Technical information
Malicious functions:
Sends SMS messages:
- 10690133603: auto##2049922344##mpl_zhushou##log in with 360
Network activity:
Connecting to:
- s####.####.com
- m####.####.cn
- ope####.####.cn
- p####.####.com
- s####.####.cn
- sh####.####.com
- a####.####.cn
- p####.####.cn
- e####.####.cn
- 1####.####.236
- pro####.####.cn
- m####.####.com
- r####.####.com
- 1####.####.231
HTTP GET requests:
- e####.####.cn/b/pv?mid=####&m2=####&pid=####&cid=####&st=####&asin=####
- p####.####.com/t01336385877fba037c.jpg
- p####.####.com/dr/160_160_/t01e3daeb0c9a81fef0.png
- p####.####.com/t019f8ef4eda051d287.png
- a####.####.cn/intf.php?method=####&devtype=####&m1=####&m2=####&_t=####&model=####&sdkversioncode=####&sdkversionname=####&versioncode=####&versionnam...
- s####.####.com/static/bb7d8807c14ce990.js
- 1####.####.236/index.html
- p####.####.com/t01e77cd0609442f25a.png
- p####.####.com/d/inn/993ea226/icon-lyjd.png
- p####.####.com/t01f06bfb4f39f8c5aa.png
- ope####.####.cn/Iservice/FailOver?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=####&re...
- p####.####.com/t011ce4810dc423a03e.png
- 1####.####.231/360baohe/c.html?para=####
- p####.####.com/dr/160_160_/t01f9b42c0addddd698.png
- p####.####.com/d/inn/993ea226/icon-xwyd.png
- p####.####.com/dr/160_160_/t01713eb1ac9ffa3df8.png
- ope####.####.cn/AppStore/getIsUpdate?ext=####&pname=####&sr=####&mysrc=####&toid=####&sa=####&inma=####&launcher=####&isnle=####&issys=####&vid=####&p...
- p####.####.com/t0133c4e21bc6d438b3.png
- p####.####.com/t01dab635c0d09449f1.jpg
- s####.####.cn/appstore/info.htm?jackUrl=####&jackHost=####&hijackType=####&st=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m...
- p####.####.com/t015ea3c3ecba74bf90.png
- s####.####.cn/360baohe/c.html?para1=J####
- p####.####.com/t01427f9bce73c0f368.png
- ope####.####.cn/iservice/pluginStatus?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=###...
- ope####.####.cn/AppPrivMap/getPrivMap?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=###...
- p####.####.com/dr/160_160_/t017f7a3707598102dc.png
- p####.####.com/dr/160_160_/t01a8fe30cb424d88ad.png
- ope####.####.cn/AppStore/getHotWordsIconsOfSearch?pos=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&pp...
- sh####.####.com/160812/198a24f34b6e80650ee011ac08cac3de/9471e1fbfd3b656d?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=#...
- m####.####.cn/baohe/list?version=####&toid=####&pst=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=...
- p####.####.com/t01bed22d225a375da4.png
- p####.####.com/t01fd6315e0ed6c48f0.png
- p####.####.com/t018c822583f9eb3a40.jpg
- p####.####.com/t01656c8b102705e16b.png
- p####.####.com/d/inn/993ea226/icon-final.png
- ope####.####.cn/iservice/getAppDetail?s_stream_app=####&market_id=####&sort=####&pname=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&c...
- sh####.####.com/160812/198a24f34b6e80650ee011ac08cac3de/9471e1fbfd3b656d
- s####.####.com/d/inn/29d33a88/icon-game.png
- p####.####.com/t01e89d596cefabd546.png
- ope####.####.cn/toolsManger/list?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=####&re=...
- p####.####.com/d/inn/993ea226/icon-gwyh.png
- s####.####.com/static/bb0ef614c3cccef6.css
- ope####.####.cn/Must/index?callback=####&_=####
- m####.####.com/cfg/appkey-cf6b551afe338f43
- p####.####.com/t010499d2c8bab97aaf.png
- p####.####.com/d/inn/993ea226/icon-yyst.png
- p####.####.com/dr/160_160_/t012db2bee5fb7dc814.png
- ope####.####.cn/webviewjs/rule?domain=####&operator=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=...
