Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.11446
- Android.SkyMobi.5.origin
- Android.SmsSpy.527.origin
- Android.Triada.155.origin
- Android.Backdoor.285.origin
- Android.DownLoader.441.origin
- Android.SmsSend.1848.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.285.origin
Network activity:
Connecting to:
- pus####.####.cn
- s####.####.com
- g####.####.info:8088
- p####.####.com
- p####.####.com:7820
- f####.####.cn:8090
- do####.####.info:8010
- d####.####.net
- g####.####.info
- do####.####.info
- f####.####.cn
- a####.####.com
HTTP GET requests:
- d####.####.net/update/plugin-release-v4.9.3.zip
- g####.####.info:8088/earth/enable?deviceid=####&version=####&imsi=####
- pus####.####.cn/czfiles/shangan-2017-51016-old5
- f####.####.cn/getjar?cpid=####&packagename=####&ismi=####&version_code=####
- s####.####.com/getconfig.aspx?
- pus####.####.cn/czfiles/youtou-2017
- f####.####.cn:8090/getjar?cpid=####&packagename=####&ismi=####&version_code=####
- g####.####.info/earth/video/needshow2?channel=####
- p####.####.com/?igtcmd=####&iccid=####&imsi=####&imei=####&order=####&umeng=####&price=####&cpid=####&gameid=####&sdk=####&gamename=####&sdkpaypoint=#...
- pus####.####.cn/czfiles/mysdk1702141640
- f####.####.cn/phoneget?cpid=####&ismi=####&calltime=####&callcount=####&smscount=####&appname=####&sign=####
- pus####.####.cn/czfiles/myadv-2017-nopermission
HTTP POST requests:
- p####.####.com/
- do####.####.info:8010/
- do####.####.info/
- a####.####.com/app_logs
- p####.####.com:7820/
Modified file system:
Creates the following files:
- /sdcard/com.zckj.files/net.tt.plugin.myadv
- /data/anr/traces.txt
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/.config
- /sdcard/com.zckj.files/net.tt.plugin.shangan
- /data/data/####/files/net.tt.plugin.mysdk.apk
- /data/data/####/Plugin/net.tt.plugin.mysdk/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/ShareFiles.xml.bak
- /data/data/####/shared_prefs/ShareFiles.xml
- /data/data/####/Plugin/net.tt.plugin.yingmei/Signature/Signature_0.key
- /data/data/####/files/net.tt.plugin.shangan.apk
- /data/data/####/Plugin/net.tt.plugin.shangan/Signature/Signature_0.key
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/zip/8c5c702b-6b87-4fbc-b60e-9d0c1f358e87.zip
- /data/data/####/Plugin/net.tt.plugin.shangan/dalvik-cache/base-1.dex
- /data/data/####/Plugin/net.tt.plugin.utadv/dalvik-cache/base-1.dex
- /data/data/####/files/mobclick_agent_cached_####
- /data/data/####/Plugin/net.tt.plugin.utadv/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.yingmei/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.skypay/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/Plugin/net.tt.plugin.myadv/apk/base-1.apk
- /data/data/####/shared_prefs/game_state_file.xml
- /sdcard/com.zckj.files/net.tt.plugin.utadv
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/crash/crash-2017-01-26-1485415860523.log
- /data/data/####/files/net.tt.plugin.skypay.apk
- /data/data/####/Plugin/net.tt.plugin.yingmei/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.yingmei.apk
- /data/data/####/Plugin/net.tt.plugin.skypay/lib/tmp.JK2103
- /data/data/####/Plugin/net.tt.plugin.skypay/lib/tmp.og2103
- /sdcard/com.zckj.files/u.apk
- /data/data/####/Plugin/net.tt.plugin.utadv/apk/base-1.apk
- /data/data/####/files/net.tt.plugin.utadv.apk
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
- /data/data/####/Plugin/net.tt.plugin.myadv/dalvik-cache/base-1.dex
- /data/data/####/Plugin/net.tt.plugin.skypay/apk/base-1.apk
- /data/data/####/files/net.tt.plugin.myadv.apk
- /sdcard/gooogle/userid.cfg
- /data/data/####/Plugin/net.tt.plugin.skypay/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.mysdk/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.myadv/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.mysdk/apk/base-1.apk
- /data/data/####/shared_prefs/userinfo_file.xml
- /sdcard/com.zckj.files/net.tt.plugin.mysdk
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/Plugin/net.tt.plugin.shangan/apk/base-1.apk
Sets the 'executable' attribute to the following files:
- /sdcard/gooogle/userid.cfg
- /data/data/####/Plugin/net.tt.plugin.yingmei/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.utadv/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.shangan/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.myadv/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.skypay/apk/base-1.apk
Miscellaneous:
Contains functionality to send SMS messages automatically.
