Technical information
Malicious functions:
Sends SMS messages:
- 4446: MCN GPAY1 57ad65c2401830ac 2 2GMKOH750FNC5DA9000013 1 2GMKOH750F JPE2N8JKNDSK CTIHO
- 4449: MCN GPAY2 57ad65c2401830ac 1 2GMKOH750FNC5DA9000013 0 2GMKOH750F JPE2N8JKNDSK CTIHO
Executes code of the following detected threats:
- Android.Mobifun.3.origin
- Android.Mobifun.5.origin
Downloads the following detected threats from the Web:
- Android.Mobifun.3.origin
- Android.Mobifun.5.origin
Network activity:
Connecting to:
- a####.####.com
- andro####.####.com
- st####.####.com
HTTP GET requests:
- a####.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####&vendor=#...
- st####.####.com/app/172/b/RU/3_OGZMJM.json
- st####.####.com/sdk/70/5822db30a941b.zip
HTTP POST requests:
- andro####.####.com/android/check_version?commonk####
Modified file system:
Creates the following files:
- <Package Folder>/.gpcache/gpmpclasses.jar
- <Package Folder>/databases/du_ad_ts.db-journal
- <Package Folder>/databases/google_analytics_v2.db-journal
- <Package Folder>/files/####/gpay_res.apk
- <Package Folder>/files/AdIdsFile
- <Package Folder>/files/AdIdsFile.rlck
- <Package Folder>/files/AdIdsFile.wlck
- <Package Folder>/files/a96dc31a99__local_last_session.json
- <Package Folder>/files/a96dc31a99__local_stat_cache.json
- <Package Folder>/files/account_a96dc31a99_34cd6598e5ddccc839c505f7fded762d
- <Package Folder>/files/charge_a96dc31a99_34cd6598e5ddccc839c505f7fded762d
- <Package Folder>/files/db2.jar
- <Package Folder>/files/gaClientId
- <Package Folder>/files/gpmpsdk.so
- <Package Folder>/files/libcuid.so
- <Package Folder>/shared_prefs/.config_file.xml
- <Package Folder>/shared_prefs/.config_file.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/CountryInfo.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/_toolbox_prefs.xml
- <Package Folder>/shared_prefs/_toolbox_prefs.xml.bak
- <Package Folder>/shared_prefs/_toolbox_prefs.xml.bak (deleted)
- <Package Folder>/shared_prefs/a000312.xml
- <Package Folder>/shared_prefs/gpsetting.xml
- <Package Folder>/shared_prefs/gsetting.xml
- <Package Folder>/shared_prefs/item.xml
- <Package Folder>/shared_prefs/mpsetting.xml
- <Package Folder>/shared_prefs/payitem_2.xml
- <Package Folder>/shared_prefs/sms.xml
- <SD-Card>/.Android/####/AHKYYJTKTK.bin
- <SD-Card>/.Android/####/update_172.zip
- <SD-Card>/.public/trxsn.lock
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/PluginFile.rlck
- <SD-Card>/Android/####/SharedPayFile.bak
- <SD-Card>/Android/####/SharedPayFile.rlck
- <SD-Card>/Android/####/SharedPayFile.wlck
- <SD-Card>/Android/####/plugin_lock
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/backups/####/.timestamp
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- cat /proc/cpuinfo
- ps adbd
- ps logcat
Contains functionality to send SMS messages automatically.