- a####.####.cn/intf.php?method=####&model=####&sdkversioncode=####&sdkversionname=####&versioncode=####&versionname=####&appid=####&_token=####&apivers...
- p####.####.com/dr/160_160_/t012dd4a12318ef0917.png
- p####.####.com/t0180e9262f0b036868.png
- ope####.####.cn/iservice/appJar?v=####&jvn=####&jvc=####
- p####.####.com/t01bb6912aca33f6f96.png
- r####.####.com/360baohe/download.php?resurl=####&m=####&m2=####&nt=####&snt=####&ntt=####&sntt=####&isWifi=####&isData=####&isMeter=####&canUseDataNet...
- p####.####.com/dr/160_160_/t012242627b6348049b.png
- p####.####.com/t01335dd474eaffbd08.png
- p####.####.com/t010a85718b1965a9bf.png
- ope####.####.cn/webviewjs/domainlist?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=####...
- p####.####.com/t01b0ceb13f1b361fb3.png
- p####.####.com/dr/160_160_/t015d940d8ed605a7f9.png
- ope####.####.cn/HuajiaoCtl/getZsSwitch?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=##...
- ope####.####.cn/inew/getRecomendApps?iszip=####&logo_type=####&deflate_field=####&bannertype=####&apiversion=####&del_header=####&ch=####&prepage=####...
- p####.####.com/dr/160_160_/t018a2e206242418929.png
- pro####.####.cn/profile/setting/getsetting?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCoun...
- s####.####.cn/zhushou/soft.html?u=####&ver=####&mid=####&cid=####&from=####&act=####&sid=####&market_id=####&pos=####&tj=####&refer=####&_=####
- ope####.####.cn/html/data/save_uninstall.json
- ope####.####.cn/Iservice/ServerConfig?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=###...
- ope####.####.cn/Cloud/getSoConf?name=####&so_ver=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=###...
- ope####.####.cn/html/downprize/zjbb.html?&showTitleBar=####&webpg=####&fcode=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=...
- p####.####.com/dr/160_160_/t01312696d79fceec36.png
- s####.####.cn/ak/3416a75f4cea9109507cacd8e2f2aefc.html?m2=####
- ope####.####.cn/Iservice/GetIndexHeader?iszip=####&logo_type=####&deflate_field=####&bannertype=####&apiversion=####&prepage=####&curpage=####&os=####...
HTTP POST requests:
- ope####.####.cn/NecessaryInstalled/checkPop?appnum=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=#...
- ope####.####.cn/mintf/getAppsByPackNames?src=####&&silent=####&plugver=####&callFrom=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2...
- p####.####.cn/pstat/plog.php
- p####.####.cn/update/update.php?p=####
- e####.####.cn/b/pv?&st=####&m2=####&model=####&mid=####
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/crash.xml
- /data/data/####/shared_prefs/PermissionMap.xml
- /data/data/####/files/rooter.jar
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/89/t29IkpRqZbjq4mQf2Krm8TBsHc8.1047821958.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/28/eTHId-sByvazJwRAUeQ27MeNnwc.-1075724518.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/46/Act8M01caFRTRwu6vyhB3EayieU.1501578020.tmp
- /sdcard/360Log/downloadLog_delegate
- /sdcard/Android/data/####/cache/webview/-417734721902276924
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/Android/data/####/cache/http/-627246689-287423486
- /data/data/####/shared_prefs/multidex.version.xml
- /sdcard/Android/data/####/cache/.nomedia
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/82/ZPIvUkG90bkvSDFYbkOUNmfb_rg.-27959441.tmp
- /sdcard/360Download/so_imagepipeline_1.apk.temp
- /data/data/####/files/dir_uninstallretain_pic/pic_5.png
- /data/data/####/files/dir_uninstallretain_pic/pic_6.png
- /data/data/####/shared_prefs/event_config.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/dir_uninstallretain_pic/pic_4.png
- /data/data/####/shared_prefs/LifeHelper.xml
- /data/data/####/shared_prefs/share_data.xml
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/localApkInfo.json
- /data/data/####/databases/new_downloads.db-journal
- /data/data/####/files/libsucore.so
- /sdcard/360Log/downloadLog_statMan
- /data/data/####/files/libsuav_nopie.so
- /data/data/####/shared_prefs/clear_shortcut.xml
- /sdcard/Android/data/####/cache/http/-830613607-1992728753
- /data/data/####/databases/new_downloads.db
- /data/data/####/databases/360appstoreInstallHistory.db
- /sdcard/360Log/downloadLog_main
- /data/data/####/shared_prefs/battery.xml
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/94/9zVSYJk_rIaA_59xF423BEfMSLc.971446553.tmp
- /data/data/####/files/dir_uninstallretain_pic/pic_2.png
- /data/data/####/files/dir_uninstallretain_pic/pic_3.png
- /data/data/####/shared_prefs/game_redirect.xml
- /data/data/####/files/personal_center_setting_new
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes-107741789.zip
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/1/_pxuOEbaE9gM-i1BXJKQggs_75c.-1364676583.tmp
- /data/data/####/databases/ignoreupdate_appinfo.db
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/24/Jm_HGLBYsksXmZdsADJaJ4Yiel8.-348542854.tmp
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000002
- /sdcard/Android/data/####/cache/http/-830439275-1272045569
- /sdcard/360Download/so_imagepipeline_1.apk.temp!
