Technical information
Malicious functions:
Sends SMS messages:
- 12114: HZSY#<IMSI>
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- sm####.####.com
- re####.####.com
- re####.####.com:10002
- mobil####.####.com
- p####.####.com
- i####.####.com:10003
- 3####.####.29
- huangda####.com
- collec####.####.com
HTTP GET requests:
- p####.####.com/cityjson?ie=####
- re####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sd...
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
- sm####.####.com/pay-data-collect/collectAppStartUserData.json
- collec####.####.com/pay-data-collect/uploadChannelNormalData.json
HTTP POST requests:
- mobil####.####.com/mobile-service/getOpenImsiMobilePhone.json
- 3####.####.29/channel/paymentHandle.action?v=####&requestId=####
- i####.####.com:10003/v2/chis
Miscellaneous:
Executes next shell scripts:
- getprop
- cat /sys/block/mmcblk0/device/cid
- <dexopt>
- cat /proc/version
Contains functionality to send SMS messages automatically.
