Technical information
Malicious functions:
Sends SMS messages:
- 106575206321505460: dyl#<IMSI>,<IMEI>,6000022-1-304-6_kh15s0004_-0
Executes code of the following detected threats:
- Android.Triada.178
- Android.Triada.258.origin
- Android.Triada.155.origin
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- huangda####.com
- 1####.####.57
- 1####.####.34:19000
- i####.####.com
- a####.####.com
HTTP GET requests:
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.com/ando-res/m/fUuctJnkGSxsEOC6TaFXT4moCtSmKHc5drsBHRgzJD7z6Q...
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- 1####.####.57/v1/order/get?phone=####&imei=####&sdk_version=####&callbac...
HTTP POST requests:
- a####.####.com/ando/x/liv?app_id=f3208725-7012-4a02-b200-5313e98d60a0&r=...
- huangda####.com/shop/shop_upload_log
- 1####.####.34:19000/v2/chis
- huangda####.com/mobilepay/v2/getPayInfoListX2.do
Modified file system:
Creates the following files:
- <Package Folder>/files/nEGDv7E5vPb7s21fP6N8Lk4lJASaC-dLQjcPpBeTJvA=/4rhvqkOz5x3deevDRTm9aA==/data.dat.tmp
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/files/.ca/QYnIi.jar
- <Package Folder>/files/nEGDv7E5vPb7s21fP6N8Lk4lJASaC-dLQjcPpBeTJvA=/atCSacLMTEpFkVLTYlJw3A==.new
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/twj.xml
- <Package Folder>/files/nEGDv7E5vPb7s21fP6N8Lk4lJASaC-dLQjcPpBeTJvA=/RQ698a4wypY5-mKIZF49kA==
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/nEGDv7E5vPb7s21fP6N8Lk4lJASaC-dLQjcPpBeTJvA=/xwGbVmjf4ddpY5RC.new
- <Package Folder>/databases/cc/cc.db-journal
- <Package Folder>/files/gfaug_d/gfaug_f.zip
- <Package Folder>/shared_prefs/zzconfig.xml
- <Package Folder>/shared_prefs/twj.xml.bak
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/cc/cc.db
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_0
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/files/nEGDv7E5vPb7s21fP6N8Lk4lJASaC-dLQjcPpBeTJvA=/U53pzErAOWfRdvhJa2-ktg==/mbmTqaUItUst5GqcYVgCMg==
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/files/nEGDv7E5vPb7s21fP6N8Lk4lJASaC-dLQjcPpBeTJvA=/RQ698a4wypY5-mKIZF49kA==.new
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
