Technical information
Malicious functions:
Sends SMS messages:
- 12114516389: ####
Executes code of the following detected threats:
- Android.Triada.151.origin
Network activity:
Connecting to:
- s####.####.com
- g####.####.pw:6801
- t####.####.top:701
- i####.####.cn
- t####.####.top
HTTP GET requests:
- s####.####.com/sdk/mobileNum?imsi=####
- s####.####.com/sdk/rootReport/getDesUrlNew.action?&imei=####&osver=####&...
- s####.####.com/sdk/gameSdkInfo/getPayInfo.action?parck_id=####&imei=####...
HTTP POST requests:
- t####.####.top/kitmain.aspx
- s####.####.com/sdk/init
- t####.####.top:701/kitmain.aspx
- s####.####.com/sdk/afdf
- s####.####.com/sdk/activate
- g####.####.pw:6801/zrmain.aspx
- i####.####.cn/iplookup/iplookup.php?format=####
Modified file system:
Creates the following files:
- /sdcard/sdtmp/id27ca64946-21c8-4417-a30b-defc9857c51a.tmp
- /sdcard/ztylog_v.txt
- /data/data/####/app_devid/uuid3
- /sdcard/sdtmp/id14260c8bf-6e2f-4f2b-9eef-d5354fe67ff8.tmp
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/sdtmp/id12f0d3b5b-ca92-4a32-87cf-8c0215b8804f.tmp
- /data/data/####/databases/database-journal
- /sdcard/.uct/uuid32aa326b9-b505-466b-be07-c7f63dc602e9.tmp
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/rtparam2.xml
- /sdcard/tmpsd11012/test.dat2d41138b-b556-4749-bdd3-685b139198c8.tmp
- /data/data/####/app_px/p6.apk
- /sdcard/sdtmp/id2875396fd-8dbc-461c-89d5-d56cbf6e7a8b.tmp
- /data/data/####/shared_prefs/zhangpay_sms_info.xml
- /data/data/####/shared_prefs/pre_blin_status.xml
- /data/data/####/shared_prefs/ZTY.xml
Miscellaneous:
Executes next shell scripts:
- ls -l /system/bin/su
- /system/bin/.nbwayxwzt
- cat /sys/class/net/wlan0/address
- conbb od2gf04pd9
Contains functionality to send SMS messages automatically.
