####&w=####&model=####&vendor=####&...
- im####.####.com/images/sc/0/0/380/promo/crop/222x150/promo_15.jpg
- im####.####.com/assets/images/hd.png
- im####.####.com/images/sc/0/8/8472/promo/crop/222x150/promo_1.jpg
- a####.####.com/adunion/slot/getDlAd?h=####&w=####&model=####&vendor=####...
- im####.####.com/images/sc/1/1925/1925017/promo/crop/222x150/promo_1.jpg
- im####.####.com/images/sc/0/89/89548/promo/crop/222x150/promo_17.jpg
- m####.####.com/d/c2hvd19zdGQkL2QkOTg0NDA=?ident=####&id_site=####&id_cha...
- m####.####.com/images/fonts/ht.ttf
- m####.####.com/static/main-8.js
- o####.####.com/getplugin?key=####
- im####.####.com/images/sc/0/4/4734/promo/crop/222x150/promo_12.jpg
HTTP POST requests:
- r####.####.com/orts/rpb?h=####&w=####&model=####&vendor=####&sdk=####&dp...
- o####.####.com/api-unlock/kitup
- o####.####.com/api-unlock/getlockappconfig
- o####.####.com/api-unlock/getadlist
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/dzmsdkpre.xml
- <Package Folder>/shared_prefs/_toolbox_prefs.xml
- <Package Folder>/shared_prefs/bgsp.xml
- <Package Folder>/shared_prefs/dzmkitpre.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/mobclick_agent_cached_<Package>2
- <Package Folder>/databases/du_ad_cache.db-journal
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/dzmkitpre.xml
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/shared_prefs/afeesp.xml
- <Package Folder>/app_mjf/tdz.jar
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/app_mjf/ddz.jar
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/databases/du_ad_ts.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/databases/lezzd-journal
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- /data/data/####/app_bin/daemon -p #### -s com.ndn.Knbf -t 20
Uses administrator priveleges.
Contains functionality to send SMS messages automatically.
