Technical information
Malicious functions:
Sends SMS messages:
- 1069009512114: 苏州易N支付##########
- 15595005292: i2mPNk1AOWWu6IO69LttHIXkg==
Network activity:
Connecting to:
- t####.####.com
- 1####.####.56:9039
- ut####.cn
- 1####.####.242
- 7x####.####.com
- o####.####.com
- 1####.cn
- d####.####.com
- aco####.####.com
- 1####.####.90
- 1####.####.242:8080
- 1####.####.56
- ut####.cn:8080
- a####.####.com
HTTP GET requests:
- t####.####.com/cc/json/mobile_tel_segment.htm?tel=####
- 1####.####.56//gamesit/xysdk/init
- o####.####.com/wmapp/update/d_data_wimipay.dat
- 1####.####.56/gamesit/singlegame/njzfInit
- 1####.####.56:9039/gamesit/jysdk/initsdk?os_info=####&os_model=####&net_info=####&imsi=####&imei=####
- 1####.####.242/
- 7x####.####.com/utopay_20170119.zip
- 1####.####.90/code/init?app=####&lon=####&count=####&imei=####&iccid=####&nwtype=####&ctech=####&aimsi=####&cpid=####&cid=####&osversion=####&pck=####...
- aco####.####.com/game/83_ch_white660
HTTP POST requests:
- 1####.####.242/pay/servlet/GetUserInfo
- a####.####.com/app_logs
- d####.####.com/wimipay/getPhoneUrl
- 1####.####.242/pay/servlet/UploadPhoneInfo_City
- d####.####.com/wimipay/Init
- 1####.####.242/pay/servlet/GetThirdInfo
- 1####.cn/order/requestNoPhoneOrder
- 1####.####.242/pay/servlet/UploadPayStartInfo
- o####.####.com/check_config_update
- d####.####.com/control/Windows
- d####.####.com/wmserver/WMUpdate
- 1####.cn/phone/fetch
- d####.####.com/control/Control
- d####.####.com/wimipay/getCardNum
- ut####.cn/excalibur/avalon/sdk/pay.aspx
- ut####.cn:8080/excalibur/avalon/sdk/init.aspx
- 1####.####.242:8080/pay/servlet/UploadPhoneInfo
- 1####.####.242/pay/servlet/UploadPayEndInfo
- d####.####.com/wimipay/getysurl
- 1####.####.242/pay/servlet/GetFeeSelfInfo
- d####.####.com/mm/getYouShu
Modified file system:
Creates the following files:
- /data/data/####/.lib/libexec.so
- /sdcard/swift_mobile/889B70572E55A9C9EDE74722B445C44A_com.pay.bin.load.Application.jar
- /data/data/####/app_dex/utopay.jar
- /data/data/####/files/212FEFE2A924077B2EF078AC774A9D73.jar
- /data/data/####/app_dex/utopay_icon.gif
- /data/data/####/databases/utopay.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/databases/database-journal
- /data/data/####/shared_prefs/report.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/device_authenticity.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/Wimipay_System.xml
- /data/data/####/shared_prefs/mydata.xml
- /data/data/####/shared_prefs/aaa_online_setting_####.xml
- /data/data/####/shared_prefs/report.xml.bak
- /data/data/####/shared_prefs/MmData.xml
- /data/data/####/app_dex/utopay.dex
- /data/data/####/.lib/libexecmain.so
- /data/data/####/shared_prefs/zhangpay_sms_info.xml
- /data/data/####/shared_prefs/zhangpay_share.xml.bak
- /data/data/####/databases/utopay.db
- /data/data/####/shared_prefs/util_preference.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/databases/lepeng.db-journal
- /data/data/####/shared_prefs/Filter.xml
- /data/data/####/shared_prefs/aaa_state_####.xml
- /data/data/####/shared_prefs/zhangpay_sms_info.xml.bak
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/app_dex/utopay_close.png
- /data/data/####/shared_prefs/aaa_state_####.xml.bak
- /data/data/####/app_dex/utopay.zip
- /data/data/####/shared_prefs/aaa_header_####.xml
- /data/data/####/shared_prefs/device_authenticity.xml.bak
- /data/data/####/shared_prefs/zhangpay_share.xml
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Executes next shell scripts:
- getprop apps.customerservice.device
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
