Android.Hidden.3276

Technical information

Malicious functions:

Prompts to install third-party applications.

Removes its shortcut from the home screen.

Network activity:

Connecting to:

1####.####.197
1####.####.21
m####.####.com
m####.####.com:81
tr####.####.com
z####.####.com

HTTP GET requests:

z####.####.com/img/20151208/193240/closeimg_20151208193240.png

HTTP POST requests:

1####.####.197/main/content/upd.php
1####.####.21/main/form/rg.php
m####.####.com/hladserver/api/3
m####.####.com:81/hladserver/api/1
tr####.####.com/update.xxdd

Modified file system:

Creates the following files:

<Package Folder>/app_baidu/xpodg
<Package Folder>/databases/4e8a73a9d95daa8a0420b00d13fbcdb5.db-journal
<Package Folder>/databases/vastpaydb
<Package Folder>/databases/vastpaydb-journal
<Package Folder>/files/####/zhsysgdi.jar
<Package Folder>/files/adctmmjd.so
<Package Folder>/files/analys.conf
<Package Folder>/shared_prefs/agchk.xml
<Package Folder>/shared_prefs/hlcsdpf.xml
<Package Folder>/shared_prefs/hlcsdpf.xml (deleted)
<Package Folder>/shared_prefs/hlcsdpf.xml.bak
<Package Folder>/shared_prefs/hlcsdpf.xml.bak (deleted)
<Package Folder>/shared_prefs/resc_b.xml
<Package Folder>/shared_prefs/resc_b.xml.bak
<Package Folder>/shared_prefs/resc_c.xml
<Package Folder>/shared_prefs/resc_d.xml
<Package Folder>/shared_prefs/resc_i.xml
<Package Folder>/shared_prefs/resc_i.xml.bak
<SD-Card>/.android/51e67b93ded9b0925aecdc0e997688a4.apk.tmp
<SD-Card>/.android/9c1afb12baebab3669032b62e5e28738.apk.tmp
<SD-Card>/.android/close.png
<SD-Card>/.android/dev.txt
<SD-Card>/.android/fatpot.png
<SD-Card>/.android/thinpot.png
<SD-Card>/.mkcong
<SD-Card>/59eec5e149a15ac4a6d5039b3a305937.jar
<SD-Card>/<Package>/analys.conf
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/59eec5e149a15ac4a6d5039b3a305937.jar
<SD-Card>/Android/####/a
<SD-Card>/Android/####/c

Miscellaneous:

Executes next shell scripts:

/data/data/com.andriod.paoapp/app_baidu/xpodg -p com.andriod.paoapp -r am start --user 0 -n com.andriod.paoapp/swsu.eowx.qqguj.thyg -a swsu.eowx.qqguj.thyg -i 2076
/data/data/com.andriod.paoapp/app_baidu/xpodg -p com.andriod.paoapp -r am start --user 0 -n com.andriod.paoapp/swsu.eowx.qqguj.thyg -a swsu.eowx.qqguj.thyg -i 2122
/data/data/com.xp.browser/files/DaemonServer -s /data/data/com.xp.browser/lib/ -n runServer -p startservice -n com.xp.browser/com.taobao.accs.ChannelService --user 0 -f /data/data/com.xp.browser -t 600 -c agoo.pid -P /data/data/com.xp.browser -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D %7B%22package%22%3A%22com.xp.browser%22%2C%22appKey%22%3A%22umeng%3A58098976717c196f4f003422%22%2C%22utdid%22%3A%22WS5lu2PfUbUDAGdzx1G7xmE1%22%2C%22sdkVersion%22%3A%22212%22%7D -I agoodm.m.taobao.com -O 80 -T -Z
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<dexopt>
<error:2>
chmod 500 /data/data/com.xp.browser/files/DaemonServer
chmod 777 /data/data/com.andriod.paoapp/app_baidu/xpodg
chmod 777 <Package Folder>/app_baidu/xpodg
getprop ro.bootloader
getprop ro.build.fingerprint
getprop ro.build.product
getprop ro.hardware
getprop ro.kernel.qemu
getprop ro.product.brand
getprop ro.product.device
getprop ro.product.manufacturer
getprop ro.product.model
getprop ro.secure
sh
sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/swsu.eowx.qqguj.thyg -a swsu.eowx.qqguj.thyg -i 2076
sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/swsu.eowx.qqguj.thyg -a swsu.eowx.qqguj.thyg -i 2122