Technical information
Malicious functions:
Sends SMS messages:
- 1069099952520: mly-7ab045d5
- 1069099952520: mly-7ab082b8
- 1069099952520: mly-7ab0b1a0
- 1069099952520: mly-7ab0f277
- 1069099952520: mly-7ab12556
Network activity:
Connecting to:
- 1####.####.211
- 1####.####.80
- 1####.####.80:8000
- 2####.####.140
- 2####.####.140:8080
- d####.####.com
- g####.####.net
- g####.####.net:8080
- sd####.####.com
- w####.####.com:7758
HTTP GET requests:
- 1####.####.211/websdk/exception?playerId=####&gameId=####&channelId=####...
- d####.####.com/egsb/otherPay/querySMSLimitMoney
HTTP POST requests:
- 1####.####.80/intp/96254ad646adcc024babddc1f5a62fdca7118760
- 1####.####.80:8000/intp/96254ad646adcc024babddc1f5a62fdca7118760
- 2####.####.140/migusdk/tl/enclog
- 2####.####.140:8080/migusdk/tl/enclog
- g####.####.net/migusdk/tl/tcttl
- g####.####.net:8080/migusdk/tl/tcttl
- sd####.####.com/behaviorLogging/eventLogging/accept?
- w####.####.com:7758/normandie/QueryConfigPolicy
Modified file system:
Creates the following files:
- <Package Folder>/2099.dex
- <Package Folder>/2206.dex
- <Package Folder>/2352.dex
- <Package Folder>/2461.dex
- <Package Folder>/2569.dex
- <Package Folder>/app_cache/tf.dex
- <Package Folder>/app_temp/mlyrestemp.dex
- <Package Folder>/cache/2099.dex (deleted)
- <Package Folder>/cache/2206.dex (deleted)
- <Package Folder>/cache/2352.dex (deleted)
- <Package Folder>/cache/2461.dex (deleted)
- <Package Folder>/databases/webview.db
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/libmiguED.so
- <Package Folder>/files/ED.ini
- <Package Folder>/files/MiguPay.Sdk30.Lib_12003003_07e001f49cf7425a25878b7204c8de63_BN202.cod
- <Package Folder>/files/MiguPay.Sdk30.Lib_12003003_07e001f49cf7425a25878b7204c8de63_BN202.dat
- <Package Folder>/files/cbdd.jar
- <Package Folder>/files/cbdd.png
- <Package Folder>/files/libmgRun_04.22.06_01.so
- <Package Folder>/files/mgAS.dat
- <Package Folder>/files/mgSS.dat
- <Package Folder>/files/mgid.dat
- <Package Folder>/files/mlyres.dat
- <Package Folder>/files/mlyrestemp.jar
- <Package Folder>/files/sdk_prefs
- <Package Folder>/files/tf.jar
- <SD-Card>/.mlysdk/####/675f2cf35bc3bee73652b01cb4e08870.properties
- <SD-Card>/.mlysdk/####/marketinfocrypted.dat
- <SD-Card>/.mlysdk/####/marketlinkcrypted.dat
- <SD-Card>/.mlysdk/####/mlysdkconfig.dat
- <SD-Card>/.mlysdk/####/mlyuser.dat
- <SD-Card>/.mlysdk/####/smsinfocrypted.dat
- <SD-Card>/Download/####/ShareData.txt
- <SD-Card>/Download/####/deviceId.txt
- <SD-Card>/Download/####/msgflag.txt
- <SD-Card>/Download/####/sdk_prefs.txt
Miscellaneous:
Executes next shell scripts:
- <dexopt>
