Technical information
Malicious functions:
Sends SMS messages:
- 1069099952520: mly-caeeff11
Network activity:
Connecting to:
- 2####.####.140
- 1####.####.80:8000
- 2####.####.140:8080
- g####.####.net
- g####.####.net:8080
- sd####.####.com
- 1####.####.80
- w####.####.com:7758
- d####.####.com
- w####.####.com
- 1####.####.211
HTTP GET requests:
- d####.####.com/egsb/otherPay/querySMSLimitMoney
- d####.####.com/egsb/startup/queryConfiguration?channelId=####&contentId=####&gameType=####
- 1####.####.211/websdk/exception?playerId=####&gameId=####&channelId=####&device=####&appVersionName=####&appVersionCode=####&sdkVersionName=####&sdkVe...
- 1####.####.211/websdk/getExtraAll?tag=####&imsi=####
HTTP POST requests:
- 2####.####.140:8080/migusdk/tl/enclog
- 1####.####.211/
- sd####.####.com/behaviorLogging/eventLogging/accept?
- d####.####.com/egsb/verification/checkSdkUpdate
- g####.####.net:8080/migusdk/tl/tcttl
- w####.####.com/normandie/QueryConfigPolicy
- 1####.####.211/websdk/updateSms
- 2####.####.140/migusdk/tl/enclog
- 1####.####.80:8000/intp/523300384d314685d3317e4466612ce22d2937f8
- d####.####.com/egsb/otherPay/querySMSInterceptorConf
- d####.####.com/egsb/gshare/switches
- g####.####.net/migusdk/verification/checkSdkUpdate
- 1####.####.80/intp/523300384d314685d3317e4466612ce22d2937f8
- d####.####.com/egsb/game/getPaymentCapability
- w####.####.com:7758/normandie/QueryConfigPolicy
- d####.####.com/egsb/thirdPay/queryThirdPayInfo
Modified file system:
Creates the following files:
- /data/data/####/files/edfile/armeabi/libmiguED.so
- /data/data/####/files/mgid.dat
- /data/data/####/files/MiguPay.Sdk30.Lib_12003003_db5cfe073edefa9a18774d01d2a4bce7_BN202.dat
- /data/data/####/files/sdk_prefs
- /data/data/####/files/mlyrestemp.jar
- /data/data/####/files/libmgRun_04.22.05_01.so
- /data/data/####/files/mlyres.dat
- /data/data/####/files/MiguPay.Sdk30.Lib_12003003_db5cfe073edefa9a18774d01d2a4bce7_BN202.cod
- /sdcard/.mlysdk/####/properties/marketlinkcrypted.dat
- /sdcard/Download/data/cn.cmgame.sdk/sdk_prefs.txt
- /sdcard/.mlysdk/####/properties/smsinfocrypted.dat
- /sdcard/.mlysdk/####/properties/mlysdkconfig.dat
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/ED.ini
- /data/data/####/files/mgAS.dat
- /data/data/####/files/mgSS.dat
- /sdcard/.mlysdk/####/properties/marketinfocrypted.dat
- /data/data/####/files/hbilling.dat
- /sdcard/Download/data/cn.cmgame.sdk/ShareData.txt
- /sdcard/Download/data/cn.cmgame.sdk/msgflag.txt
- /data/data/####/files/ly.jar
- /data/data/####/temp.dex
- /sdcard/.mlysdk/####/properties/mlyuser.dat
- /sdcard/Download/data/cn.cmgame.sdk/log/deviceId.txt
- /sdcard/.mlysdk/####/properties/fbc35c475274a4a63ac17bac51be5d84.properties
Miscellaneous:
Executes next shell scripts:
- ls -l /system/bin/su
Contains functionality to send SMS messages automatically.
