Technical information
Malicious functions:
Sends SMS messages:
- 106584211: 5fd3bec6c0a86a404271828230574330M302000A免费登录短信，请勿修改
Network activity:
Connecting to:
- h####.####.com
- 1####.####.197:8080
- 7x####.####.com
- obf0c####.####.com
- w####.####.com
- haoh####.cn
- 1####.####.197
- i####.####.cn
- haoh####.cn:8080
- a####.####.com
HTTP GET requests:
- 1####.####.197/pubres/downloadzipv1/3x9/39x2/392x5/392554581/2-392554588...
- w####.####.com/r/p/myspacedata.jsp?vt=####&aaa_flag=####
- a####.####.com/v1/bulletin/android/4.0.2
- a####.####.com/static/data/recommend-images/VkKIelb1Rh.jpg
- a####.####.com/v1/apps/store-control
- obf0c####.####.com/visenvt9_9_20160808104730.zip
- 7x####.####.com/zip/payjar_-1_20170423120749.zip
- 1####.####.197:8080/pubres/downloadzipv1/3x9/39x2/392x5/392554581/2-3925...
- a####.####.com/static/data/android-config.json
- a####.####.com/v3/recommend/android
- i####.####.cn/iplookup/iplookup.php?format=####
- w####.####.com/sso/p/logindata.jsp?e_l=9&purl=/r/p/myspacedata.jsp?aaa_f...
- a####.####.com/static/data/recommend-images/i7jHZEz8RT.jpg
HTTP POST requests:
- haoh####.cn/asg/portal.do
- h####.####.com/app.gif
- haoh####.cn:8080/asg/portal.do
Modified file system:
Creates the following files:
- /data/data/####/cache/volley/-118490680-1826513182
- /sdcard/.ishugui/books/393365243/393365246.kf
- /data/data/####/shared_prefs/Cookies250026699187743.xml
- /sdcard/Anyview/res/front-covers/cache/1b81a72ca481a3e751edee463b557f92
- /sdcard/Anyview/res/front-covers/cache/81202b14753a3b91bfcec5ff5e301e7d
- /sdcard/.ishugui/books/384206990/bookinfo.bat
- /data/data/####/files/Reports/1493317692942
- /sdcard/.ishugui/books/389064355/389071023.kf
- /data/data/####/cache/volley/-1184906801784778293
- /sdcard/Anyview/res/front-covers/cache/b6650b48bc8958797dfcdd7601ee1559
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/.ishugui/books/393365243/393365245.kf
- /sdcard/.ishugui/books/346865084/bookinfo.bat
- /data/data/####/files/__local_stat_cache.json
- /sdcard/.ishugui/books/1493317703178.tmp
- /sdcard/.ishugui/books/346865084/346865088.kf
- /data/data/####/files/__local_ap_info_cache.json
- /sdcard/.ishugui/books/393365243/393365247.kf
- /data/data/####/databases/history.db
- /sdcard/.ishugui/books/2-392554588-392554589_392554581.zip
- /sdcard/.system/confv9/visen.conf
- /data/data/####/shared_prefs/MonitoringServicesPrefs.xml
- /sdcard/.ishugui/books/388798774/388801254.kf
- /data/data/####/shared_prefs/JsonReportPrefs.xml
- /sdcard/Anyview/temp/361579171.tmp
- /sdcard/.ishugui/books/374125360/374125362.kf
- /data/data/####/shared_prefs/MonitoringServicesPrefs.xml.bak
- /sdcard/.ishugui/.log/reqlog.txt
- /data/data/####/shared_prefs/shared_preferences.xml
- /sdcard/.ishugui/books/377284115/377284120.kf
- /sdcard/.ishugui/books/392554581/392554584.kf
- /sdcard/.ishugui/books/392554581/392554589.kf
- /sdcard/.ishugui/books/2-392554586-392554587_392554581.zip
- /sdcard/.ishugui/Cache/2e6ex4z6ht006fka06av34j3k
- /sdcard/.ishugui/Cache/35sqqz6orxc4v73vnpr284k5e
- /sdcard/Anyview/res/front-covers/cache/03d63a8677be215567e8bc002e1c9e01
- /sdcard/.ishugui/books/392554581/392554587.kf
- /data/data/####/shared_prefs/conf_sp_name.xml
- /sdcard/.ishugui/payerr.txt
- /data/data/####/databases/intercept_pad.db-journal
- /sdcard/.ishugui/books/377284115/377284119.kf
- /sdcard/.system/confv9/visen.conf.temp
