Technical information
Malicious functions:
Sends SMS messages:
- 12114516420: <IMSI>
Network activity:
Connecting to:
- 1####.####.226
- 1####.####.226:8002
- 1####.####.238
- 7j####.####.com
- a####.####.com
- and####.####.com
- and####.####.com:8077
- c-h####.####.com
- huangda####.com
- i####.####.cn
- i####.####.com:10003
- iji####.com
- m####.####.com
- p####.####.com
- re####.####.com:10002
- s####.####.com
- v####.####.com
- w####.####.com
HTTP GET requests:
- 1####.####.238/dex/ldsource.bin
- 7j####.####.com/tdata_Gct942
- a####.####.com/fetch.php?gid=####&ch=####&key=####
- a####.####.com/location/ip?ak=####&mcode=####
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- i####.####.cn/iplookup/iplookup.php?format=####
- iji####.com/qsxa/iploc/get_ip
- m####.####.com/course/504703.html?cm=####
- p####.####.com/cityjson?ie=####
- re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
- s####.####.com/config/hz-hzv3.conf
- v####.####.com/version/tcmn/app/mmplay
- w####.####.com/r/378609775/378609778/index.htm?cm=####
HTTP POST requests:
- 1####.####.226/api/sl/vcoderule/getvalid
- 1####.####.226:8002/api/qxt/tel/get
- and####.####.com/record-plat/msg/strategy/query.do
- and####.####.com:8077/android/sms/netpay/prefetch.do
- c-h####.####.com/api.php?format=####&t=####
- i####.####.com:10003/v2/chis
- s####.####.com/api.php?format=####&t=####
- v####.####.com/api/payment/updateInit
Modified file system:
Creates the following files:
- <Package Folder>/app_Wyzf_plg/5.0.7.jar
- <Package Folder>/app_dex/classes.jar
- <Package Folder>/app_workbench76426/apk.zip
- <Package Folder>/app_workbench81952/apk.zip
- <Package Folder>/cache/####/-1041073581-725745144
- <Package Folder>/cache/####/-1068573379-1184142096
- <Package Folder>/cache/####/-1151921718-1634960416
- <Package Folder>/cache/####/-1880205299-280587161
- <Package Folder>/cache/####/-289127285521454655
- <Package Folder>/cache/####/-38908455-2028071639
- <Package Folder>/cache/####/-7108262311437499599
- <Package Folder>/cache/####/-9571393181437499599
- <Package Folder>/cache/####/15474364822036111375
- <Package Folder>/cache/####/1792313716-725745144
- <Package Folder>/cache/####/18535536631287924584
- <Package Folder>/cache/####/1995736170521454655
- <Package Folder>/cache/####/575306583454497158
- <Package Folder>/cache/####/7260375671742562742
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/Data_sync.db-journal
- <Package Folder>/databases/increment.db-journal
- <Package Folder>/databases/pushext.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/databases/smspay20723719.db
- <Package Folder>/databases/smspay20723719.db-journal
- <Package Folder>/databases/tmpd8.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/plus.jar
- <Package Folder>/files/gdaemon_20161017
- <Package Folder>/files/init.pid
- <Package Folder>/files/libabc
- <Package Folder>/files/mobclick_agent_cached_<Package>3
- <Package Folder>/files/noend.ini
- <Package Folder>/files/push.pid
- <Package Folder>/files/run.pid
- <Package Folder>/files/tdata_nlh657.jar
- <Package Folder>/files/tdata_nlh657.tmp
- <Package Folder>/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
- <Package Folder>/shared_prefs/BOOT_SMS_INFO.xml
- <Package Folder>/shared_prefs/BOOT_SMS_SENT_TIME.xml
- <Package Folder>/shared_prefs/DB_MTS.xml
- <Package Folder>/shared_prefs/QugouUser.xml
- <Package Folder>/shared_prefs/QugouUserTag.xml
- <Package Folder>/shared_prefs/VistorNo.xml
- <Package Folder>/shared_prefs/dispatch_log.xml
- <Package Folder>/shared_prefs/first_pref.xml
- <Package Folder>/shared_prefs/first_register.xml
- <Package Folder>/shared_prefs/jmsdk.dat.xml
- <Package Folder>/shared_prefs/mgsdkfin1.xml
- <Package Folder>/shared_prefs/mgsdkfin1.xml.bak
- <Package Folder>/shared_prefs/plugin_record_app_info.xml
- <Package Folder>/shared_prefs/pref_recomm.xml
- <Package Folder>/shared_prefs/pref_recomm.xml.bak
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/sp_name_config20723719.xml
- <Package Folder>/shared_prefs/tpservices.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/version.dat.xml
- <Package Folder>/shared_prefs/wyzf_config20723719.xml
- <Package Folder>/shared_prefs/wyzf_config20723719.xml.bak
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.sjpm42A1526791324A26FE6F1AC568u/####/0cs3k24342653r9akr8db81r48n00j0k
- <SD-Card>/.sjpm42A1526791324A26FE6F1AC568u/####/ks295bsrm7l5135y9sc5hb83nu239a68
- <SD-Card>/.sjpm42A1526791324A26FE6F1AC568u/####/r2d68pi89s48u3mlb1f02e41duyhg660
- <SD-Card>/.sjpm42A1526791324A26FE6F1AC568u/user.sys
- <SD-Card>/.tpservice/####/qsha_80001_5096.jar
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3003_2270.zip
- <SD-Card>/<Package>/####/TYDSETTING
- <SD-Card>/<Package>/####/f42a2f3be7be22d7413a108337d7f9e0
- <SD-Card>/libs/<Package>.db
- <SD-Card>/libs/app.db
- <SD-Card>/libs/com.getui.sdk.deviceId.db
- <SD-Card>/libs/com.igexin.sdk.deviceId.db
- <SD-Card>/system/####/tdata_nlh657
Miscellaneous:
Executes next shell scripts:
- /data/data/taijiayuan.zhejiangzhisheng.qianshixunai1/files/gdaemon_20161017 0 taijiayuan.zhejiangzhisheng.qianshixunai1/com.igexin.sdk.PushService 27222 300 0
- <dexopt>
- cat /sys/block/mmcblk0/device/cid
- chmod 700 /data/data/taijiayuan.zhejiangzhisheng.qianshixunai1/files/gdaemon_20161017
- chmod 700 <Package Folder>/files/gdaemon_20161017
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 27222 300 0
