Technical information
Malicious functions:
Prompts to install third-party applications.
Network activity:
Connecting to:
- t####.####.net
- c####.####.com
- trac####.####.net
- y####.####.com
- f####.####.me
- po####.####.com
- a####.####.com
HTTP GET requests:
- c####.####.com/group1/M02/B0/BC/qIYBAFhVrHKAJ0hrAAAVDGYoVMY022.png
- a####.####.com/config.get?app=####&keys=####&versionCode=####&versionNam...
- trac####.####.net/340/9apps-id
- a####.####.com/pushmessage.json?app=####&imei=####&versionCode=####&vers...
- a####.####.com/v3/app/com.appsnap.girls.xray.cloth.scanner.girls.body.sc...
- po####.####.com/config/winDataConfig?app=####&imei=####&versionCode=####...
- y####.####.com/m/um.htm?c=####
- po####.####.com/config?app=####&imei=####&versionCode=####&versionName=#...
- f####.####.me/mobawap/9apps_id.apk
- a####.####.com/client/check/task?app=####&versionCode=####&versionName=#...
- a####.####.com/config?app=####&versionCode=####&versionName=####&um_ch=#...
- a####.####.com/app.mustHaveApps?app=####&versionCode=####&versionName=##...
HTTP POST requests:
- t####.####.net/api/mobawap/new-api_id.php?app_name=####&api=####
- a####.####.com/user/check-increment-update.json?app=####&gzip=####&versi...
Modified file system:
Creates the following files:
- /sdcard/Systemckg/app.android.ninestore.apk
- /sdcard/.com.taobao.dp/dd7893586a493dc3
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/9appsPro/downloader/tmp/qIYBAFhVrHKAJ0hrAAAVDGYoVMY022.png.tmp
- /sdcard/.com.taobao.dp/6c709c11d2d46a7b
- /data/data/####/shared_prefs/listpacks.xml
- /sdcard/Systemckg/tmp.apk
Miscellaneous:
Executes next shell scripts:
- cat /proc/cpuinfo | grep Serial
- ls -l /system/xbin/su
- sh
Contains functionality to send SMS messages automatically.
