Technical information
Malicious functions:
Sends SMS messages:
- 12114516416: ####A
Network activity:
Connecting to:
- s####.####.com
- pa####.####.cn
- ne####.####.com
- pass####.####.cn
- pa####.####.cn:1001
- s####.####.net
- i####.####.cn
- a####.####.com
HTTP GET requests:
- s####.####.com/tysy/t122.mp4
- ne####.####.com/icons/201603//17/0b9a/56eab218c76da.jpg
- s####.####.com/versioncheck.aspx?
- ne####.####.com/icons/201603//17/9a31/56eab6108f0c1.jpg
- ne####.####.com/wp-content/uploads/2016/08/57a54e7743018-2-300x168.jpg
- i####.####.cn/iplookup/iplookup.php?format=####
- s####.####.net/v2/?qt=####
- pass####.####.cn/client/authRequest
- ne####.####.com/icons/201603//17/9dda/56eab663eed0a.jpg
- ne####.####.com/icons/201603//17/b667/56eab0b310eed.jpg
- ne####.####.com/icons/201603//28/b402/56f8ba0954f7f.jpg
- ne####.####.com/icons/201603//17/40c4/56eab5979abe1.jpg
- s####.####.com/GetFeeData.aspx?iswifi=####
- ne####.####.com/wp-content/uploads/2016/07/zsq63.jpg
- ne####.####.com/wp-content/uploads/2016/08/zsq10.jpg
- pa####.####.cn/Interface/appconfig.ashx?config_ver=####&sid=####&cid=####
- ne####.####.com/icons/201603//17/d658/56eab486ce41b.jpg
- s####.####.com/getconfig.aspx?
- ne####.####.com/wp-content/uploads/2016/07/zsq78.jpg
- ne####.####.com/wp-content/uploads/2016/10/t122-300x168.jpg
- ne####.####.com/icons/201603//17/ef15/56eab53bc35f2.jpg
- ne####.####.com/icons/201603//17/4564/56eab2bf8310f.jpg
- ne####.####.com/icons/201603//17/eaad/56eab376e75d1.jpg
- ne####.####.com/icons/201603//17/145b/56eab32cca55c.jpg
- s####.####.net/v2/?qt=####&class=####
- ne####.####.com/icons/201603//28/39fa/56f8ba86b7873.jpg
- pa####.####.cn:1001/app_config.js
HTTP POST requests:
- a####.####.com/app_logs
- pa####.####.cn/Interface/tuidata.ashx?action=####
Modified file system:
Creates the following files:
- /data/data/####/databases/cc.db-journal
- /data/data/####/databases/ua.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/databases/cc.db
- /data/data/####/cache/image_manager_disk_cache/fa8e1b2b89bc31786e268b06d74458d24fe777b8158fe9e43acbdba8dd803cd3.0.tmp
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/cache/image_manager_disk_cache/2c974e27cda16c659575e87d854fe3e8f64797ba7652d6b3996f22db1882ca4a.0.tmp
- /data/data/####/databases/ua.db-journal
- /data/data/####/cache/image_manager_disk_cache/0c89a9f2a44ca9d192a5d6e48389f935d3296dc6a134a1eb7f3be4698d09d4c8.0.tmp
- /data/data/####/cache/image_manager_disk_cache/c44a1a6f6eb214812c60c417dba2069eec5c4516fa9cef65b6134994677a2b85.0.tmp
- /sdcard/pvnew/app_acshe/152133104.0
- /data/data/####/cache/image_manager_disk_cache/62f081a4ca10b247fd417dc65b2476c0911be079ead57eda00173336d3381f70.0.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/libats.lock
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/files/.imprint
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/cache/image_manager_disk_cache/4f9ee4d8d6439165ea25296ed606b4e74a881c5172e6835b38129827ab8de557.0.tmp
- /data/data/####/shared_prefs/ui.xml
- /data/data/####/cache/image_manager_disk_cache/d7b7265cc3844f6d763b6159eb16ffae0847e701587de42440589cf1ff948718.0.tmp
- /data/data/####/files/exid.dat
- /data/data/####/cache/image_manager_disk_cache/9ba8ca18f74066c4b1331b9c47f2baeafee5fd4e62b2c7bc05dcfe29f5ad2c0a.0.tmp
- /data/data/####/cache/image_manager_disk_cache/a5679e2559ba62a616d7a33af000bfe72fb1c99a74a3a8f64158125af07c09e9.0.tmp
- /data/data/####/cache/image_manager_disk_cache/2a1d4b16e743037fb33ecacab13a24e193af9b37f2d500d0332c73ba9757d5cf.0.tmp
- /data/data/####/databases/db_feeList
- /data/data/####/cache/image_manager_disk_cache/d5fd56cdaf14167641debd7aa009b2c1c53f54b98a31b08ce848330020e39c74.0.tmp
- /data/data/####/files/umeng_it.cache
- /sdcard/pvnew/app_acshe/-870629250.0
- /data/data/####/cache/image_manager_disk_cache/c7bebf98813a3fd5164015a3ee689a2789e3cdd1113b5aa9bdc5ac9c446f2067.0.tmp
- /sdcard/pvnew/app_acshe/-870629249.0
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/databases/db_feeList-journal
- /data/data/####/shared_prefs/ui.xml.bak
- /data/data/####/cache/image_manager_disk_cache/4a6ebbcee87ff7327ca37e33348c3661587b87bac4ac4c59ee7d843a5a111c05.0.tmp
- /data/data/####/cache/image_manager_disk_cache/263e913c3d4b1cebe544ae89c8d1c915803dc197b823bde3989ffa992df45e78.0.tmp
- /sdcard/pvnew/app_acshe/journal.tmp
- /data/data/####/cache/image_manager_disk_cache/917167f91bec6446690acd1620b42371bc3a310be0b82716d17a4bd41ca7d23c.0.tmp
- /data/data/####/cache/image_manager_disk_cache/journal.tmp
- /data/data/####/cache/image_manager_disk_cache/359deb88293d4e179f4196e198e0220dfb7ede0c1fe10d416634e47b72fa474b.0.tmp
- /data/data/####/cache/image_manager_disk_cache/bcbec875b72e7c5adb43d5eda9b9c4edada7b52aad0b5c90dd5c71430fb40a22.0.tmp
- /data/data/####/shared_prefs/RuntimeSetting.xml
Miscellaneous:
Contains functionality to send SMS messages automatically.
