Technical information
Malicious functions:
Sends SMS messages:
- 106584211: 5fd3bec6c0a86a606011115350754336M302000A免费登录短信，请勿修改
Network activity:
Connecting to:
- s####.####.com
- 7x####.####.com
- 7j####.####.com
- c-h####.####.com
- obf0c####.####.com
- w####.####.com
- 1####.####.195
- d####.####.com:8083
- boo####.####.cn
- m####.####.com
- i####.####.cn
- a####.####.com
HTTP GET requests:
- s####.####.com/config/hz-hzv3.conf
- w####.####.com/r/p/myspacedata.jsp?vt=####&aaa_flag=####
- boo####.####.cn//pubres/picture/show_img/xinshufree.jpg
- obf0c####.####.com/visenvt9_9_20160808104730.zip
- w####.####.com/sso/p/logindata.jsp?e_l=9&purl=/r/p/myspacedata.jsp?aaa_f...
- 7j####.####.com/tdata_DBk687
- i####.####.cn/iplookup/iplookup.php?format=####&aaa_flag=####
- boo####.####.cn//pubres/picture/show_img/mami720-288.jpg
- boo####.####.cn/pubres/picture/show_img/xinshufree.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000007518/11000007518.jpg
- 7j####.####.com/tdata_IJJ441
- boo####.####.cn//pubres/picture/show_img/tieshen.jpg
- 7j####.####.com/tdata_WUi230
- 7x####.####.com/zip/payjar_-1_20170525203434.zip
- boo####.####.cn/pubres/picture/show_img/tieshen.jpg
- w####.####.com/r/411266762/411266765.htm?cm=####&vt=####&aaa_flag=####
- boo####.####.cn/pubres/picture/show_img/mami720-288.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000080125/11000080125.jpg
HTTP POST requests:
- 1####.####.195/asg/portal.do?aaa_flag=####
- s####.####.com/api.php?format=####&t=####
- a####.####.com/app_logs
- 1####.####.195/asg/portal.do
- m####.####.com/gateway.do
- c-h####.####.com/api.php?format=####&t=####
- d####.####.com:8083/useractive
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/myepay.xml
- <Package Folder>/app_temp/libcryto_zywx.so
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/files/init.pid
- <Package Folder>/files/run.pid
- <Package Folder>/files/100400022600UploadUserBehavior.dat
- <Package Folder>/shared_prefs/myepay.xml.bak
- <Package Folder>/files/.imprint
- <Package Folder>/files/mobclick_agent_cached_<Package>1010401
- <Package Folder>/files/gdaemon_20161017
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/shared_prefs/ishugui.shareInfo.xml
- <Package Folder>/databases/pushext.db-journal
- <Package Folder>/files/defrayPriority100400022600<IMSI>.dat
- <Package Folder>/app_libs/libcryto_zywx.so
- <Package Folder>/files/DownloadBillingList_100400022600_00000848_000000003288_<IMSI>unanaly
- <Package Folder>/databases/intercept_pad.db-journal
- <Package Folder>/files/tdata_IJJ441.jar
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/tdata_DBk687.jar
- <Package Folder>/files/tdata_WUi230.tmp
- <Package Folder>/databases/ishugui.db-journal
- <Package Folder>/shared_prefs/ishugui.shareInfo.xml.bak
- <Package Folder>/shared_prefs/Cookies<IMSI>.xml
- <Package Folder>/databases/tmpd8.db-journal
- <Package Folder>/databases/increment.db-journal
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/tdata_IJJ441.tmp
- <Package Folder>/shared_prefs/iapppay_config.xml
- <Package Folder>/shared_prefs/conf_sp_name.xml
- <Package Folder>/files/tdata_DBk687.tmp
- <Package Folder>/databases/pushgdm.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/pushg.db-journal
- <Package Folder>/shared_prefs/Cookies<IMSI>.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/push.pid
- <Package Folder>/files/tdata_WUi230.jar
Miscellaneous:
Executes next shell scripts:
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24846 300 0
- /data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 24846 300 0
- <dexopt>
- chmod 700 /data/data/####/files/gdaemon_20161017
- chmod 700 <Package Folder>/files/gdaemon_20161017
Contains functionality to send SMS messages automatically.
