Technical information
Malicious functions:
Sets passwords on the lock screen
Network activity:
Connecting to:
- s####.####.com
- a####.####.com:17209
- a####.####.com
HTTP GET requests:
- s####.####.com/config?slotId=####&appId=####&sv=####&udid=####&os=####&osv=####&dmf=####&dml=####&dpd=####&so=####&ds=####&icc=####&cn=####&pk=####&
- a####.####.com/search.php?sid=####&aid=####&udid=####&os=####&osv=####&dt=####&dml=####&dpd=####&so=####&mcc=####&mnc=####&icc=####&adnum=####&ngp=###...
- a####.####.com:17209/v1/apps?page=####&size=####&sid=####&aid=####&campaign=####&version_code=####&api_level=####&os=####&osv=####&dmf=####&dml=####&d...
- a####.####.com/v1/apps?page=####&size=####&sid=####&aid=####&campaign=####&version_code=####&api_level=####&os=####&osv=####&dmf=####&dml=####&dpd=###...
HTTP POST requests:
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/hilocker.xml
- /data/data/####/files/.yflurrydatasenderblock.b8b4aae7-75c1-4ecb-9cc1-d44f31f8b097
- /data/data/####/files/.YFlurrySenderIndex.info.AnalyticsData_4XYQWGRCQ5DQF9B2DRST_202
- /data/data/####/shared_prefs/brixd.prefs.xml
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- /data/data/####/shared_prefs/mobnativeads_preferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/files/umeng_it.cache
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/com.pingstart.adsdk.preference.xml.bak
- /data/data/####/databases/google_analytics_v4.db-journal
- /data/data/####/databases/zuimei.lockscreen.sqlite-journal
- /data/data/####/cache/ads1452756019.jar
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/mobnativeads_preferences.xml
- /data/data/####/files/.imprint
- /data/data/####/files/AF_INSTALLATION
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/files/.yflurrydatasenderblock.628bbed8-5cd2-4a26-b9d5-305a9cbe3710
- /data/data/####/databases/zuiads.db-journal
- /data/data/####/shared_prefs/settings.pref.xml.bak
- /data/data/####/databases/webview.db-journal
- /sdcard/zuimei/lock_screen/images/journal.tmp
- /data/data/####/shared_prefs/settings.pref.xml
- /data/data/####/files/gaClientId
- /data/data/####/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/files/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/shared_prefs/appsflyer-data.xml.bak
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/cache/ApplicationCache.db-journal
- /data/data/####/shared_prefs/appsflyer-data.xml
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/shared_prefs/com.pingstart.adsdk.preference.xml
- /data/data/####/files/.yflurryreport.42439eb95395d245
Miscellaneous:
Executes next shell scripts:
- ps
Contains functionality to send SMS messages automatically.
