Technical information
Malicious functions:
Sends SMS messages:
- 1069013352371: SWA#383937303130323636393931383737343336
Network activity:
Connecting to:
- s####.####.com
- 7j####.####.com
- c-h####.####.com
- d####.####.com
- st####.####.com
- a####.####.com
- pass####.####.com
HTTP GET requests:
- st####.####.com/cms/upload/generalHeadline/201611/2016111111253646.png
- st####.####.com/cms/upload/generalHeadline/201705/2017050217033694.jpg
- a####.####.com/location/ip?ak=####
- st####.####.com/cms/upload/generalHeadline/201608/2016081609472489.jpg
- st####.####.com/cms/upload/generalHeadline/201608/2016081918101475.jpg
- st####.####.com/appSpace/0/0/0/85/110/icon.png
- st####.####.com/appSpace/0/0/233/233266/1/icon.png
- st####.####.com/appSpace/0/0/234/234101/303/icon.png
- s####.####.com/actionimp.json?game_id=####&server_id=####&act_id=####&ac...
- st####.####.com/cms/freestore/systemConf/splash/1493367579337.jpg
- st####.####.com/cms/upload/generalHeadline/201611/2016111111252777.png
- st####.####.com/cms/upload/generalHeadline/201609/2016092316473443.jpg
- st####.####.com/cms/upload/homepage/201608/2016081616091564.png
- st####.####.com/cms/upload/generalHeadline/201611/2016111015451094.jpg
- st####.####.com/appSpace/0/0/233/233802/16/icon.png
- st####.####.com/cms/upload/generalHeadline/201608/2016081515151533.jpg
- st####.####.com/appSpace/0/0/167/167982/1920/icon.png
- st####.####.com/cms/upload/generalHeadline/201608/2016081918105987.jpg
- st####.####.com/appSpace/0/0/168/168109/108340/icon.png
- s####.####.com/config/hz-hzv3.conf
- st####.####.com/cms/upload/generalHeadline/201608/2016081609474480.jpg
- st####.####.com/cms/upload/generalHeadline/201608/2016081513171340.png
- st####.####.com/cms/upload/generalHeadline/201609/2016092316481679.jpg
- 7j####.####.com/tdata_oIB717
- st####.####.com/cms/upload/generalHeadline/201705/2017050215202094.png
- st####.####.com/appSpace/0/0/0/88/8/icon.png
- st####.####.com/cms/upload/generalHeadline/201608/2016081513162422.png
- st####.####.com/appSpace/0/0/233/233501/1006/icon.png
- 7j####.####.com/tdata_IJr270
- st####.####.com/cms/upload/kuwanHomepage/201607/2016071516194794.jpg
- st####.####.com/cms/upload/generalHeadline/201608/2016081918103714.jpg
- st####.####.com/cms/upload/generalHeadline/201611/2016111016300582.jpg
- st####.####.com/cms/upload/generalHeadline/201608/2016081515162725.jpg
- st####.####.com/cms/upload/generalHeadline/201611/2016111016054883.jpg
- st####.####.com/appSpace/0/0/234/234301/10009248/icon.png
- st####.####.com/cms/upload/generalHeadline/201611/2016111111254416.png
- st####.####.com/game/0/0/0/73/19/com.snailgame.lineage.snail_19.apk
- st####.####.com/cms/upload/generalHeadline/201608/2016083109541574.jpg
- st####.####.com/appSpace/0/0/0/73/19/icon.png
HTTP POST requests:
- s####.####.com/api.php?format=####&t=####
- d####.####.com/_event.gif
- pass####.####.com/fbi/passport/mobile/queryImsi.do
- pass####.####.com/passport/queryConfig.do
- a####.####.com/app_logs
- c-h####.####.com/api.php?format=####&t=####
Modified file system:
Creates the following files:
- /data/data/####/files/push.pid
- /data/data/####/files/tdata_IJr270.jar
- /data/data/####/files/init.pid
- /data/data/####/databases/pushsdk.db-journal
- /sdcard/libs/com.getui.sdk.deviceId.db
- /data/data/####/files/tdata_oIB717.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/65/Ck9iiCYUblvI-bNb1KK-fgZ9EEI.755122889.tmp
- /sdcard/Android/data/####/cache/252053345210747322
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes129400501.zip
- /data/data/####/cache/image_cache/v2.ols100.1/94/dsa076rB1aUqD7_b50v-BJ5tyvc.713278941.tmp
- /data/data/####/files/a/e/92121862957078.0
- /data/data/####/cache/image_cache/v2.ols100.1/0/kSmijoMowPzjdoHz_-8NHDm3AoM.-329240375.tmp
- /data/data/####/files/gdaemon_20161017
- /sdcard/FreeStore/.Image/71fde94a3f98e38bb19d7b2d6086dfeb
- /data/data/####/cache/image_cache/v2.ols100.1/11/ed4aZUcnFn4flaXE-jRG1Xm2X6c.1922433580.tmp
- /data/data/####/shared_prefs/freeStoreXmlData.xml.bak
- /data/data/####/databases/pushext.db-journal
- /data/data/####/cache/image_cache/v2.ols100.1/64/dujsM7Nd5DiS14T4t8TAVxegtjQ.-1191953616.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/65/nmDuuhetk86IzNInYm9foeTd-Ac.-1723585600.tmp
- /sdcard/Android/data/####/cache/-1531562973540212463
