Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.261.origin
Network activity:
Connecting to:
- 1####.####.73
- 1####.####.42:8008
HTTP GET requests:
- 1####.####.73/sms/api/getSms.php?chargingid=####&paykey=####&longcode=##...
- 1####.####.73/sapp/api/getFeeFlag.php?open=####
HTTP POST requests:
- 1####.####.73/csp/api/init
- 1####.####.42:8008/DispatchServer/Rcc
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/SDK.xml
- /data/data/####/shared_prefs/share_date_spay.xml.bak
- /data/data/####/shared_prefs/SDK.xml.bak
- /data/data/####/files/1493729374657
- /data/data/####/files/1493729374853.jar
- /data/data/####/files/dex/uz.jar
- /data/data/####/shared_prefs/setting.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/1493729375896.jar
- /sdcard/GodPK
- /data/data/####/files/1493729375764
- /data/data/####/shared_prefs/share_date_spay.xml
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 42 40 174424 /data/data/####/files/1493729375896.jar 1251248293 -1300695279 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f
- ps
- /system/bin/dexopt --dex 27 46 40 153736 /data/data/####/files/dex/uz.jar 1249798409 386157714 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.
Contains functionality to send SMS messages automatically.
