Technical information
Malicious functions:
Sends SMS messages:
- 12114000372329: 0#77qol8
- 12114000372329: i2mPNk1AOWWu6IO69LttHIXkg==
Network activity:
Connecting to:
- s####.####.com
- 1####.####.151:8080
- u####.####.com
- v####.####.com
- beijin####.####.com
- union####.####.com
- ut####.cn
- v####.####.com:1111
- r####.####.com
- 1####.####.55:8082
- 1####.####.234:8080
- aliyu####.com
- z####.####.com
- 1####.####.55
- i####.net
- ut####.cn:8080
- 1####.####.234
HTTP GET requests:
- s####.####.com/img/pic.gif
- i####.net/template/njmomoda/js/home.js
- v####.####.com/socket.io/socket.io.js
- s####.####.com/core.php?web_id=####&show=####&t=####
- 1####.####.55/201703/mm.jpg
- aliyu####.com/aliyunxz.js
- beijin####.####.com/apks/load.bat
- i####.net/player/91flv.js
- i####.net/template/njmomoda/js/zepto.piclazyload.min.js
- i####.net/template/njmomoda/css/app.min.css?v=####
- 1####.####.55/201702/fenl.jpg
- i####.net/template/njmomoda/css/14470348816dL25.png
- 1####.####.55/201702/cfpl.jpg
- i####.net/js/playerconfig.js
- i####.net/vodplayhtml/2621.html?2621####&sn=####
- 1####.####.55/201703/gtjt.jpg
- union####.####.com/html/top.js
- 1####.####.55/201703/hynn.jpg
- i####.net/template/njmomoda/css/mui.min.css
- z####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&showp=####&t=####&umuuid=####&h=####&rnd=####
- u####.####.com/html/top.js
- 1####.####.55/201701/dntz.jpg
- 1####.####.55/201702/gfyj.jpg
- 1####.####.55/201703/gskc.jpg
- i####.net/js/player.js
- v####.####.com/html/js/jquery-1.11.2.min.js
- i####.net/
- i####.net/inc/timming.php?t=####
- i####.net/js/jq/jquery.lazyload.js
- 1####.####.55/201703/jhxhx.jpg
- i####.net/template/njmomoda/js/swiper.min.js
- v####.####.com//20170331/gNCA1BP6/1.jpg
- i####.net/template/njmomoda/js/foot.js?v=####
- i####.net/js/jq/jquery.autocomplete.js
- i####.net/template/njmomoda/css/header-menubtn-back.png
- i####.net/template/njmomoda/js/tpl.js
- r####.####.com/open/js/jweixin-1.1.0.js
- v####.####.com/share/maant9BegUZ8Thcg
- i####.net/upload/playdata/20170331/2621/2621.js
- 1####.####.55:8082/logo.jpg
- 1####.####.55/201612/xdyh.jpg
- 1####.####.55/201703/jgkld.jpg
- i####.net/template/njmomoda/css/iconfont.ttf?v=####
- i####.net/js/jquery.js
- 1####.####.55/201703/tgxj.jpg
- 1####.####.55/201703/cnrscjn.jpg
- i####.net/template/njmomoda/css/style.css
- i####.net/template/njmomoda/js/zepto.min.js
- i####.net/ma/code.jpg
- v####.####.com/html/ckplayer/key.js
- i####.net/js/tj.js
- v####.####.com:1111/share/maant9BegUZ8Thcg
- i####.net/template/njmomoda/css/iweite.png
- i####.net/template/njmomoda/css/swiper.min.css
- v####.####.com/html/ckplayer/ckplayer.js
- s####.####.com/z_stat.php?id=####&show=####
- i####.net/vodplayhtml/2621.html?2621####
- 1####.####.55/logo.jpg
- i####.net/api/data.php?url=####&callback=####&_=####
HTTP POST requests:
- ut####.cn/excalibur/avalon/sdk/queryResult.aspx
- 1####.####.234/Service/@intf@/i0001
- 1####.####.234/Service/@intf@/i0003
- 1####.####.234:8080/Service/@intf@/i2001
- ut####.cn/excalibur/avalon/sdk/pay.aspx
- 1####.####.151:8080/astrolinkSDK/info/getUpUrlInfo
- ut####.cn:8080/excalibur/avalon/sdk/init.aspx
Modified file system:
Creates the following files:
- /data/data/####/databases/d_aa6a5bg-journal
- /data/data/####/app_dex/utopay.jar
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/app_dex/utopay_icon.gif
- /data/data/####/databases/utopay.db-journal
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_3
- /sdcard/Download/AST_DOWN/load.bat
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/shared_prefs/setting.xml
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/sp_haoapp.xml
- /data/data/####/app_dex/utopay_close.png
- /data/data/####/databases/d_aa6a5bg
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Executes next shell scripts:
- getprop apps.customerservice.device
Contains functionality to send SMS messages automatically.