- /data/data/####/cache/image_cache/v2.ols100.1/2/DLCalg2e8oigVY6zgzb1wnhwFuE.-1975380857.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/64/LxDPVvQCo4i1vqC4ZlIDg4qFm_4.115618681.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/23/0nFmigH8HUoeamsBWyoZ7w8790o.1484514715.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/81/llXLBOQsD-_aDf9yUX_2FGnR_do.1193019226.tmp
- /data/data/####/databases/tmpd8.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/run.pid
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /data/data/####/files/tdata_IJr270.tmp
- /data/data/####/databases/hmdb
- /data/data/####/cache/image_cache/v2.ols100.1/16/Bompqvg1-sEOvTJJpO2e6_kYGDw.-748682853.tmp
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/Android/data/####/cache/1211366931190924088
- /sdcard/SnailLogin/System/U25haWxMb2.json
- /data/data/####/files/.imprint
- /data/data/####/files/a/e/59121859610376.0
- /data/data/####/cache/image_cache/v2.ols100.1/95/IgSWRGAZYXvHqH95AF1GJqxnIEI.1750930123.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/6/-d5_uQus4r49_2RrC5Ezd2NsowI.-640578961.tmp
- /data/data/####/files/tdata_oIB717.jar
- /data/data/####/cache/image_cache/v2.ols100.1/77/cAXDGxsLZYAHJeNJxo8bQwlM9pE.1846048176.tmp
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/files/a/e/journal
- /sdcard/system/tmp/local/tdata_oIB717
- /data/data/####/cache/image_cache/v2.ols100.1/1/_aKMnu5WC0Dt4ztSz-HzZy8qVU8.-1644943106.tmp
- /data/data/####/databases/pushg.db-journal
- /data/data/####/databases/hmdb-journal
- /data/data/####/cache/image_cache/v2.ols100.1/53/V5HNdacKv5LC3L-u29KNdSczSs4.1017735354.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/88/sHOwKVZDDG1YqSLdRKBx-EGwGa4.-1596251922.tmp
- /data/data/####/shared_prefs/TestinAgent.xml.bak
- /data/data/####/cache/image_cache/v2.ols100.1/38/hGpk4UGBfs-4tGkfATYHz-_atDM.1037773480.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/8/HBY_1jaRYYuAozDX_SEebYK9hgQ.479384183.tmp
- /sdcard/snail/sdklog/sdklogfile.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/98/_usrjvu5YUx1lkxwxRPO6hFAn3M.-26485355.tmp
- /sdcard/libs/####.db
- /data/data/####/cache/image_cache/v2.ols100.1/95/Dk_svrYPSVKS_2TxnmU6sm1w06s.-1252485571.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/95/XQNp406T2vLfexSCMhZ1pfCO9OQ.1610653645.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/52/qliH9w7JWU6_T7l68cu6uiCI1H4.340350344.tmp
- /data/data/####/databases/logdb.db
- /data/data/####/databases/downloads.db-journal
- /sdcard/Android/data/####/cache/2520533451902232198
- /data/data/####/cache/image_cache/v2.ols100.1/14/2k6sQisNQPEpML9V7XvPutAsq40.-1764201832.tmp
- /sdcard/FreeStore/Persistent
- /data/data/####/cache/image_cache/v2.ols100.1/28/nmhctJu3lr6JkKaPD77DdfJFIUY.-1244487063.tmp
- /data/data/####/shared_prefs/freeStoreXmlData.xml
- /sdcard/libs/app.db
- /sdcard/Android/data/####/cache/1152088506-440938967
- /data/data/####/files/temp_photo.jpg
- /data/data/####/cache/image_cache/v2.ols100.1/94/yVoetBZot9f7LKA0oPcXaxpBtfE.1113673976.tmp
- /data/data/####/files/umeng_it.cache
- /data/data/####/cache/image_cache/v2.ols100.1/29/zdFwRrFe0TQw5MLz-ED8klew1vk.-392243445.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/databases/snail_app_store.db-journal
- /data/data/####/cache/image_cache/v2.ols100.1/35/djuhcHCyrZoALzBMiIX0c9fpDwE.662081295.tmp
- /sdcard/FreeStore/snail_data
- /data/data/####/databases/increment.db-journal
- /data/data/####/shared_prefs/####.SnailLogin.xml
- /sdcard/snail/snail_data_v1
- /sdcard/system/tmp/local/tdata_IJr270
- /data/data/####/shared_prefs/TestinAgent.xml
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes1438256035.zip
- /data/data/####/files/mobclick_agent_cached_####180
- /data/data/####/cache/image_cache/v2.ols100.1/18/oS6mr0TSMFwfsZJjVAQZRilsdA8.939050067.tmp
- /data/data/####/databases/statistics.db-journal
- /data/data/####/databases/logdb.db-journal
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 64 40 390900 /data/data/####/files/tdata_oIB717.jar 1231310420 -212408084 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewor
- chmod 700 /data/data/####/files/gdaemon_20161017
- /data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 24664 300 0
- /system/bin/dexopt --dex 27 40 40 1497564 /data/data/####/code_cache/secondary-dexes/####-1.apk.classes2.zip 2162688 1706343653 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /sy
- sh /data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 24664 300 0
- /system/bin/dexopt --dex 27 55 40 320248 /data/data/####/files/tdata_IJr270.jar 1233277135 1207831647 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewor
Contains functionality to send SMS messages automatically.
