Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.129.origin
Network activity:
Connecting to:
- h####.####.com
- t####.####.net
- 1####.####.43:8080
- o####.####.com
- 2####.####.233:443
- r####.####.com
- 1####.####.193
- 2####.####.233:14000
- t####.####.cn
- 1####.####.43
- a####.####.com
- 2####.####.233:8080
HTTP GET requests:
- a####.####.com/index.php?page=####&r=####&size=####&
- a####.####.com/index.php?categorys=####&page=####&r=####&isNew=####&size=####&
- a####.####.com/index.php?r=####&
- r####.####.com/easemob/server.json?sdk_version=####&app_key=####&file_version=####
- a####.####.com/index.php?clientVersion=####&r=####&deviceType=####&name=####&
- a####.####.com/index.php?page=####&r=####&customPosition=####&size=####&
HTTP POST requests:
- 2####.####.233:443/
- 1####.####.43:8080/pay/appclient/fetchTask.do
- 1####.####.43/tabscr/sybb/appclient//sybb!bannerInfo.do
- t####.####.net/g/d?crc=####
- 1####.####.43/pay/appclient/fetchTask.do
- h####.####.com/app.gif
- t####.####.cn/api/statis/3f6ec4da684547211e371a67946d85757/app-D9D2BB22D42240B9028BB306D629DF8B
- t####.####.cn/api/collect/app/3f6ec4da684547211e371a67946d85757
- 2####.####.233:14000/
- 1####.####.43/tabscr/sybb/appclient//versionActivation.service?
- 1####.####.193/adminmaimeng/maimeng/devices
- 1####.####.43/tabscr/sybb/appclient//sybb!rmdInfo.do
- o####.####.com/check_config_update
- t####.####.cn/api/q/a/3f6ec4da684547211e371a67946d85757
- a####.####.com/app_logs
- a####.####.com/index.php
- t####.####.cn/api/statis/3f6ec4da684547211e371a67946d85757
- 2####.####.233:8080/
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/sharefs_new_user.xml
- /data/data/####/shared_prefs/sharefs_new_user.xml.bak
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/shared_prefs/TDpref_longtime.xml
- /data/data/####/cache/volley/598548133-90805866
- /data/data/####/cache/volley/14571110321188226590
- /data/data/####/files/mpush_gateway_preferences_file
- /data/data/####/files/mpush_version_preferences_file
- /sdcard/emlibs/libs/monitor.db-journal
- /data/data/####/files/server.json
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/TDpref_shorttime.xml
- /data/data/####/cache/volley/-171775708-315044996
- /data/data/####/databases/stay4it-journal
- /data/data/####/shared_prefs/TDpref_longtime.xml.bak
- /data/data/####/databases/mpush_app.db-journal
- /data/data/####/cache/volley/77970606-1887089117
- /sdcard/.tcookieid
- /data/data/####/shared_prefs/.tpns.xml.xml
- /data/data/####/files/.imprint
- /data/data/####/cache/volley/-618937007-153055035
- /data/data/####/files/td.lock
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/TD_CHANNEL_ID.xml
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml.bak
- /data/data/####/shared_prefs/device_id.xml
- /data/data/####/shared_prefs/maimeng.xml
- /sdcard/baidu/.cuid
- /data/data/####/files/config.json
- /sdcard/Tencent/mta/.mid.txt
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/TDtcagent.db
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/files/TDtcagent.db-journal
- /data/data/####/shared_prefs/TDpref_shorttime.xml.bak
- /data/data/####/shared_prefs/logtime.xml
- /data/data/####/shared_prefs/TalingDataConfigD9D2BB22D42240B9028BB306D629DF8B.xml
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /sdcard/wybbMedia/files/rmdInfo.service
- /data/data/####/cache/volley/32585766-1535537077
- /data/data/####/shared_prefs/maimeng.xml.bak
Miscellaneous:
Contains functionality to send SMS messages automatically.
