Technical information
Malicious functions:
Sends SMS messages:
- 106575206321505460: dyl#null,<IMEI>,6000098-1-214748-ssys_00613-0
- 10691009: @8DYL#null,<IMEI>,6000098-1-214748-ssys_00613-0
- 12114516412: systemcGx1dG8yNTAwMjY2OTkxODc3NDM=
- 12114: HZSY#<IMSI>
Network activity:
Connecting to:
- a####.####.cn
- c####.####.com
- c####.####.com:10101
- col####.####.com
- huangda####.com
- i####.####.cn
- i####.####.com:10003
- mo####.####.com
- p####.####.cn
- p####.####.com
- re####.####.com
- re####.####.com:10002
- s####.####.com
- v####.####.cn
- z####.####.com
HTTP GET requests:
- a####.####.cn/video-app/server/userHelp.html
- c####.####.com/v1/sdk/report?sdk_type=####&sdk_status=####&trade_id=####...
- c####.####.com:10101/v1/order/get?phone=####&imei=####&sdk_version=####&...
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.cn/iplookup/iplookup.php?format=####
- p####.####.com/cityjson?ie=####
- re####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sd...
- re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
- v####.####.cn/Fot1VcawUQFPF1x64cvOZ4ELtcj8-AvatarMiddle
- z####.####.com/m/m72.mp4
HTTP POST requests:
- col####.####.com/pay-data-collect/collectAppStartUserData.json
- i####.####.com:10003/v2/chis
- mo####.####.com/mobile-service/getOpenImsiMobilePhone.json
- p####.####.cn/index.php/API
- s####.####.com/pay-sms-access//uploadOpenPayOrderResult.json?
Modified file system:
Creates the following files:
- <Package Folder>/app_apCoreplugn/####/23uiusfjc.bin
- <Package Folder>/app_apCoreplugn/sinner.apk
- <Package Folder>/app_apCoreplugn/smap.apk
- <Package Folder>/app_apCoreplugn/sms.apk
- <Package Folder>/app_apCoreplugn/sqq.apk
- <Package Folder>/app_apCoreplugn/sweb.apk
- <Package Folder>/app_plugin_dir/####/base-1.apk
- <Package Folder>/app_plugin_dir/####/base-1.dex
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/sinner.apk.apk
- <Package Folder>/cache/smap.apk.apk
- <Package Folder>/cache/sms.apk.apk
- <Package Folder>/cache/sqq.apk.apk
- <Package Folder>/cache/sweb.apk.apk
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/TestinAgent.db
- <Package Folder>/databases/TestinAgent.db-journal
- <Package Folder>/databases/com.core.main.pay.plugmain_sy_pay_record-journal
- <Package Folder>/databases/mp.db
- <Package Folder>/databases/mp.db-journal
- <Package Folder>/databases/recordInfo-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/xUtils_http_cookie.db
- <Package Folder>/databases/xUtils_http_cookie.db-journal
- <Package Folder>/files/####/plus.jar
- <Package Folder>/files/mobclick_agent_cached_<Package>2147483647
- <Package Folder>/shared_prefs/CHECK_VERSION_TIME.xml
- <Package Folder>/shared_prefs/CONFIGS.xml
- <Package Folder>/shared_prefs/FIRST_ENTER_PLAY.xml
- <Package Folder>/shared_prefs/LOGIN_TIME.xml
- <Package Folder>/shared_prefs/PAY_STATUS.xml
- <Package Folder>/shared_prefs/PLAY_COUNT.xml
- <Package Folder>/shared_prefs/PROTOCOL_SHOW.xml
- <Package Folder>/shared_prefs/RECORD_INFOS.xml
- <Package Folder>/shared_prefs/SAFETIPS.xml
- <Package Folder>/shared_prefs/SPEED_UP.xml
- <Package Folder>/shared_prefs/THIRD_STATUS_UPLOAD.xml
- <Package Folder>/shared_prefs/TestinAgent.xml
- <Package Folder>/shared_prefs/UPDATE_VERSION.xml
- <Package Folder>/shared_prefs/USER_EXTRA_INFO.xml
- <Package Folder>/shared_prefs/USER_OPEN_COUNT.xml
- <Package Folder>/shared_prefs/com.core.main.pay.plugmain_p_config.xml
- <Package Folder>/shared_prefs/com.souying.pay.xml
- <Package Folder>/shared_prefs/cpMsg.xml
- <Package Folder>/shared_prefs/device_id.xml.xml
- <Package Folder>/shared_prefs/getFlag.xml
- <Package Folder>/shared_prefs/plugins.installed.xml
- <Package Folder>/shared_prefs/plugins.serviceMapping.xml
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/signUpload.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml.bak
- <Package Folder>/shared_prefs/twc.xml
- <Package Folder>/shared_prefs/twc.xml.bak
- <Package Folder>/shared_prefs/umengEnable.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/userInfo.xml
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3001_2274.zip
- <SD-Card>/Android/####/-1268207648.tmp
- <SD-Card>/Android/####/-1433934119.tmp
- <SD-Card>/Android/####/-1457839936.tmp
- <SD-Card>/Android/####/-147419963.tmp
- <SD-Card>/Android/####/-1698354776.tmp
- <SD-Card>/Android/####/-1741023183.tmp
- <SD-Card>/Android/####/-1841618321.tmp
- <SD-Card>/Android/####/-1952831884.tmp
- <SD-Card>/Android/####/-24037258.tmp
- <SD-Card>/Android/####/-243360246.tmp
- <SD-Card>/Android/####/-350763275.tmp
- <SD-Card>/Android/####/-58190579.tmp
- <SD-Card>/Android/####/-67389520.tmp
- <SD-Card>/Android/####/-67970597.tmp
- <SD-Card>/Android/####/-781822830.tmp
- <SD-Card>/Android/####/-812369691.tmp
- <SD-Card>/Android/####/-813633533.tmp
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1235034122.tmp
- <SD-Card>/Android/####/1268139851.tmp
- <SD-Card>/Android/####/135907032.tmp
- <SD-Card>/Android/####/143246314.tmp
- <SD-Card>/Android/####/1458132409.tmp
- <SD-Card>/Android/####/1470231709
- <SD-Card>/Android/####/1505132456.tmp
- <SD-Card>/Android/####/1898151556.tmp
- <SD-Card>/Android/####/1971445410
- <SD-Card>/Android/####/1978821443.tmp
- <SD-Card>/Android/####/2088874381.tmp
- <SD-Card>/Android/####/233425421.tmp
- <SD-Card>/Android/####/298978873.tmp
- <SD-Card>/Android/####/334446035.tmp
- <SD-Card>/Android/####/365245048.tmp
- <SD-Card>/Android/####/510337057.tmp
- <SD-Card>/Android/####/617565282.tmp
- <SD-Card>/Android/####/868112325.tmp
- <SD-Card>/Android/####/911312921.tmp
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
Contains functionality to send SMS messages automatically.
