Technical information
Malicious functions:
Sends SMS messages:
- 106906316717912114: 苏州易N支付##########
- 106906316717912114: PAY#QYBxdqLz2Di4lrx252VqGTjD/9gTNJrZPhgSRkqtIpTRIc2h66KzFKn4f6xxAPtE
Network activity:
Connecting to:
- 1####.####.90
- v####.####.com
- s####.####.cn
- 1####.cn
- p####.####.com
- c####.####.com
- v####.####.com:998
- a####.####.com
HTTP GET requests:
- v####.####.com/v3/images/VIP.png
- v####.####.com/public/v2/201604/a6ccc953e4f93d32.jpg
- p####.####.com/cityjson?ie=####
- v####.####.com/public/v2/201604/48e00143b02eb221.jpg
- v####.####.com:998/v3/recommend.html
- 1####.####.90/code/init?app=####&lon=####&count=####&imei=####&iccid=####&nwtype=####&ctech=####&aimsi=####&cpid=####&cid=####&osversion=####&pck=####...
- v####.####.com/public/v2/banner/87f66e4.jpg
- a####.####.com/ReportAction/?&secretKey=####&seed=####&md5=####&type=####&tag=####&str_tag=####&IMEI=####
- v####.####.com/v2/recommend.do
- v####.####.com/public/v2/201604/17686305416604ff.jpg
- a####.####.com/ReportInfo/?&secretKey=####&seed=####&md5=####&appChannel=####&OStype=####&machineID=####&sysVersion=####&phoneType=####&hardwareAddr=#...
- v####.####.com/v3/js/core.js
- v####.####.com/v3/js/apps.js
- a####.####.com/GetAD20160302/?&secretKey=####&seed=####&md5=####&appChannel=####&action=####&time=####&IMEI=####
- v####.####.com/v3/images/more.png
- s####.####.cn/versioncheck.aspx
- c####.####.com/u/img/20160412/img$20160412$b00e25628ab35d7baa4a56df34b01a4b.png
- v####.####.com/v3/images/loading.gif
- v####.####.com/public/v2/201604/96c1f91255a7ee2e.jpg
- v####.####.com/v2/recommend.banner
- v####.####.com/public/v2/201604/1db4f9acbd22c7b6.jpg
- v####.####.com/v3/css/style-bak.css
- v####.####.com/public/v2/banner/X1K4zmQ.jpg
- v####.####.com/v3/images/reflash.png
- v####.####.com/public/v2/201604/ebe26c7982c0ec13.jpg
- a####.####.com/ReportAD/?&secretKey=####&seed=####&md5=####&appChannel=####&IMEI=####&ad_id=####&action=####&ad_type=####&image=####&time=####
- c####.####.com/u/img/20160323/img$20160323$1bbde2b04e689eed9eb11b52ab97e3b9.jpg
- a####.####.com/GetAD20160302/?&secretKey=####&seed=####&md5=####&appChannel=####&action=####&time=####&IMEI=####&type=####
- c####.####.com/u/img/20160112/img$20160112$4dbbff95eea41c063a66c7d7a1200459.jpg
HTTP POST requests:
- a####.####.com/app_logs
- 1####.cn/phone/fetch
Modified file system:
Creates the following files:
- /sdcard/lll/cjimg/img201601124dbbff95eea41c063a66c7d7a1200459
- /sdcard/lll/cadinfo/specialAd
- /sdcard/lll/cjicon/img20160412b00e25628ab35d7baa4a56df34b01a4b
- /sdcard/lll/cadinfo/appKey
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/device_authenticity.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/InitInfo.xml
- /data/data/####/shared_prefs/ADdata.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/lll/cadinfo/normalAd
- /data/data/####/shared_prefs/MmData.xml
- /sdcard/lll/cjimg/img201603231bbde2b04e689eed9eb11b52ab97e3b9
- /data/data/####/files/.imprint
- /data/data/####/shared_prefs/util_preference.xml
- /sdcard/Download/channel_zmcj
- /data/data/####/databases/webview.db-journal
- /data/data/####/databases/lepeng.db-journal
- /data/data/####/shared_prefs/secretKeyFile.xml
- /data/data/####/shared_prefs/Filter.xml
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/files/umeng_it.cache
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/shared_prefs/device_authenticity.xml.bak
- /data/data/####/shared_prefs/STORE.xml
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Contains functionality to send SMS messages automatically.
