Technical information
Malicious functions:
Sends SMS messages:
- 12114516420: <IMSI>
Network activity:
Connecting to:
- 1####.####.226
- 1####.####.226:8002
- 1####.####.238
- 1####.####.238:8977
- 7j####.####.com
- a####.####.com
- and####.####.com
- and####.####.com:8077
- c-h####.####.com
- huangda####.com
- i####.####.cn
- i####.####.com:10003
- iji####.com
- m####.####.com
- p####.####.com
- re####.####.com:10002
- s####.####.com
- v####.####.com
- w####.####.com
HTTP GET requests:
- 1####.####.238/dex/ldsource.bin
- 1####.####.238:8977/dex/version.txt
- 7j####.####.com/tdata_Diu264
- a####.####.com/fetch.php?gid=####&ch=####&key=####
- a####.####.com/location/ip?ak=####&mcode=####
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- i####.####.cn/iplookup/iplookup.php?format=####
- iji####.com/tcmn/user/get_home_user?vncode=####&home_uid=####&channel=##...
- m####.####.com/course/504703.html?cm=####
- p####.####.com/cityjson?ie=####
- re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
- s####.####.com/config/hz-hzv3.conf
- v####.####.com/pic/tcmn/2016/01/22/5512630642883.jpg
- w####.####.com/r/p/index.jsp?vt=####&cm=####
HTTP POST requests:
- 1####.####.226/api/sl/device/upload
- 1####.####.226:8002/api/sl/vcoderule/getvalid
- and####.####.com/record-plat/record/upload.do
- and####.####.com:8077/record-plat/seq/query.do
- c-h####.####.com/api.php?format=####&t=####
- i####.####.com:10003/v2/chis
- s####.####.com/api.php?format=####&t=####
Miscellaneous:
Executes next shell scripts:
- /data/data/com.iwphvtc.dcgplmyu/files/gdaemon_20161017 0 com.iwphvtc.dcgplmyu/nghfw.anbey.service.MhGtphService 25053 300 0
- <dexopt>
- cat /sys/block/mmcblk0/device/cid
- chmod 700 /data/data/com.iwphvtc.dcgplmyu/files/gdaemon_20161017
- chmod 700 <Package Folder>/files/gdaemon_20161017
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/nghfw.anbey.service.MhGtphService 25053 300 0
