Technical information
Malicious functions:
Sends SMS messages:
- 12114516412: maimobbvzWKuFJTpjDbypWqh9wjiLAM1TjCkUX4wyfMO4DW1I!o2IENzojcbkhi50UMcbTAtgnd34UNIEzpSQAIzb60UP
- 12114516412: maimobbZqWXVFSZpMMbG5WXG9pSibIMCWjv!USjwJhMrTDSLIaW2RINbyjnWktF5W5Mm9TJzgD!3koNiSzspQ4Pz9n0LY
Network activity:
Connecting to:
- s####.####.com
- g####.####.com
- c####.####.net
- mmoc####.####.com:8088
- s####.####.com:4001
- g####.####.com:18001
- mmoc####.####.com
- apm-col####.####.com
- p####.####.cn
- w####.####.com
- m####.####.com
- 2####.####.233
- 2####.####.233:8080
HTTP GET requests:
- m####.####.com/course/431514.html?dataSrcId=####&sqId=####&cm=####
- w####.####.com/r/l/n.jsp?nid=####&vt=####&ln=####&dataSrcId=####&sqId=####&cm=####
- m####.####.com/p/retrieval_new.jsp?parentId=####&subClassId=####&ord=####&sort=####&dataSrcId=####&sqId=####&cm=####
HTTP POST requests:
- c####.####.net/config/update
- s####.####.com/ymsdkv1/api05
- p####.####.cn/index.php/API
- mmoc####.####.com:8088/smspay/bill_init
- mmoc####.####.com/smspay/bill_init
- apm-col####.####.com/cpi/crash
- g####.####.com:18001/clienteventlv
- 2####.####.233/
- s####.####.com:4001/ymsdkv1/api05
- g####.####.com/clienteventlv
- 2####.####.233:8080/
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/CobubRazor_SharedPref.xml
- /data/data/####/shared_prefs/TestinCrash.xml.bak
- /data/data/####/files/ymsdk_01.jar
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/files/comssttbyxlj
- /data/data/####/databases/dataeye_database_C9034F0A2763EC373E918F17F4DB2C11.db-journal
- /sdcard/.comssttbyxlj
- /data/data/####/databases/TestinAgent.db-journal
- /data/data/####/databases/dataeye_database_C9034F0A2763EC373E918F17F4DB2C11.db
- /data/data/####/databases/TestinAgent.db
- /data/data/####/cache/cobub.cache
- /data/data/####/databases/jrnewad3.db-journal
- /data/data/####/shared_prefs/.tpns.xml.xml
- /data/data/####/files/libymsdk_21035.so
- /sdcard/.SystemService/C9034F0A2763EC373E918F17F4DB2C11/uid
- /data/data/####/shared_prefs/device_id.xml
- /data/data/####/shared_prefs/dc.C9034F0A2763EC373E918F17F4DB2C11.preferences.xml
- /sdcard/Tencent/mta/.mid.txt
- /data/data/####/databases/mp.db-journal
- /data/data/####/databases/mp.db
- /data/data/####/shared_prefs/JOYPUSH_PREFS.xml
- /data/data/####/shared_prefs/TestinCrash.xml
- /data/data/####/shared_prefs/dc.C9034F0A2763EC373E918F17F4DB2C11.preferences.xml.bak
Miscellaneous:
Executes next shell scripts:
- /data/data/####/lib/libtpnsWatchdog.so ####,2100183303;####,2100183303; 55861 203.205.128.130 [{"idx":0,"ts":%d,"et":2000,"si":0,"ui":"####","ky":"Axg%lu","mid":"3c6992750fac083c4de5ae8480a0cf296f93dcbe","ev":{"
- /system/bin/sh
- logcat -t 100 -v time
- /data/data/####/lib/libtpnsWatchdog.so ####,2100183303; 55861 203.205.128.130 [{"idx":0,"ts":%d,"et":2000,"si":0,"ui":"####","ky":"Axg%lu","mid":"0","ev":{"ov":"18","sr":"800*552","md":"Generic Android-x86","lg":"en","sv":
Contains functionality to send SMS messages automatically.
