How can someone detect if their phone has this backdoor installed?
bigdata.adups.com (primary)
bigdata.adsunflower.com
bigdata.adfuture.cn
bigdata.advmob.cn
Then check the content of the POST request (usually to url/mobileupload.do )