Technical information
Malicious functions:
Sends SMS messages:
- 12114516416: <IMSI>A
- 12114: <IMSI>A
Network activity:
Connecting to:
- a####.####.com
- s####.####.cn
- s####.####.com
- v####.####.com
HTTP GET requests:
- s####.####.cn/getconfig.aspx?
- s####.####.com/GetFeeData.aspx?iswifi=####
- v####.####.com/v1/index.html
HTTP POST requests:
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/MyDB.db
- <Package Folder>/databases/MyDB.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/ui.xml
- <Package Folder>/shared_prefs/ui.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/wb.xml
- <Package Folder>/shared_prefs/wb.xml.bak
Miscellaneous:
Contains functionality to send SMS messages automatically.
