Technical information
Malicious functions:
Sends SMS messages:
- 4446: SHNMB 7533 SDK0085NG13805P944J046U914I####ED
Network activity:
Connecting to:
- e####.####.com
- c####.com
- p####.####.com
- i####.####.com
- e####.####.com:9090
HTTP GET requests:
- e####.####.com/sdkcp/push_msgcp_new.jsp?uid=####&comptime=####&cpid=####&Pjid=####&Subid=####&Imei=####&Imsi=####&
- i####.####.com/a/3f6ec4da684547211e371a67946d85757
- e####.####.com/wapbill/Bfeecnf.jsp?uid=####&dangwei=####&chanpid=####&jiqi=####&jid=####&xiangid=####&chuanhao=####&kehuid=####&
- e####.####.com/wapbill/sale_static_newcp.jsp?chanpid=####&ruanid=####&Cptime=####&jiqi=####&net=####&xiangid=####&chuanhao=####&kehuid=####&
- e####.####.com/sdkcp/user_visit_appcp.jsp?uid=####&chanpid=####&Cptime=####&jiqi=####&net=####&xiangid=####&chuanhao=####&kehuid=####&
- c####.com/
- e####.####.com/sdkcp/sub_payquery.jsp?sendtimes=####&model=####&chanpid=####&symbol=####&ruanid=####&sysver=####&jiqi=####&show=####&xiangid=####&send...
- e####.####.com:9090/wapbill/Allfeecnf.jsp?uid=####&plmn=####&chanpid=####&mcc=####&vid=####&xiangid=####&chuanhao=####&kehuid=####&
HTTP POST requests:
- p####.####.com/api/q/a/3f6ec4da684547211e371a67946d85757
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/3f6ec4da684547211e371a67946d85757|account_file.xml
- /data/data/####/shared_prefs/td_pefercen_profile.xml
- /data/data/####/files/mpush_version_preferences_file
- /data/data/####/cache/s.des.apk
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/shared_prefs/shony_global.xml
- /data/data/####/files/playerData
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/mpush_gateway_preferences_file
- /data/data/####/shared_prefs/pref_file.xml.bak
- /data/data/####/shared_prefs/td_pefercen_profile.xml.bak
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml
- /data/data/####/databases/mpush_game.db-journal
- /data/data/####/cache/w.des.apk
- /data/data/####/shared_prefs/pref_file.xml
Miscellaneous:
Contains functionality to send SMS messages automatically.