- /sdcard/.ishugui/books/388798774/388801253.kf
- /data/data/####/shared_prefs/4.0.2.xml
- /sdcard/Android/data/####/cache/.nomedia
- /sdcard/.ishugui/books/389064355/389071025.kf
- /data/data/####/shared_prefs/CacheLoader.xml
- /sdcard/.ishugui/books/392554581/392554585.kf
- /data/data/####/shared_prefs/ishugui.shareInfo.xml
- /data/data/####/shared_prefs/store_control.xml
- /sdcard/Anyview/temp/user_expierence.data
- /sdcard/.ishugui/books/404944122/bookinfo.bat
- /sdcard/.ishugui/books/388798774/bookinfo.bat
- /sdcard/.ishugui/books/374125360/374125364.kf
- /sdcard/.ishugui/books/392554581/392554588.kf
- /sdcard/.ishugui/books/346865084/346865087.kf
- /data/data/####/databases/ishugui.db-journal
- /data/data/####/databases/history.db-journal
- /sdcard/.ishugui/books/374125360/bookinfo.bat
- /data/data/####/shared_prefs/ishugui.shareInfo.xml.bak
- /sdcard/.ishugui/Cache/4ench0d3fs1ljc2as4bpjjc06
- /sdcard/Android/data/.nomedia
- /sdcard/.ishugui/books/389064355/389071024.kf
- /sdcard/.ishugui/books/404944122/404944125.kf
- /sdcard/.ishugui/books/384206990/384209243.kf
- /sdcard/.system/confv9/visen.conf.mark
- /sdcard/Anyview/chapters/-1337991640.chapters
- /sdcard/.ishugui/books/384206990/384209245.kf
- /sdcard/.ishugui/Cache/12xscl4m6z5nhop040m4254uh
- /sdcard/.ishugui/Cache/5wu8zq2cpiqxjqci92hyu23jp
- /sdcard/.ishugui/books/389064355/bookinfo.bat
- /sdcard/Anyview/res/front-covers/cache/b30cf89c41cb57c3b687092ab2c6296d
- /sdcard/.ishugui/Cache/438423fl0bw9ix5vtkj2iauyv
- /sdcard/Anyview/res/front-covers/covers_default.zip.res
- /sdcard/.ishugui/Cache/26zocw83tp6wrfpnke3mfigch
- /data/data/####/files/__local_last_session.json
- /sdcard/.ishugui/books/1493317725126.tmp
- /sdcard/.ishugui/books/346865084/346865086.kf
- /sdcard/.ishugui/books/392554581/392554586.kf
- /data/data/####/shared_prefs/app_theme_preferences.xml
- /sdcard/.ishugui/books/388798774/388801255.kf
- /sdcard/.ishugui/books/374125360/374125363.kf
- /sdcard/.ishugui/books/404944122/404944124.kf
- /sdcard/Anyview/res/front-covers/cache/0ec9b7b243bc781c08a257d1aba61809
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/Anyview/res/xmls/Env_Config.xml
- /data/data/####/files/Reports/1493317692921
- /sdcard/Anyview/sys/.recsv3
- /sdcard/.ishugui/books/384206990/384209244.kf
- /sdcard/Anyview/res/front-covers/cache/c624fe48b45725f1ce6ad54782fdc607
- /sdcard/.ishugui/books/377284115/377284118.kf
- /sdcard/.ishugui/Cache/5jw4rqqoawz35iihfff09kysk
- /sdcard/Anyview/temp/392554581/392554584
- /sdcard/Anyview/temp/392554581/392554585
- /sdcard/Anyview/temp/392554581/392554586
- /sdcard/.ishugui/books/393365243/bookinfo.bat
- /sdcard/Anyview/temp/392554581/392554583
- /sdcard/.system/confv9/visen.conf.out.temp
- /sdcard/.system/confv9/paydex.dzlib.temp
- /sdcard/.ishugui/books/392554581/bookinfo.bat
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- /sdcard/baidu/.cuid
- /sdcard/.ishugui/books/404944122/405593636.kf
- /sdcard/Anyview/temp/-658672869.tmp
- /sdcard/.ishugui/books/377284115/bookinfo.bat
- /data/data/####/shared_prefs/setting_preferences.xml
- /sdcard/.ishugui/Cache/5k48ekx4mbso0yln05pf6cxkl
- /sdcard/.ishugui/books/392554581/392554583.kf
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 94 40 390064 /storage/emulated/0/.system/confv9/paydex.dzlib 1251434669 -1857557483 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f
Contains functionality to send SMS messages automatically.
