Technical information
Malicious functions:
Sends SMS messages:
- 12114: HZSY#####
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- sdku####.####.com
- mo####.####.com
- dynami####.####.com
- 1####.####.com
- tpb24iO####.####.cn
- mmy####.####.com
- i####.####.cn
- vide####.####.cn
- priceru####.####.com
HTTP GET requests:
- priceru####.####.com/price-rule-cmp/rule/matchRule?version=####&deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=#...
- vide####.####.cn/20170330/78ff2c88-9fa0-4648-9830-9ceb59565dc5-1.jpg
- vide####.####.cn/20170330/79d3429e-0570-4080-be32-a4706f81daef-%E6%AF%8D%E3%81%AE%E5%8F%8B%E4%BA%BA.jpg
- vide####.####.cn/20170330/01608e6e-cb95-4ab8-8496-4719cd96faad-20170330.PNG
- mmy####.####.com/mmys-cps/styleTopChlVideo.service?pageNo=####&pageSize=####&showStyle=####&rv=####&deviceId=####&uuid=####&imei=####&imsi=####&manufa...
- vide####.####.cn/20170317/62911c63-a7b8-4c15-bbae-908df8f834a6-%E7%8C%A5%E8%A4%BB%E3%81%AA%E6%80%A7%E6%AC%B21.jpg
- vide####.####.cn/20170317/bf739e2a-c8dc-42ca-b101-b019fd57f9fe-%E4%B8%80%E8%BC%AA%E8%BB%8A%E3%80%81%E5%A9%A6%E8%AD%A6%E3%81%95%E3%82%93.jpg
- vide####.####.cn/20170330/ab0d814e-01d0-44f0-ab72-fb432defc8a9-2.jpg
- vide####.####.cn/20170318/bc18eea1-de23-43ab-a656-8da400b3af8e-oba00312jp-9.jpg
- vide####.####.cn/20170317/9f638fff-74b3-41f7-8230-b9b4ef514e6c-%E5%B1%88%E8%BE%B1%E3%81%AE%E5%A4%B1%E7%A6%81.jpg
- vide####.####.cn/20170328/336dd91d-1570-40fc-ace4-600c066d1e15-2.jpg
- mmy####.####.com/mmys-cps/runConfig.service?deviceId=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&appId=####&dc...
- mmy####.####.com/mmys-cps/rdContent.service?deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&app...
- vide####.####.cn/20170324/ae5a831c-e53e-44e4-b97f-1ed5238f1a63-12.jpg
- vide####.####.cn/20170330/cc0d1087-75ef-451d-ae75-9831b3faa110-1.jpg
- 1####.####.com/ic.asp
- vide####.####.cn/20170324/6de0ecf8-a5ca-4521-a21a-5d0a94fb19e1-1.jpg
- i####.####.cn/iplookup/iplookup.php?format=####
- mmy####.####.com/mmys-cps/bannerInfo.service?showStyle=####&deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&...
HTTP POST requests:
- mmy####.####.com/mmys-cps/userVisit.service?deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&app...
- tpb24iO####.####.cn/tmpay/initv2
- mmy####.####.com/mmys-cps/userActivation.service?deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=###...
- mo####.####.com/mobile-service/getImsiMobilePhone.json
- dynami####.####.com/dynamicpay//getSyFormalChannels.json?
- sdku####.####.com/sdk-update/sdkUpdateCdnUpload.json
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/global_count.xml.bak
- /sdcard/SYPAYFILENAME/CACHE/SMSCACHE/ISDELSMS
- /data/data/####/cache/picasso-cache/ee68cfaf945ea870854f7b06868e4d0a.0.tmp
- /data/data/####/cache/picasso-cache/248946480dcf3f89d45628d178f3b063.0.tmp
- /data/data/####/cache/picasso-cache/a6213fd5faccb13b505167ad47ba38c4.0.tmp
- /data/data/####/shared_prefs/time.xml
- /data/data/####/cache/picasso-cache/aca48d1db211e070befd09d917282e1e.0.tmp
- /data/data/####/shared_prefs/ds_configer.xml
- /data/data/####/cache/picasso-cache/b1724e7d763f3549d93cf8c43d4ec99f.0.tmp
- /data/data/####/cache/picasso-cache/885da13da7af7a1da90668f4ba59caaf.0.tmp
- /data/data/####/cache/picasso-cache/448bab2f7e2e2e203026cf038ac6357e.1.tmp
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/cache/picasso-cache/6134d992660c09eb1c9586ad7a410737.1.tmp
- /data/data/####/cache/picasso-cache/279660a8a570b82d965ba3d19706e95a.1.tmp
- /data/data/####/cache/picasso-cache/c8f6800f50b1513f4b2385de2b451af0.1.tmp
- /data/data/####/cache/picasso-cache/afc8dfea0c9b36158cecca800c17bcbb.1.tmp
- /data/data/####/shared_prefs/uuid.xml
- /data/data/####/cache/picasso-cache/248946480dcf3f89d45628d178f3b063.1.tmp
- /data/data/####/shared_prefs/trigger_recorder.xml.bak
- /data/data/####/shared_prefs/global_count.xml
- /data/data/####/cache/picasso-cache/afc8dfea0c9b36158cecca800c17bcbb.0.tmp
- /data/data/####/cache/picasso-cache/a6213fd5faccb13b505167ad47ba38c4.1.tmp
- /data/data/####/cache/picasso-cache/6f721c777fce06e49b72c1b46e740571.0.tmp
- /data/data/####/cache/picasso-cache/c8f6800f50b1513f4b2385de2b451af0.0.tmp
- /data/data/####/databases/upgrade_app-journal
- /data/data/####/cache/picasso-cache/279660a8a570b82d965ba3d19706e95a.0.tmp
- /data/data/####/databases/statistics_db-journal
- /data/data/####/cache/picasso-cache/ee68cfaf945ea870854f7b06868e4d0a.1.tmp
- /data/data/####/cache/picasso-cache/b1724e7d763f3549d93cf8c43d4ec99f.1.tmp
- /data/data/####/cache/picasso-cache/448bab2f7e2e2e203026cf038ac6357e.0.tmp
- /data/data/####/shared_prefs/p_config.xml
- /data/data/####/shared_prefs/trigger_recorder.xml
- /data/data/####/cache/picasso-cache/885da13da7af7a1da90668f4ba59caaf.1.tmp
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/gaClientId
- /data/data/####/databases/sy_video_data_cache-journal
- /data/data/####/cache/picasso-cache/journal.tmp
- /data/data/####/databases/recommend_app-journal
- /data/data/####/databases/google_analytics_v2.db-journal
- /data/data/####/databases/statistics_db
- /data/data/####/cache/picasso-cache/6f721c777fce06e49b72c1b46e740571.1.tmp
- /data/data/####/cache/picasso-cache/6134d992660c09eb1c9586ad7a410737.0.tmp
- /data/data/####/cache/picasso-cache/aca48d1db211e070befd09d917282e1e.1.tmp
Miscellaneous:
Contains functionality to send SMS messages automatically.
