Technical information
Malicious functions:
Sends SMS messages:
- 1065-71090-88877: 99#<IMSI>#android#doudou_2
Network activity:
Connecting to:
- r####.####.cn
- t####.####.cn
- i####.####.cn
- h####.####.com
HTTP GET requests:
- h####.####.com/h.js?0807807####
- i####.####.cn/img/cs/zone/deliver_note.gif
- i####.####.cn/img/cs/tx/mobile_login.gif
- i####.####.cn/img/tx/home/logo.gif
- t####.####.cn/kf/cs/ask.do?z=####
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln...
- t####.####.cn/forum/threadDetail.do?fid=####&tid=####&cfrom=####
- t####.####.cn/kf/cs/index.do?z=####
- i####.####.cn/img/tx/icon/daohang/frind.gif
- i####.####.cn/img//cs/tx/alarm.gif
- i####.####.cn/img/tx/logos/league.gif
- t####.####.cn/in/fltin_t.jsp?z=####&type=####&returl=####
- i####.####.cn/img/tx/icon/daohang/game.gif
- i####.####.cn/img/tx/logos/l_kf.gif
- i####.####.cn/img/tx/icon/daohang/talk.gif
- t####.####.cn/in/guest.do?returl=####
- t####.####.cn/in/login.do?kid=####&type=####&cfrom=####
- i####.####.cn/img/tx/icon/daohang/life.gif
- t####.####.cn/kf/cs/faqdetail.do?id=####
- r####.####.cn/api/c/ad/10240?uid=####&ip=####&imsi=####&width=####
- t####.####.cn/in/regist1.do?kid=####&cfrom=####
- t####.####.cn/in/fltregimg.jsp?imgid=####
- i####.####.cn/img/tx/book/read/gonggao.gif
- t####.####.cn/
- t####.####.cn/in/fltin_t.jsp?type=####
- i####.####.cn/img/login/QQ.png
- i####.####.cn/img/cs/space/scratch.gif
- i####.####.cn/img/cs/tx/search_help.gif
- i####.####.cn/img/cs/tx/key.gif
- i####.####.cn/img/cs/tx/up.gif
- t####.####.cn/space/index.do?uid=####
- i####.####.cn/img/cs/tx/down.gif
- i####.####.cn/img/css/skin1/tx.wapCSS.1.2.css
- i####.####.cn/img/cs/tx/help_online.gif
- i####.####.cn/img/css/skin2/tx.wapCSS.1.2.css
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja...
- t####.####.cn/love/cs/index.do?z=####&from=####
HTTP POST requests:
- t####.####.cn/in/cs/login.do?type=####
Modified file system:
Creates the following files:
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Contains functionality to send SMS messages automatically.
