Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.1848.origin
Network activity:
Connecting to:
- t####.####.com
- p####.####.com:9000
- i####.####.com
- 1####.####.111:8001
- 1####.####.111
- o####.####.com
- p####.####.com
- 1####.####.238:8977
- w####.####.com
- 1####.####.238
- 1####.####.242
- y####.com
- m####.####.com
- 1####.####.242:8080
- a####.####.com
HTTP GET requests:
- y####.com/TLimages2009/yesky/js/jquery-1.7.2.min.js
- y####.com/TLimages2009/yesky/wap/swiper.min.css
- y####.com/TLimages2009/yesky/js/swiper.js
- w####.####.com/pic/
- m####.####.com/get139.php?apiKey=####&imsi=####
- t####.####.com/cc/json/mobile_tel_segment.htm?tel=####
- 1####.####.238/dex/version.txt
- 1####.####.238/dex/ldsource.bin
- 1####.####.111/GetMobile/MatchingMobile.aspx?IMSI=####&IMEI=####&TimeSta...
- y####.com/TLimages2009/yesky/wap/tupianshouye.css
- a####.####.com/query/?datatype=####&token=####
- i####.####.com/getip.aspx
- y####.com/TLimages2009/yesky/js/tiaozhuanyemian.js
- 1####.####.238:8977/dex/version.txt
- y####.com/TLimages2009/yesky/js/iscroll.js
- 1####.####.111:8001/GetMobile/MatchingMobile.aspx?IMSI=####&IMEI=####&Ti...
- p####.####.com:9000/versionpatch?updVersion=####&crc32=####&version=####...
- y####.com/TLimages2009/yesky/js/add_adv.js
- y####.com/TLimages2009/yesky/js/counter/web-utils.js
HTTP POST requests:
- p####.####.com/sdkMis/sdk-update
- 1####.####.242:8080/pay/servlet/UploadPhoneInfo2
- o####.####.com/check_config_update
- a####.####.com/app_logs
- 1####.####.242/pay/servlet/GetThirdInfo2
- 1####.####.242/pay/servlet/UploadPhoneInfo2
Modified file system:
Creates the following files:
- /data/data/####/baea/tmb.jar
- /data/data/####/shared_prefs/b_share.xml
- /data/data/####/shared_prefs/ma_data.xml
- /data/data/####/shared_prefs/setting.xml
- /data/data/####/app_dexlm/classes.jar
- /data/data/####/shared_prefs/ma_call.xml
- /data/data/####/shared_prefs/edition.xml
- /data/data/####/databases/cc/cc.db
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/jmsdk.dat.xml
- /data/data/####/shared_prefs/new_vvsion.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/aaa_online_setting_####.xml
- /data/data/####/shared_prefs/nnt_data.xml
- /data/data/####/shared_prefs/zzconfig.xml
- /data/data/####/shared_prefs/aaa_state_####.xml.bak
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/files/plugin.apk
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/version.dat.xml
- /data/data/####/shared_prefs/jmsdk.dat.xml.bak
- /data/data/####/shared_prefs/tools.xml.bak
- /data/data/####/databases/bil_db-journal
- /data/data/####/files/libexecmain.so
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/aaa_state_####.xml
- /data/data/####/app_tongyu/plugins/tongyu-pay-lib.apk
- /data/data/####/shared_prefs/tools.xml
- /data/data/####/databases/MA_epay_db
- /data/data/####/shared_prefs/b_setting.xml
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/databases/zpay_db-journal
- /data/data/####/baea/entrance.jar
- /data/data/####/databases/zpay_db
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/aaa_header_####.xml
- /data/data/####/files/libexec.so
- /data/data/####/databases/bil_db
- /data/data/####/databases/MA_epay_db-journal
Miscellaneous:
Executes next shell scripts:
- getprop ro.product.cpu.abi
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- cat /sys/class/net/wlan0/address
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
