Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.1848.origin
Network activity:
Connecting to:
- 1####.####.34:19000
- p####.####.net
- p####.####.net:8082
- p####.####.com
HTTP GET requests:
- p####.####.com/cityjson?ie=####
- p####.####.net/skin/1.png
- p####.####.net/skin/14.png
- p####.####.net/skin/15.png
- p####.####.net/skin/16.png
- p####.####.net/skin/17.png
- p####.####.net/skin/12.png
- p####.####.net/skin/13.png
- p####.####.net/avatar/18.png
- p####.####.net/skin/18.png
HTTP POST requests:
- p####.####.net/admin/client!upgrade.action
- p####.####.net/admin/user!visitorLogin.action
- p####.####.net/admin/client!banWordInfo.action
- p####.####.net:8082/user/userbase!generateUUID.action
- p####.####.net/palm4s-server-ssh/Statistics!appsave
- p####.####.net/jarupdate
- p####.####.net/user/userbase!generateUUID.action
- 1####.####.34:19000/v2/chis
- p####.####.net/admin/client!configAndroid.action
- p####.####.net/admin/user!userSkin.action
Modified file system:
Creates the following files:
- /data/data/####/baea/tmb.jar
- /data/data/####/files/receiversms_103.dat
- /sdcard/Android/data/####/cache/1981564384.tmp
- /data/data/####/shared_prefs/b_share.xml
- /data/data/####/files/userdata.dat
- /data/data/####/shared_prefs/pay_smsc_sp.xml
- /data/data/####/shared_prefs/pref.xml
- /data/data/####/shared_prefs/ma_data.xml
- /data/data/####/shared_prefs/pay_sp.xml.bak
- /data/data/####/shared_prefs/ma_call.xml
- /data/data/####/shared_prefs/edition.xml
- /data/data/####/files/user0/config.a
- /data/data/####/databases/cc/cc.db
- /data/data/####/files/Plugin2.apk
- /data/data/####/shared_prefs/new_vvsion.xml
- /sdcard/Download/snake/.gfsp/1477929600000
- /data/data/####/shared_prefs/pay_sp.xml
- /data/data/####/shared_prefs/nnt_data.xml
- /data/data/####/shared_prefs/zzconfig.xml
- /data/data/####/shared_prefs/login_user.xml
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Android/data/####/cache/1985258468.tmp
- /data/data/####/databases/bil_db-journal
- /data/data/####/files/smsorder_101.dat
- /data/data/####/files/microJar.jar
- /sdcard/.system_wid
- /sdcard/Android/data/####/cache/1983411426
- /data/data/####/databases/MA_epay_db
- /sdcard/Android/data/####/cache/1984334947.tmp
- /sdcard/Android/data/####/cache/-1460184823.tmp
- /sdcard/Android/data/####/cache/1986181989.tmp
- /sdcard/Android/data/####/cache/-2046908471.tmp
- /data/data/####/databases/webview.db-journal
- /sdcard/Android/data/####/cache/.nomedia
- /sdcard/Download/snake/.did/imei_356507059351895_uuid_148541566030522776
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/files/user0/skin.a
- /data/data/####/databases/MA_epay_db-journal
- /data/data/####/shared_prefs/game_info.xml
- /data/data/####/shared_prefs/snake.xml
- /sdcard/Android/data/####/cache/1982487905.tmp
- /data/data/####/shared_prefs/abc.xml
- /data/data/####/shared_prefs/b_setting.xml
- /data/data/####/files/mobclick_agent_cached_####2028
- /data/data/####/databases/bil_db
- /data/data/####/files/wapsms_101.dat
Miscellaneous:
Executes next shell scripts:
- getprop
- service list
Contains functionality to send SMS messages automatically.
