Technical information
Malicious functions:
Sends SMS messages:
- 10086: CXGPRSTC
Executes code of the following detected threats:
- Android.DownLoader.396.origin
- Android.DownLoader.348.origin
- Android.DownLoader.455.origin
Network activity:
Connecting to:
- o####.####.com
- p####.####.cn
- a####.####.com
HTTP POST requests:
- a####.####.com/apk-api/api/packages/MarketCategory.action
- a####.####.com/khmarket-api/api/bannerAd/getMarketBannerInfoList.action
- o####.####.com/check_config_update
- a####.####.com/apk-api/api/appInfo/marketGame.action
- a####.####.com/khmarket-api/api/keyword/searchKeyword.action
- a####.####.com/khmarket-api/api/bizhiImages/MarketWp.action
- a####.####.com/khmarket-api/api//bizhiCates/MarketWpCate.action
- p####.####.cn/admin/nbad.action?z=####
- a####.####.com/app_logs
- p####.####.cn/admin/sc.action?requestId=####
- a####.####.com/apk-api/api/appInfo/marketGameupdate.action
- a####.####.com/khmarket-api/api/bannerAd/marketdoBanner.action
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/ccallType.xml
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/shared_prefs/shpresents.xml
- /data/data/####/files/1485415899297.jar
- /data/data/####/shared_prefs/caid.xml
- /data/data/####/shared_prefs/mid.xml
- /data/data/####/databases/qcut_download.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/System_icon.bin
- /data/data/####/shared_prefs/fcut_appInfo_pre.xml
- /data/data/####/files/1485415898987.jar
- /data/data/####/files/1485415898818.jar
- /data/data/####/databases/user.db-journal
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml
- /data/data/####/shared_prefs/i_fionf_pre356507059351895.xml.bak
- /data/data/####/shared_prefs/fcut_trategy_pre.xml
- /data/data/####/shared_prefs/coni_io_356507059351895.xml
- /data/data/####/shared_prefs/i.xml
- /data/data/####/shared_prefs/time.xml
- /sdcard/data/.push_deviceid
- /data/data/####/shared_prefs/ybappInfo_pre.xml
- /data/data/####/shared_prefs/xy.xml
- /data/data/####/shared_prefs/log.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/shstype.xml
- /data/data/####/files/14854158997090.jar
- /data/data/####/shared_prefs/shloc.xml
- /data/data/####/shared_prefs/shb.xml
- /sdcard/Android/data/code/MID.DAT
- /data/data/####/files/.imprint
- /data/data/####/shared_prefs/fcut_conf_pre.xml.bak
- /data/data/####/shared_prefs/JPushSA_Config.xml.bak
- /data/data/####/shared_prefs/fcut_conf_pre.xml
- /data/data/####/shared_prefs/itrategy_io_356507059351895.xml
- /data/data/####/shared_prefs/c_i.xml
- /data/data/####/files/14854158999349.jar
- /data/data/####/shared_prefs/iappInfo_io_356507059351895.xml.bak
- /data/data/####/files/jpush_stat_cache_history.json
- /data/data/####/shared_prefs/aidian_market_sp.xml
- /data/data/####/files/mobclick_agent_cached_####1899
- /data/data/####/shared_prefs/JPushSA_Config.xml
- /data/data/####/databases/E_ID356507059351895.db-journal
- /data/data/####/shared_prefs/ybconf_pre.xml
- /data/data/####/shared_prefs/fcut_info_pre.xml
- /data/data/####/databases/idiantech_ideal.db-journal
- /data/data/####/shared_prefs/fcut_appInfo_pre.xml.bak
- /data/data/####/sms.db-journal
- /data/data/####/files/System_NOTIFICATION.bin
- /data/data/####/shared_prefs/itrategy_io_356507059351895.xml.bak
- /data/data/####/shared_prefs/_ccoorgql.xml.bak
- /data/data/####/shared_prefs/ybappInfo_pre.xml.bak
- /data/data/####/files/jpush_stat_cache.json
- /data/data/####/shared_prefs/coni_io_356507059351895.xml.bak
- /data/data/####/shared_prefs/iappInfo_io_356507059351895.xml
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/shared_prefs/_ccoorgql.xml
- /data/data/####/files/1485415899130.jar
- /data/data/####/files/14854159044755.jar
- /data/data/####/shared_prefs/traffic_setting.xml
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/aidian_market_sp.xml.bak
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/odmd.hl.fr.jar
- /data/data/####/files/1485415899250.jar
- /data/data/####/sms.db
- /data/data/####/shared_prefs/fcut_trategy_pre.xml.bak
- /data/data/####/shared_prefs/cn.jpush.serverconfig.xml
- /data/data/####/shared_prefs/id.xml
- /data/data/####/files/14854158995437.jar
- /data/data/####/databases/db_d.db-journal
- /sdcard/Download/pdat/names.dat
- /sdcard/Download/pdat/share.dat
Miscellaneous:
Contains functionality to send SMS messages automatically.
