Technical information
Malicious functions:
Sends SMS messages:
- 10690010136504048: ####
Executes code of the following detected threats:
- Android.Triada.151.origin
Network activity:
Connecting to:
- s####.####.com
- s####.####.com:8093
- g####.####.pw:6801
- t####.####.top
- t####.####.top:701
- i####.####.cn
HTTP GET requests:
- s####.####.com/sdk/mobileNum?imsi=####
- s####.####.com:8093/sdk/rootReport/getDesUrlNew.action?&imei=####&osver=...
- s####.####.com/sdk/gameSdkInfo/getPayInfo.action?parck_id=####&imei=####...
HTTP POST requests:
- t####.####.top/kitmain.aspx
- s####.####.com/sdk/init
- t####.####.top:701/kitmain.aspx
- s####.####.com/sdk/activate
- s####.####.com/sdk/afdf
- g####.####.pw:6801/zrmain.aspx
- i####.####.cn/iplookup/iplookup.php?format=####
Modified file system:
Creates the following files:
- /sdcard/tmpsd11012/test.dat0560d0c9-70c4-4027-a759-f467a91d43ec.tmp
- /sdcard/ztylog_v.txt
- /data/data/####/app_devid/uuid3
- /sdcard/sdtmp/id2f37618bb-ccc2-4d34-9c23-affa074f337e.tmp
- /data/data/####/shared_prefs/rtparam2.xml
- /data/data/####/app_px/p6.apk
- /data/data/####/shared_prefs/pre_blin_status.xml
- /sdcard/sdtmp/id18974fc01-0f93-4ef4-9ce6-60724eaded08.tmp
- /sdcard/.uct/uuid3988ca5a5-41cd-45bb-a331-a04a58d16945.tmp
- /sdcard/sdtmp/id1
- /sdcard/sdtmp/id2
- /data/data/####/shared_prefs/ZTY.xml
Miscellaneous:
Executes next shell scripts:
- ls -l /system/bin/su
- /system/bin/.nbwayxwzt
- conbb od2gf04pd9
- cat /sys/class/net/wlan0/address
Contains functionality to send SMS messages automatically.
