Technical information
Malicious functions:
Sends SMS messages:
- 12114516389: ####
Executes code of the following detected threats:
- Android.Triada.151.origin
Network activity:
Connecting to:
- s####.####.com
- s####.####.com:8093
- t####.####.top
- s####.####.com:8080
- t####.####.top:701
- i####.####.cn
HTTP GET requests:
- s####.####.com/sdk/mobileNum?imsi=####
- s####.####.com:8093/sdk/rootReport/getDesUrlNew.action?&imei=####&osver=...
- s####.####.com/sdk/gameSdkInfo/getPayInfo.action?parck_id=####&imei=####...
- s####.####.com:8080/sdk/mobileNum?imsi=####
HTTP POST requests:
- t####.####.top/kitmain.aspx
- s####.####.com/sdk/init
- t####.####.top:701/kitmain.aspx
- s####.####.com/sdk/afdf
- s####.####.com/sdk/activate
- i####.####.cn/iplookup/iplookup.php?format=####
Modified file system:
Creates the following files:
- /sdcard/sdtmp/id175c25d77-23d8-4493-a66e-b32168459e9d.tmp
- /sdcard/sdtmp/id2ed88c7cb-3ae6-406c-92d0-12012d3911f2.tmp
- /sdcard/ztylog_v.txt
- /sdcard/tmpsd11012/test.dat419ca666-b26a-46ef-909c-6467a04b86fa.tmp
- /data/data/####/shared_prefs/ZTY.xml
- /data/data/####/app_devid/uuid3
- /sdcard/.hand/lastacc76bd9191-8b19-4392-8556-cf8dbbc015f2.tmp
- /sdcard/.hand/lastaccddf1cc09-ad24-4ea9-8d05-3a872542d547.tmp
- /data/data/####/shared_prefs/rtparam2.xml
- /data/data/####/app_px/p6.apk
- /sdcard/.uct/uuid38bf7ecae-dcc5-4bc1-a01b-a95fe2df1876.tmp
- /sdcard/sdtmp/id1aa972c8c-8000-499f-a2d3-a41985f506c6.tmp
- /sdcard/sdtmp/id29beb7203-aa7d-41d7-949b-2eca5b37c498.tmp
- /data/data/####/app_hand/lastacc
Miscellaneous:
Executes next shell scripts:
- ls -l /system/bin/su
- /system/bin/.nbwayxwzt
- cat /sys/class/net/wlan0/address
- conbb od2gf04pd9
Contains functionality to send SMS messages automatically.
