Technical information
Malicious functions:
Sends SMS messages:
- 106901333271: GETP#8de7187022094804ad0aebec32262e34
Network activity:
Connecting to:
- xl####.####.com
- gaand####.####.net
- h####.####.com
- o####.####.com
- and####.####.com
- gam####.####.com
- x####.####.com
- a####.####.com
HTTP POST requests:
- a####.####.com/app_logs
- x####.####.com/sdkServer/sdkconfig
- gam####.####.com/standalone/gameWhiteList
- x####.####.com/sdkServer/pay
- gam####.####.com/standalone/queryGbAndMmSupport
- gam####.####.com/standalone/GameRecommendStatistics
- gam####.####.com/standalone/queryNewPayChannelV200
- xl####.####.com/userServer/phone/getnumber.jsp
- o####.####.com/v2/get_update_time
- h####.####.com/app.gif
- gam####.####.com/standalone/queryAllSMSPayChannel
- gam####.####.com/standalone/getGameRecommendV140
- gam####.####.com/standalone/gameVersionUpdate
- o####.####.com/v2/check_config_update
- and####.####.com/rqd/async
- gam####.####.com/standalone/thirdpaySupportList
- a####.####.com/rest/2.0/channel/4513560728026690599
- gaand####.####.net/g/d?crc=####
- a####.####.com/rest/2.0/channel/channel
Modified file system:
Creates the following files:
- <Package Folder>/databases/gp_app.db-journal
- <Package Folder>/files/native_record_lock
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/pref_file.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/iRSNz99qNQaaaXSsRq7co6Op__local_stat_cache.json
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/databases/xl_order.db
- <Package Folder>/databases/dk_props.db-journal
- <Package Folder>/shared_prefs/umeng_feedback_user_info.xml
- <Package Folder>/shared_prefs/d2eam_sdk.xml
- <Package Folder>/shared_prefs/com_xl_shared_preferences.xml.bak
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/gost.xml
- <Package Folder>/shared_prefs/bindcache.xml
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/databases/xl_props.db
- <Package Folder>/databases/xl_single_operator.db
- <Package Folder>/databases/xl_order.db-journal
- <Package Folder>/files/d2eam_runtime/libd2eam.so
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/td_pefercen_profile.xml
- <Package Folder>/databases/dk_thirdpay.db
- <Package Folder>/files/local_crash_lock
- <Package Folder>/files/assets/markVersion
- <Package Folder>/files/2cb6687eb5__local_stat_cache.json
- <Package Folder>/databases/xl_single_operator.db-journal
- <Package Folder>/databases/bugly_db_-journal
- <Package Folder>/databases/dk_props.db
- <Package Folder>/databases/xl_props.db-journal
- <Package Folder>/databases/dk_single_operator.db
- <Package Folder>/shared_prefs/com_xl_shared_preferences.xml
- <Package Folder>/shared_prefs/pref_file.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/2cb6687eb5__local_except_cache.json
- <Package Folder>/databases/dk_thirdpay.db-journal
- <Package Folder>/files/d2eam_runtime/libxlddz.so
- <Package Folder>/shared_prefs/isShow.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/databases/dk_single_operator.db-journal
- <Package Folder>/shared_prefs/com_dk_shared_preferences.xml.bak
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/files/security_info
- <Package Folder>/shared_prefs/com_dk_shared_preferences.xml
- <Package Folder>/shared_prefs/umeng_feedback_conversations.xml
Miscellaneous:
Executes next shell scripts:
- pm list packages
- app_process /system/bin com.android.commands.pm.Pm list packages
- getprop ro.board.platform
- /system/bin/sh -c type su
- /system/bin/sh -c getprop ro.board.platform
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
