Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.269.origin
Network activity:
Connecting to:
- upl####.####.com
- h####.####.com
- w####.####.com:9002
- p####.####.com
- c####.####.com
- d####.####.com
- w####.####.com
- y####.com
- i####.####.cn
- a####.####.com
HTTP GET requests:
- h####.####.com/hm.js?a02de45####
- upl####.####.com/image/57edfcbf386da.png
- upl####.####.com/image/584a70ed22d64.png
- upl####.####.com/image/57c799c34d922.png
- upl####.####.com/image/57c7c43a209b1.jpg
- upl####.####.com/image/57c79a2ca300d.png
- upl####.####.com/image/57c79a0268174.png
- upl####.####.com/image/589bbcf764bb4.jpg
- upl####.####.com/image/589bbc67966db.jpg
- upl####.####.com/image/57c7c403b8eec.jpg
- upl####.####.com/image/57c97506cdd3a.jpg
- i####.####.cn/iplookup/iplookup.php?format=####
- upl####.####.com/image/57c79a3c7cb03.png
- upl####.####.com/image/57c7c4197ca4f.jpg
- upl####.####.com/image/57c7a9e2a24be.png
- upl####.####.com/image/57c799dad1826.png
- p####.####.com/ex?i=####
- upl####.####.com/image/57c7c1a8df223.png
- p####.####.com/ecbm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&coa=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=###...
- upl####.####.com/image/57c7c1b9622ab.png
- upl####.####.com/image/57c7abb13c004.png
- upl####.####.com/image/583d4c086804f.png
- w####.####.com/?bid=####
- upl####.####.com/image/57c79a0a91f9f.png
- upl####.####.com/image/57c799e6591aa.png
- d####.####.com/?channel=####
- upl####.####.com/image/5808297a0b416.png
- upl####.####.com/image/58082a6d63779.png
- upl####.####.com/image/57c799f06c8e9.png
- upl####.####.com/image/57c78f360a1cb.png
- d####.####.com/static/js/jquery-1.8.3.min.js
- p####.####.com/ecbm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- upl####.####.com/image/57c799fa2ae91.png
- upl####.####.com/image/57c7c17fb23b9.png
- upl####.####.com/image/57c773c1a31cc.png
- upl####.####.com/image/57c7c13fe17c6.png
- upl####.####.com/image/58082a8752354.png
- p####.####.com/ecbm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- upl####.####.com/image/57c974e39ef29.png
- upl####.####.com/image/582bbb22c317d.png
- h####.####.com/hm.gif?pid=####&channel=####&name=####&url=####&rnd=####
- w####.####.com/web/sl?bid=####&keyword=####
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####
- d####.####.com/static/css/style.css
- upl####.####.com/image/57c974cec6bd1.png
- upl####.####.com/image/57c7c16f1f400.png
- c####.####.com/cpro/ui/cm.js
- w####.####.com/resource/static/view/index/index_12a71c3.css
- upl####.####.com/image/57c7c35fa3445.jpg
- upl####.####.com/image/57c7aaca357d4.png
- upl####.####.com/image/57c7ad844d547.png
- upl####.####.com/image/57c799cbde376.png
- upl####.####.com/image/589bbc9642fb3.jpg
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####
- upl####.####.com/image/57c97480d8fa6.jpg
- w####.####.com/resource/static/js/index/index_68cd1b7.js
- d####.####.com/static/js/page.js
- upl####.####.com/image/57ca42034be01.png
- upl####.####.com/image/57c970ff7d83f.jpg
- a####.####.com/t/tanxmobile/tanxssp.js?_v=####
- h####.####.com/hm.js?1####
- upl####.####.com/image/581aaf4077dd5.jpg
- p####.####.com/ecbm?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=###...
- upl####.####.com/image/586075dc5de0b.png
- upl####.####.com/image/584f4cbe4c16d.png
- upl####.####.com/image/58082a41e78fb.png
- upl####.####.com/image/57c7c153983c2.png
HTTP POST requests:
- w####.####.com/api/getCfg.jsp
- w####.####.com/api/uploadInstallApps.jsp
- w####.####.com/api/getInAppFull.jsp
- w####.####.com/api/getDtk.jsp
- w####.####.com/api/getLauncher.jsp
- y####.com/cu.ashx
- w####.####.com/api/getSI.jsp
- w####.####.com/api/getFallDown.jsp
- w####.####.com/api/getFloat.jsp
- w####.####.com/api/getStartPop.jsp
- w####.####.com:9002/api/getSht.jsp
- w####.####.com/api/uploadSaleInfo.jsp
- w####.####.com/api/getAreaId.jsp
- w####.####.com/api/getInAppFloat.jsp
- w####.####.com/api/getSlidingScreen.jsp
- w####.####.com/api/getStartNonFull.jsp
- w####.####.com/api/getStartDialog.jsp
- w####.####.com/api/getStartFull.jsp
- w####.####.com/api/getAlist.jsp
- w####.####.com/api/getSht.jsp
- w####.####.com/api/getInAppNonFull.jsp
- w####.####.com/api/getNotification.jsp
- w####.####.com/api/getExit.jsp
- w####.####.com/api/getStartWin.jsp
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/online.xml.bak
- /sdcard/Android/data/system/cache/.hb/insifhbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /sdcard/Android/data/system/cache/.hb/exthbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/f_000001
- /sdcard/Android/data/system/cache/.hb/sdhm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /sdcard/Android/data/system/cache/.hb/swhm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/insiohbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/areaInfo.xml
- /sdcard/Android/data/system/cache/.hb/ntbhbm_l_hb_t
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/pp.xml
- /sdcard/Android/data/system/cache/.hb/snfhm_l_hb_t
- /data/data/####/shared_prefs/localtime.xml.bak
- /sdcard/Android/data/system/cache/.hb/DtkAdbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/cfghbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/sfhm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/fhbm_l_hb_t
- /data/data/####/shared_prefs/pp.xml.bak
- /sdcard/Android/data/system/cache/.hb/sdhbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/IUhbm_l_hb_t
- /sdcard/Android/data/system/cache/.hb/lauhbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/shared_prefs/localtime.xml
- /data/data/####/biz_close.jar
- /data/data/####/shared_prefs/online.xml
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/shared_prefs/device.xml
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/databases/baidu_cee-journal
- /data/data/####/databases/favorite.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/databases/webview.db-journal
- /sdcard/Android/data/system/cache/.hb/falhbm_l_hb_t
- /sdcard/device
- /sdcard/Android/data/system/cache/.hb/sihm_l_hb_t
- /data/data/####/files/80.tmp
- /sdcard/Android/data/system/cache/.hb/sihbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /sdcard/Android/data/system/cache/.hb/insiwfhbm_l_hb_t
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Contains functionality to send SMS messages automatically.
