Technical information
Malicious functions:
Sends SMS messages:
- 18974129280: <IMEI>13
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) weib####.g####.sina####.com:80
- TCP(HTTP/1.1) api.h####.cn:81
- TCP(TLS/1.0) 2####.58.212.142:443
- TCP(TLS/1.0) weib####.g####.sina####.com:443
- TCP(TLS/1.0) i.l####.net:443
DNS requests:
- api.h####.cn
- i.l####.net
- ws1.sin####.cn
- ww1.sin####.cn
- ww2.sin####.cn
- ww3.sin####.cn
- ww4.sin####.cn
- wx1.sin####.cn
- wx2.sin####.cn
- wx3.sin####.cn
- wx4.sin####.cn
HTTP GET requests:
- api.h####.cn:81/mf/json.txt
- weib####.g####.sina####.com/large/0060lm7Tly1fobhirdep9j303c03cwec.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fqi47x1heoj2020020748.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fqi4cgzdv6j2020020q2v.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fqi4hjn11nj2040040t8x.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fqi4lcae2fj204g04gwej.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1frc0qchto4j20e80e9wgd.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fs2fcicv7tj205c05cwei.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fs2fvatvwwj203c03cmxk.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fs8fl7eu28j204z04at8l.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fs8g1ra45ij204l03nt8i.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fs8gcg0bbbj204i03la9x.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1ft3n1upwrrj2055046glp.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1ft3nd13150j204e03waa4.jpg
- weib####.g####.sina####.com/large/87c01ec7ly1fr5d5uty0mj2046046t95.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fr222o0cg8j30ku0kuwei.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fu6oziazuuj303y03tmx1.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fun3xw5md7j304h04d0sp.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fun3yc8s47j307404vt90.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fupd3m6rkfj307i06zwei.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fupe5f1jjtj304103owee.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fupeab1tqzj303d03dt8m.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fuzv9vl6nnj3046046gli.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fuzva6m3ovj3046046dfr.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fv0apoo8zuj3046046747.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fvjc0tkg9kj301w01tgle.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fvjduokhnlj3050050dfv.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fvjxt5tz3ij30a007imx6.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fw7u4v52woj304m04cjs9.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fw834mqtmbj30sg0sgjut.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fw834re2oxj30sg0sgtc3.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fw84rcmgwsj30sg0sg77i.jpg
Modified file system:
Creates the following files:
- /data/data/####/ck732093061.xml
- /data/media/####/.nomedia
- /data/media/####/136wio9eo7zg1pnmax5extaif.tmp
- /data/media/####/1xzeajyxvm6d35qzmm8vumvua.tmp
- /data/media/####/23p47wat620ag4l6mhxvp3zvp.tmp
- /data/media/####/24b20ivf2cldmqr4qtozlx7rd.tmp
- /data/media/####/2by2u22uxkzr1770dhzajkjy.tmp
- /data/media/####/2c1ridei7ml0govfjzabqwbzu.tmp
- /data/media/####/2fbi2ootbof3lz6ko76mcrzw1.tmp
- /data/media/####/2nxwhirudugp3ke15h583to3w.tmp
- /data/media/####/2rv14apzqkzr8lwxlb22c5rxd.tmp
- /data/media/####/2s0t5xh9kons5yl5a34v0vfz4.tmp
- /data/media/####/2ylpzns3w5ipl7wl5ark0lv1i.tmp
- /data/media/####/3fw5o2zqgcudzfdx03wf444d2.tmp
- /data/media/####/3t5x698mcjqa2b3mn7ro0hu4.tmp
- /data/media/####/4bi3f3pfmp3qeb8xs9rb7zn6e.tmp
- /data/media/####/4dmuo2n3jxi1t3b5ghn69ku8h.tmp
- /data/media/####/4ee2qph37z5n2pq44lqo53u3d.tmp
- /data/media/####/4i9v276wo7v5w2u5ijzu8re0g.tmp
- /data/media/####/4la2fipr5ra2uliyhtx83pm3i.tmp
- /data/media/####/4rjmuoxwvinix4hvzqzb1r7q9.tmp
- /data/media/####/4st3zk7w767ov85q4dbapwj0m.tmp
- /data/media/####/4su2kqitqnpqp465gz5auatu8.tmp
- /data/media/####/4u0t98cec6u7ii6yasjw8bwp4.tmp
- /data/media/####/4uoo55m015mfjzbde534trk6w.tmp
- /data/media/####/4wwg4a0tngubricf7gr73rwi.tmp
- /data/media/####/4yitdjnfq7aqkesnkqnj9tj0r.tmp
- /data/media/####/54nsx33hopo4mz2mozfctch26.tmp
- /data/media/####/5a41tzce70m21v7k0f0axmcv3.tmp
- /data/media/####/5gg8ywflsau0isbkw35wv8g3e.tmp
- /data/media/####/5p6s8rh1afd6n6uhj1ippdllz.tmp
- /data/media/####/5zy09a78080s74gn098hfwkui.tmp
- /data/media/####/697gws92frn1joq4tgdyb6q0j.tmp
- /data/media/####/6jd9f7r5gbvclxbz1n0c04kty.tmp
- /data/media/####/6sjeu0nqa4n6f48ir02w4eaql.tmp
- /data/media/####/6tuc9qy4yv5ifzd1s3qszita.tmp
- /data/media/####/6yohf1zhfchu98bikht2bzqkp.tmp
- /data/media/####/6zh58jucs3t3bgs1710j67kai.tmp
- /data/media/####/76gxsvsh0a7gx7xl2gxhe8rir.tmp
- /data/media/####/786x1e1u5ghtkqq85tph4kazf.tmp
- /data/media/####/78qhhbof6yo7j2fbno5ss6zum.tmp
- /data/media/####/7iz2xu26xrkjqp5rzd893tupr.tmp
- /data/media/####/c09hu7dwes4p4j9am6kbnjt0.tmp
- /data/media/####/ckxc2kjctt2gmqgadibh4euv.tmp
- /data/media/####/dle5vdyplqpxzd0dwbo3dvlf.tmp
- /data/media/####/f7b1o9s3d8v8e2hvaxsdf7xg.tmp
- /data/media/####/u9izlsiofwafix66gispos3k.tmp
- /data/media/####/zpgtrfsz7z5c43wdlmltjrh5.tmp
Miscellaneous:
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
Parses information from SMS messages.
Gains access to information about sent/received SMS messages.
