Technical information
Malicious functions:
Sends SMS messages:
- 10658000: QNBSJB
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- p####.####.com:8080
- o91vx####.####.com
- p####.####.com
- oa5cv####.####.com
- 1####.####.91
- 1####.####.91:8080
- 1####.####.147:8080
- a####.####.com
- 1####.####.147
HTTP GET requests:
- 1####.####.147/xmld/HttpService!service?paramMap=####
- 1####.####.91/mm/HttpService!service?paramMap=####
- p####.####.com:8080/sdk/spaycoredex_so_1970.jar
- 1####.####.91:8080/mm/HttpService!service?paramMap=####
- p####.####.com/sdk/dp_1.5.0.jar
- p####.####.com/ADicon/ic_tcsy.png
- oa5cv####.####.com/ic_jmapp.png
- oa5cv####.####.com/ic_mmzbuowrw.png
- oa5cv####.####.com/ic_huobao.png
- o91vx####.####.com/q300042.apk
HTTP POST requests:
- a####.####.com/app_logs
- 1####.####.147/xmld/HttpService
- 1####.####.147:8080/xmld/HttpService
Modified file system:
Creates the following files:
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/app_process_lock/2965396851459.21
- <Package Folder>/databases/xUtils_http_cookie.db
- <Package Folder>/app_process_lock/1122127182532.45
- <Package Folder>/app_process_lock/261204690045.695
- <Package Folder>/app_process_lock/261204690541.996
- <Package Folder>/app_process_lock/690274310025.877
- <Package Folder>/app_process_lock/2325801431869.79
- <Package Folder>/app_process_lock/1122127182503.97
- <Package Folder>/app_process_lock/2965396850062.87
- <Package Folder>/app_process_lock/690274311237.071
- <Package Folder>/app_process_lock/524145.397123729
- <Package Folder>/app_process_lock/1122127182901.67
- <Package Folder>/app_process_lock/668260.464978357
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/databases/cc.db
- <Package Folder>/app_process_lock/161.918512514603
- <Package Folder>/app_process_lock/524145.096669153
- <Package Folder>/app_process_lock/1122127182619.95
- <Package Folder>/app_process_lock/2965396851523.59
- <Package Folder>/files/.umeng/exchangeIdentity.json
- <Package Folder>/app_process_lock/690274309346.043
- <Package Folder>/app_process_lock/1122127182348.92
- <Package Folder>/app_process_lock/2965396850472.62
- <Package Folder>/app_process_lock/1122127182877.31
- <Package Folder>/shared_prefs/pay.xml
- <Package Folder>/app_process_lock/2325801433425.83
- <Package Folder>/databases/xUtils_http_cache.db
- <Package Folder>/app_process_lock/2325801433998.29
- <Package Folder>/app_process_lock/2325801436288.92
- <Package Folder>/app_process_lock/852048.333815873
- <Package Folder>/app_process_lock/261204689872.545
- <Package Folder>/app_process_lock/261204690220.45
- <Package Folder>/files/exid.dat
- <Package Folder>/app_process_lock/2325801440369.9
- <Package Folder>/app_process_lock/690274308714.325
- <Package Folder>/databases/ua.db
- <Package Folder>/app_process_lock/2325801439902.7
- <Package Folder>/app_process_lock/1122127182940.36
- <Package Folder>/app_process_lock/2965396851617.12
- <Package Folder>/app_process_lock/261204691000.32
- <Package Folder>/app_process_lock/2965396851625.83
- <Package Folder>/app_process_lock/261204690284.741
- <Package Folder>/app_process_lock/261204690531.627
- <Package Folder>/files/.imprint
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/app_process_lock/2965396850779.11
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/app_process_lock/690274308256.75
- <Package Folder>/app_process_lock/261204690947.85
- <Package Folder>/databases/xUtils_http_cache.db-journal
- <Package Folder>/app_process_lock/2965396850547.88
- <Package Folder>/app_process_lock/1122127182937.06
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/app_process_lock/690274309998.476
- <Package Folder>/databases/xUtils_http_cookie.db-journal
- <Package Folder>/app_process_lock/2325801436196.59
- <Package Folder>/app_payload_odex/<Package>.jar
- <Package Folder>/app_process_lock/690274311098.41
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/app_process_lock/690274309176.142
- <Package Folder>/app_process_lock/2325801430328.04
- <Package Folder>/app_process_lock/668266.292786374
Miscellaneous:
Executes next shell scripts:
- app_process /system/bin com.android.commands.pm.Pm install -r /system/app/com.wwwx.onlyou.apk
- su
- <su-internal:result>
- sh
- <su-internal:request>
- chmod 644 /system/app/com.wwwx.onlyou.apk
- <dexopt>
- cp /storage/emulated/0/Android/com.wwwx.onlyou.apk /system/app/
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
