Technical information
Malicious functions:
Sends SMS messages:
- 10086: 40411
- 10086: 5911
- 10658000: XYJD
Network activity:
Connecting to:
- 1####.####.147
- 1####.####.147:8080
- 1####.####.91:8080
- a####.####.com
- p####.####.com
- p####.####.com:8080
HTTP GET requests:
- 1####.####.91:8080/xad/resService!service?paramMap=####
- p####.####.com/res/novel/app/icon/5.jpg
- p####.####.com:8080/res/novel/app/content/3.txt
HTTP POST requests:
- 1####.####.147/xmld/HttpService
- 1####.####.147:8080/xmld/HttpService
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- <Package Folder>/app_payload_odex/<Package>.jar
- <Package Folder>/app_process_lock/2325833367530.03
- <Package Folder>/app_process_lock/690283786894.833
- <Package Folder>/app_process_lock/889.37042982576
- <Package Folder>/app_process_lock/889.37042982576 (deleted)
- <Package Folder>/app_process_lock/889.414950493276
- <Package Folder>/app_process_lock/889.414950493276 (deleted)
- <Package Folder>/app_process_lock/889.459471160793
- <Package Folder>/app_process_lock/889.459471160793 (deleted)
- <Package Folder>/app_process_lock/889.503991828309
- <Package Folder>/app_process_lock/889.503991828309 (deleted)
- <Package Folder>/app_process_lock/889.548512495826
- <Package Folder>/app_process_lock/889.593033163343
- <Package Folder>/app_process_lock/889.637553830859
- <Package Folder>/app_process_lock/889.637553830859 (deleted)
- <Package Folder>/app_process_lock/889.682074498376
- <Package Folder>/app_process_lock/889.682074498376 (deleted)
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/xUtils_http_cache.db
- <Package Folder>/databases/xUtils_http_cache.db-journal
- <Package Folder>/databases/xUtils_http_cache.db-journal (deleted)
- <Package Folder>/databases/xUtils_http_cookie.db
- <Package Folder>/databases/xUtils_http_cookie.db-journal
- <Package Folder>/databases/xUtils_http_cookie.db-journal (deleted)
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/exid.dat
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/Android/1.txt.tmp
- <SD-Card>/Android/2.txt.tmp
- <SD-Card>/Android/3.txt.tmp
- <SD-Card>/Android/4.txt.tmp
- <SD-Card>/Android/7.txt.tmp
- <SD-Card>/Android/8.txt.tmp
- <SD-Card>/updateApkDemo/FrameCore.jar
Miscellaneous:
Executes next shell scripts:
- <dexopt>
