Technical information
Malicious functions:
Sends SMS messages:
- 12114516420: <IMSI>
Network activity:
Connecting to:
- 1####.####.226
- 1####.####.226:8002
- 1####.####.238
- 1####.####.238:8977
- 7j####.####.com
- a####.####.com
- and####.####.com
- and####.####.com:8077
- c-h####.####.com
- huangda####.com
- i####.####.cn
- i####.####.com:10003
- iji####.com
- m####.####.com
- p####.####.com
- pub-####.####.com
- re####.####.com:10002
- s####.####.com
- v####.####.com
- w####.####.com
HTTP GET requests:
- 1####.####.238/dex/ldsource.bin
- 1####.####.238:8977/dex/version.txt
- 7j####.####.com/tdata_CbF394
- a####.####.com/fetch.php?gid=####&ch=####&key=####
- a####.####.com/location/ip?ak=####&mcode=####
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- i####.####.cn/iplookup/iplookup.php?format=####
- iji####.com/qsxa/tyvideo/get_mmplayer?vncode=####&channel=####&pkg=####&...
- m####.####.com/course/504703.html?cm=####
- p####.####.com/cityjson?ie=####
- pub-####.####.com/tdata_EDT356
- re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
- s####.####.com/config/hz-hzv3.conf
- v####.####.com/version/tcmn/app/mmplay
- w####.####.com/r/378609775/378609778/index.htm?cm=####
HTTP POST requests:
- 1####.####.226/api/sl/device/upload
- 1####.####.226:8002/api/sl/vcoderule/getvalid
- and####.####.com/record-plat/record/upload.do
- and####.####.com:8077/record-plat/seq/query.do
- c-h####.####.com/api.php?format=####&t=####
- i####.####.com:10003/v2/chis
- s####.####.com/api.php?format=####&t=####
Modified file system:
Creates the following files:
- <Package Folder>/app_dex/classes.jar
- <Package Folder>/app_workbench26386/apk.zip
- <Package Folder>/cache/####/-1281248236-1107943145
- <Package Folder>/cache/####/-1880205299-280587161
- <Package Folder>/cache/####/-21337470272036111375
- <Package Folder>/cache/####/-2162556181358827316
- <Package Folder>/cache/####/-227015352750747567
- <Package Folder>/cache/####/-42783841-43191765
- <Package Folder>/cache/####/-4625687051358827316
- <Package Folder>/cache/####/-8498556011107599749
- <Package Folder>/cache/####/1384653209346049011
- <Package Folder>/cache/####/1411862030-2106743922
- <Package Folder>/cache/####/1552139061-1107943145
- <Package Folder>/cache/####/1552458802-1262814379
- <Package Folder>/cache/####/18535536631287924584
- <Package Folder>/cache/####/1967320000-43191765
- <Package Folder>/cache/####/726037567-559421760
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/Data_sync.db-journal
- <Package Folder>/databases/increment.db-journal
- <Package Folder>/databases/pushg.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/plus.jar
- <Package Folder>/files/init.pid
- <Package Folder>/files/libabc
- <Package Folder>/files/mobclick_agent_cached_<Package>1
- <Package Folder>/files/noend.ini
- <Package Folder>/files/push.pid
- <Package Folder>/files/run.pid
- <Package Folder>/files/tdata_CbF394.jar
- <Package Folder>/files/tdata_CbF394.tmp
- <Package Folder>/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
- <Package Folder>/shared_prefs/BOOT_SMS_INFO.xml
- <Package Folder>/shared_prefs/BOOT_SMS_SENT_TIME.xml
- <Package Folder>/shared_prefs/DB_MTS.xml
- <Package Folder>/shared_prefs/QugouUser.xml
- <Package Folder>/shared_prefs/QugouUserTag.xml
- <Package Folder>/shared_prefs/QugouUserTag.xml.bak
- <Package Folder>/shared_prefs/VistorNo.xml
- <Package Folder>/shared_prefs/dispatch_log.xml
- <Package Folder>/shared_prefs/first_pref.xml
- <Package Folder>/shared_prefs/first_register.xml
- <Package Folder>/shared_prefs/gx_sp.xml
- <Package Folder>/shared_prefs/jmsdk.dat.xml
- <Package Folder>/shared_prefs/jmsdk.dat.xml.bak
- <Package Folder>/shared_prefs/mgsdkfin1.xml
- <Package Folder>/shared_prefs/mgsdkfin1.xml.bak
- <Package Folder>/shared_prefs/plugin_record_app_info.xml
- <Package Folder>/shared_prefs/pref_recomm.xml
- <Package Folder>/shared_prefs/pref_recomm.xml.bak
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/tpservices.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/version.dat.xml
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.2h2n849FCDBCE226706C3753FD516p0/####/0127hjk98iz3s36h6iui3h0ytk144912
- <SD-Card>/.2h2n849FCDBCE226706C3753FD516p0/####/50ztbfyd2xxl2rc038dwcp817278akq3
- <SD-Card>/.2h2n849FCDBCE226706C3753FD516p0/####/k10642h805uk4v0n6d16idvauasai394
- <SD-Card>/.2h2n849FCDBCE226706C3753FD516p0/user.sys
- <SD-Card>/.tpservice/####/qsha_80001_5096.jar
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3003_2270.zip
- <SD-Card>/<Package>/####/TYDSETTING
- <SD-Card>/<Package>/####/f42a2f3be7be22d7413a108337d7f9e0
- <SD-Card>/libs/<Package>.db
- <SD-Card>/libs/app.db
- <SD-Card>/libs/com.igexin.sdk.deviceId.db
- <SD-Card>/system/####/tdata_CbF394
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- cat /sys/block/mmcblk0/device/cid
- cat /sys/class/net/wlan0/address
- mount
