Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.122.origin
Prompts to install third-party applications.
Network activity:
Connecting to:
- 5####.####.com
- h####.####.com
- s####.####.cn
- c####.####.cc
- i####.####.cc
- l####.####.com
- i####.####.cc:8080
- i####.####.cn
HTTP GET requests:
- i####.####.cc/MTProject/MTContr?action=####&terminalType=####&version=####
- 5####.####.com/sdkplugin/smssdk_v17.txt
- l####.####.com/kb416.php?ri=####
- i####.####.cn/iplookup/iplookup.php?format=####
- i####.####.cc:8080/MTProject/MTContr?action=####&terminalType=####&versi...
- c####.####.cc/IsInterface.php?ri=####&op=####&mac=####&vs=####&tm=####&k...
- i####.####.cc/MTProject/MTContr?action=####
HTTP POST requests:
- s####.####.cn/cn/reportErrorLog.do
- s####.####.cn/cn/smsSdk.do
- s####.####.cn/cn/prefetch.do
- h####.####.com/app.gif
- s####.####.cn/serverIP.do
Modified file system:
Creates the following files:
- /sdcard/Sonnenblume/apayment.db-journal
- /sdcard/Sonnenblume/sf_idle.ini
- /sdcard/Sonnenblume/apayment.db
- /sdcard/Sonnenblume/res.apk.u
- /sdcard/baidu/.cuid
- /sdcard/Sonnenblume/EE53AF5B170264468E95E783E26D76C2
Miscellaneous:
Contains functionality to send SMS messages automatically.