- /data/data/####/files/uninstallRetainJson
- /data/data/####/shared_prefs/MATSharedPreferences.xml
- /sdcard/temp.tmp~
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/27/eCdd2RocquYVvWpQqMt3yDExfxY.1873455472.tmp
- /data/data/####/shared_prefs/crash.xml.bak
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/62/ou3ENmp8miGiPYbeGMsjEucHSGA.-2092506131.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/31/0RV5TOmI4bFfn4sg6FgXaDwcq-E.2081018136.tmp
- /sdcard/Android/data/.nomedia
- /data/data/####/files/dir_uninstallretain_pic/pic_8.png
- /data/data/####/databases/filelist.db-journal
- /data/data/####/files/dir_uninstallretain_pic/pic_1.png
- /data/data/####/databases/update_history.db
- /data/data/####/databases/account.db-journal
- /data/data/####/databases/update_history.db-journal
- /data/data/####/shared_prefs/save_myself_config.xml
- /data/data/####/files/dir_uninstallretain_pic/pic_9.png
- /sdcard/360Log/downloadLog_p2p
- /data/data/####/downloadStat.json
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/48/9CFE7JwNTRsxsRnGxXMa7l7-XXI.747578757.tmp
- /data/data/####/files/imagepipeline_1.so
- /data/data/####/databases/download5.db-journal
- /data/data/####/shared_prefs/BaoHe_only_pref.xml.bak
- /data/data/####/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/73/4NifoTVm7IB0SseIISmPc1o2ryY.-915571128.tmp
- /data/data/####/databases/_ire-journal
- /data/data/####/shared_prefs/BaoHe_only_pref.xml
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/54/iEov_RP38-h3PHjNEMHIL0NI_7k.-2031248725.tmp
- /data/data/####/shared_prefs/PermissionMap.xml.bak
- /data/data/####/databases/account.db
- /data/data/####/files/temp.tmp~
- /data/data/####/files/dir_uninstallretain_pic/pic_7.png
- /data/data/####/shared_prefs/share_data.xml.bak
- /data/data/####/files/pluginconfigcache
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/12/epNxfWqSXEjKlpAsPOX9XAT6qCI.1736193634.tmp
- /sdcard/Android/data/####/cache/http/2048943908952570089
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/12/n-5uw0M4qbBjeKk81wT_MuMUUXk.-956483043.tmp
- /data/data/####/databases/360appstoreInstallHistory.db-journal
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/19/363kUs5DTkKfQaB-6xl1TfcCqeU.337605369.tmp
- /data/data/####/shared_prefs/MATSharedPreferences.xml.bak
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/89/EYTb5IV211UUA56MkwiPTKqiqtQ.-1164831931.tmp
- /data/data/####/databases/ignoreupdate_appinfo.db-journal
Sets the 'executable' attribute to the following files:
- /data/data/####/files/libsuav_nopie.so
Miscellaneous:
Executes next shell scripts:
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.88
- su
- pm list packages
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 106.120.160.207
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.208
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 111.13.65.243
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.
