Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSpy.2599
Network activity:
Connecting to:
- 2####.####.105
- v####.com:81
- 2####.####.105:83
- v####.com
HTTP GET requests:
- 2####.####.105/res/upload/contents/201502/16/201502161523464070/309_1.jpg?1424071####
- 2####.####.105/res/upload/contents/201502/16/201502161523513003/309_1.jpg?1424071####
- 2####.####.105/res/upload/contents/201502/16/201502161523487419/309_1.jpg?1424071####
- 2####.####.105/res/upload/contents/201502/16/201502161523435134/309_1.jpg?1424071####
- 2####.####.105/res/upload/contents/201502/16/201502161523389045/309_1.jpg?1424071####
- 2####.####.105/res/upload/contents/201502/16/201502161523448427/309_1.jpg?1424071####
- 2####.####.105/res/upload/contents/201606/30/20160630160112758/308.jpg?1478585####
- 2####.####.105/res/upload/contents/201502/16/20150216152342447/309_1.jpg?1424071####
- 2####.####.105/res/upload/contents/201502/16/201502161523403575/309_1.jpg?1424071####
- 2####.####.105/res/upload/contents/201502/16/20150216152337882/309_1.jpg?1424071####
- 2####.####.105:83/res/upload/contents/201606/30/201606301601378314/309_1.jpg?1467273####
- 2####.####.105/res/upload/contents/201502/16/20150216152345890/309_1.jpg?1424071####
- 2####.####.105/res/upload/contents/201502/16/201502161523411998/309_1.jpg?1424071####
- 2####.####.105/res/upload/contents/201502/16/201502161523474004/309_1.jpg?1424071####
- 2####.####.105/res/upload/contents/201502/16/201502161523505126/309_1.jpg?1424071####
- 2####.####.105/res/upload/contents/201502/16/201502161523394141/309_1.jpg?1424071####
- v####.com/vt/py/xyzplay?sv=####&ch=####&ont=####&cproid=####&btid=####&fbf=####&cid=####&wbid=####&loop=####&f=####&cipher=####&w=####&h=####&nt=####&...
- v####.com:81/vt/py/preln?cipher=####&uflag=####&w=####&h=####&nt=####&xx=####&ntg=####&tmv=####&ua=####&fmt=####&sv=####
- 2####.####.105/res/upload/contents/201502/16/201502161523495231/309_1.jpg?1424071####
Modified file system:
Creates the following files:
- /data/data/####/files/image1195788443
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/vs_filter.txt
- /data/data/####/files/image-1571796722
- /data/data/####/files/b1/yong.dat
- /data/data/####/files/image-1559937388
- /data/data/####/files/b1/main/aknfile_standalone_ptl.dat
- /data/data/####/files/image771033344
- /data/data/####/files/image-1566307939
- /data/data/####/files/image1517565606
- /data/data/####/shared_prefs/AUTO_UPDATE_DICT.xml
- /data/data/####/files/image-2139639880
- /data/data/####/files/image507691130
- /data/data/####/files/vs_num.txt
- /data/data/####/shared_prefs/leku.xml
- /data/data/####/files/image-350808939
- /data/data/####/files/image-720224575
- /data/data/####/files/image-477886799
- /data/data/####/files/image406281120
- /data/data/####/shared_prefs/device_id.xml
- /data/data/####/files/image1931536167
- /data/data/####/files/image-1242903360
- /data/data/####/shared_prefs/user_profile.xml
- /data/data/####/files/image-1408322272
- /data/data/####/files/image-1075917857
- /data/data/####/files/image-1878400571
Miscellaneous:
Contains functionality to send SMS messages automatically.
