Technical information
Malicious functions:
Sends SMS messages:
- 15595005292: i2mPNk1AOWWu6IO69LttHIXkg==
Network activity:
Connecting to:
- 1####.####.111
- 1####.####.111:8001
- a####.####.com
- c####.####.com
- c####.####.net
- d####.####.com
- en####.####.cn
- f####.####.com
- g####.####.cn
- h####.####.com
- i####.####.cn
- i####.####.net
- l####.####.com
- lx-uplo####.####.com
- m####.####.com
- nvren####.net
- o####.####.com
- p####.####.com
- pco####.####.com
- ping####.####.com
- qzones####.####.cn
- r####.####.com
- s####.####.com
- s####.####.com:36800
- static####.####.com
- t####.####.com
- ta####.com
- ut####.cn
- ut####.cn:8080
- v####.####.com
- w####.####.cn
- w####.####.com
- wo####.####.cn
- x####.####.com
- x####.####.net
- y####.####.cn
- z####.####.com
HTTP GET requests:
- 1####.####.111/APP/GetFeePoint.aspx
- 1####.####.111:8001/APP/AppTask.aspx
- a####.####.com/t/tanxmobile/tanxssp.js?_v=####
- c####.####.com/9.gif?abc=####&rnd=####
- c####.####.com/?dspid=####&dspuid=####&gettuid=####
- c####.####.com/core.php?web_id=####&t=####
- c####.####.com/cpro/ui/dm.js
- c####.####.com/cpro/ui/uijs.php?en=####&c=####&fv=####&itm=####&kdi0=###...
- c####.####.com/js/m.js
- c####.####.com/report/report?strValue=####&nValue=####&tag=####&t=####
- c####.####.com/t/acookie/acbeacon2.html
- c####.####.com/tencent?tuid=####&ver=####
- c####.####.net/pixel?google_nid=####&google_cm=####&google_tc=####
- d####.####.com/spf?e=####&u=####&k=####&tanxssp_t=####
- en####.####.cn/api/v1/activity/get4web?request_id=####&app_key=####&adsl...
- f####.####.com/it/u=1307605659,1926006417&fm=76
- g####.####.cn/wap/js/wp.js
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln...
- i####.####.cn/s/uae/g/0s/tag_yun/tag_yun.js
- i####.####.net/d.js?RSI####
- l####.####.com/t.gif?cna=####&cache=####
- lx-uplo####.####.com/monitor/redirect/HEOuelSp6p3FfWFFhcu18Tz9FX-nQZDuHz...
- m####.####.com/?sprefer=####
- nvren####.net/yidian/index_files/15.jpg
- o####.####.com/wap?i=####&cb=####&callback=####&userid=####&o=####&f=###...
- p####.####.com/ccom?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- p####.####.com/ex?i=####
- p####.####.com/wap/js/wp.js
- pco####.####.com/app.gif?&cna=####
- ping####.####.com/pingd?cc=####&ct=####&java=####&lang=####&pf=####&scl=...
- qzones####.####.cn/qzone/openapi/qc-1.0.1.js
- r####.####.com/hm.gif?requesturl=####&_cid=####&_slot=####&_dmac=####&_u...
- s####.####.com/cfs/get?platform=####&screenColorDepth=####&language=####...
- s####.####.com/stat.php?id=####
- static####.####.com/ssps/a.js
- t####.####.com/wap/images/wap_txt_1.png
- ta####.com/
- v####.####.com/sj.asp?action=####&loc=####
- w####.####.cn/css/style.css
- w####.####.com/adx.php?c=####
- wo####.####.cn/wolongtanx_impress?p=####&b=####&tanxssp_t=####
- x####.####.com/ask?id=####&cb=####&ssi0=####&wsg=####&_v=####
- x####.####.net/frqctrl.html
- y####.####.cn/h5-tuia/media/media-1.0.0.min.js
- z####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&...
HTTP POST requests:
- s####.####.com/cfgplan.action
- s####.####.com:36800/cfgplan.action
- ut####.cn/excalibur/avalon/sdk/pay.aspx
- ut####.cn:8080/excalibur/avalon/sdk/init.aspx
Modified file system:
Creates the following files:
- <Package Folder>/app_dex/utopay.jar
- <Package Folder>/cache/####/1496869337948
- <Package Folder>/cache/####/1496869339673
- <Package Folder>/cache/####/1496869340359
- <Package Folder>/cache/####/1496869341045
- <Package Folder>/cache/####/1496869341766
- <Package Folder>/cache/####/1496869342464
- <Package Folder>/cache/####/1496869343135
- <Package Folder>/cache/####/1496869343814
- <Package Folder>/cache/####/1496869344495
- <Package Folder>/cache/####/1496869345167
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/index
- <Package Folder>/databases/sms_db
- <Package Folder>/databases/sms_db-journal
- <Package Folder>/databases/utopay.db
- <Package Folder>/databases/utopay.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/mj.apk
- <Package Folder>/files/mobclick_agent_cached_<Package>1
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/WebViewSettings.xml
- <Package Folder>/shared_prefs/mlib.xml
- <Package Folder>/shared_prefs/pluginLib.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/Android/####/.UUID
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- getprop apps.customerservice.device
Contains functionality to send SMS messages automatically.
