Technical information
Malicious functions:
Sends SMS messages:
- 10698000036592: 8fdacb2b-23b9-484d-8116-1b4cc7cc5494-1496217050931,点击发送直接登录
Network activity:
Connecting to:
- a####.####.com
- h####.####.com
- i####.####.com
- pass####.####.com
- sd####.####.com
- unio####.####.com
- useract####.####.com
- wap####.####.com
HTTP GET requests:
- i####.####.com/cimages/img/18911/18911.jpg
- wap####.####.com/static/appsapi/conf/config.txt?tpl=####&app_version=###...
HTTP POST requests:
- a####.####.com/rest/2.0/channel/3918004645817475520
- h####.####.com/app.gif
- pass####.####.com/v2/sapi/smsgetlogin
- sd####.####.com/game/call
- unio####.####.com/unionsdk/cs
- useract####.####.com/useraction/call
Modified file system:
Creates the following files:
- <Package Folder>/databases/app.db-journal
- <Package Folder>/databases/dk_user.db
- <Package Folder>/databases/dk_user.db-journal
- <Package Folder>/databases/downloads.db-journal
- <Package Folder>/databases/pushstat_4.6.2.db
- <Package Folder>/databases/pushstat_4.6.2.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/account_deb6af019f_eaee204c4efd6b17ed2d3cae607373a2
- <Package Folder>/files/bdp_activity_config
- <Package Folder>/files/bdp_channel
- <Package Folder>/files/bdp_error
- <Package Folder>/files/bdp_pay
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/pUvd0kYHh1cZp68GorgZgyVq__local_last_session.json
- <Package Folder>/files/pUvd0kYHh1cZp68GorgZgyVq__local_stat_cache.json
- <Package Folder>/files/wappass.baidu.com-passport-login.html
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
- <Package Folder>/shared_prefs/bdp_pref.xml
- <Package Folder>/shared_prefs/bdp_pref.xml.bak
- <Package Folder>/shared_prefs/bids.xml
- <Package Folder>/shared_prefs/bindcache.xml
- <Package Folder>/shared_prefs/channelid.xml
- <Package Folder>/shared_prefs/com_dk_shared_preferences.xml
- <Package Folder>/shared_prefs/com_dk_shared_preferences.xml.bak
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/shared_prefs/pst.xml (deleted)
- <Package Folder>/shared_prefs/pst.xml.bak
- <Package Folder>/shared_prefs/sapi_system.xml
- <Package Folder>/shared_prefs/sapi_system.xml.bak
- <SD-Card>/.BD_SAPI_CACHE/####/login.html
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.config
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/baidu/.cuid
- <SD-Card>/duoku/####/18911.jpg
- <SD-Card>/duoku/####/19433.png
- <SD-Card>/duoku/####/adinfo.txt
- <SD-Card>/duoku/####/logoinfo_h5.txt
Miscellaneous:
Executes next shell scripts:
- ls -l /system/bin/su
Contains functionality to send SMS messages automatically.
