Technical information
Malicious functions:
Sends SMS messages:
- 12114516420: <IMSI>
Network activity:
Connecting to:
- 1####.####.226
- 1####.####.238
- 1####.####.238:8977
- 7j####.####.com
- a####.####.com
- and####.####.com
- and####.####.com:8077
- c-h####.####.com
- huangda####.com
- i####.####.cn
- i####.####.com:10003
- iji####.com
- m####.####.com
- p####.####.com
- re####.####.com:10002
- s####.####.com
- v####.####.com
- w####.####.com
HTTP GET requests:
- 1####.####.238/dex/ldsource.bin
- 1####.####.238:8977/dex/version.txt
- 7j####.####.com/tdata_xnO526
- a####.####.com/fetch.php?gid=####&ch=####&key=####
- a####.####.com/location/ip?ak=####&mcode=####
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.cn/iplookup/iplookup.php?format=####
- iji####.com/tcmn/iploc/get_ip
- m####.####.com/course/504703.html?cm=####
- p####.####.com/cityjson?ie=####
- re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
- s####.####.com/config/hz-hzv3.conf
- v####.####.com/pic/tcmn/2017/05/12/788128600405.jpg
- w####.####.com/r/378609775/index.htm?cm=####
HTTP POST requests:
- 1####.####.226/api/sl/vcoderule/getvalid
- and####.####.com/record-plat/msg/strategy/query.do
- and####.####.com:8077/record-plat/seq/query.do
- c-h####.####.com/api.php?format=####&t=####
- i####.####.com:10003/v2/chis
- s####.####.com/api.php?format=####&t=####
Modified file system:
Creates the following files:
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/app_cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/app_dex/classes.jar
- <Package Folder>/app_workbench21174/apk.zip
- <Package Folder>/cache/####/-121009383773056441
- <Package Folder>/cache/####/-1279434992750962528
- <Package Folder>/cache/####/-1541396962-164944138
- <Package Folder>/cache/####/-1766753532-1466107108
- <Package Folder>/cache/####/-19911374461790587085
- <Package Folder>/cache/####/-2058342613-1673518234
- <Package Folder>/cache/####/-2073803866-1508934462
- <Package Folder>/cache/####/-2078316598-870733788
- <Package Folder>/cache/####/-8579468531790587085
- <Package Folder>/cache/####/1066632938-190576509
- <Package Folder>/cache/####/1112325137-1878663413
- <Package Folder>/cache/####/1112325137-427747099
- <Package Folder>/cache/####/1112325137-658176393
- <Package Folder>/cache/####/11123251371138282312
- <Package Folder>/cache/####/11123251371806588945
- <Package Folder>/cache/####/12828074421746016962
- <Package Folder>/cache/####/128280744219076090
- <Package Folder>/cache/####/15027263772045905944
- <Package Folder>/cache/####/1561945396-936892913
- <Package Folder>/cache/####/16489413521379302903
- <Package Folder>/cache/####/1853553663-815849171
- <Package Folder>/cache/####/24958737750962528
- <Package Folder>/cache/####/564987735-275368373
- <Package Folder>/cache/####/595570210458385214
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/index
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/Data_sync.db-journal
- <Package Folder>/databases/my_pagecache.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/plus.jar
- <Package Folder>/files/init.pid
- <Package Folder>/files/init_c1.pid
- <Package Folder>/files/libabc
- <Package Folder>/files/mobclick_agent_cached_<Package>192
- <Package Folder>/files/noend.ini
- <Package Folder>/files/push.pid
- <Package Folder>/files/run.pid
- <Package Folder>/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
- <Package Folder>/shared_prefs/BOOT_SMS_INFO.xml
- <Package Folder>/shared_prefs/BOOT_SMS_SENT_TIME.xml
- <Package Folder>/shared_prefs/DB_MTS.xml
- <Package Folder>/shared_prefs/QugouUser.xml
- <Package Folder>/shared_prefs/QugouUserTag.xml
- <Package Folder>/shared_prefs/VistorNo.xml
- <Package Folder>/shared_prefs/dispatch_log.xml
- <Package Folder>/shared_prefs/first_pref.xml
- <Package Folder>/shared_prefs/first_register.xml
- <Package Folder>/shared_prefs/getui_sp.xml
- <Package Folder>/shared_prefs/jmsdk.dat.xml
- <Package Folder>/shared_prefs/mgsdkfin1.xml
- <Package Folder>/shared_prefs/mgsdkfin1.xml.bak
- <Package Folder>/shared_prefs/plugin_record_app_info.xml
- <Package Folder>/shared_prefs/pref_recomm.xml
- <Package Folder>/shared_prefs/pref_recomm.xml.bak
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/tpservices.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/version.dat.xml
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.tpservice/####/qsha_80001_5096.jar
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3003_2270.zip
- <SD-Card>/<Package>/####/TYDSETTING
- <SD-Card>/<Package>/####/f42a2f3be7be22d7413a108337d7f9e0
- <SD-Card>/Android/####/com.skymobi.pay.plugin.main.data
- <SD-Card>/Android/####/com.skymobi.pay.plugin.recordupload.data
- <SD-Card>/Android/####/com.skymobi.pay.plugin.smspay.data
- <SD-Card>/Android/####/user.sys
- <SD-Card>/libs/<Package>.bin
- <SD-Card>/libs/<Package>.db
- <SD-Card>/libs/app.db
- <SD-Card>/libs/com.igexin.sdk.deviceId.db
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- cat /sys/block/mmcblk0/device/cid
