Technical information
Malicious functions:
Sends SMS messages:
- 106575206321505460: dyl#<IMSI>,<IMEI>,6000089-1-1-6_kh29s0135_-0
Executes code of the following detected threats:
- Android.Triada.247.origin
- Android.Triada.248.origin
Downloads the following detected threats from the Web:
- Android.Triada.247.origin
- Android.Triada.248.origin
Prompts to install third-party applications.
Network activity:
Connecting to:
- 6####.####.140
- a####.####.com
- c####.####.com
- huangda####.com
- mei####.####.com
- p####.####.com
- pa####.####.com
- w####.####.com
HTTP GET requests:
- c####.####.com/20170622/tongyu-pay-lib-2148-yt.apk
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- mei####.####.com/wodeanjila/wodeanjila.properties
- p####.####.com/sdkMis/getRdoUrl
- w####.####.com/rdo/order?mcpid=####&orderNo=####&feeCode=####&reqTime=##...
HTTP POST requests:
- 6####.####.140/ando/x/lis?app_id=####&r=####
- a####.####.com/app_logs
- pa####.####.com/mobile-service/getOpenImsiMobilePhone.json
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- /data/data/####/-p7qHNFo-bHTIdDHfXNtehO67ZTmzQbu.new
- /data/data/####/.imprint
- /data/data/####/11mVt6B3SPr-_N8j.zip
- /data/data/####/3lah0_f1_pMPcls86eq_JFSB3QCa1r-L.new
- /data/data/####/3nqaLYdwX2jOyctFbDeUAw==.new
- /data/data/####/3xyhNWMexZ_f0AjYC9lS_EwQIio=
- /data/data/####/3xyhNWMexZ_f0AjYC9lS_EwQIio=.new
- /data/data/####/4F6Yun4Ss9iGCbdntvFlF-k3sAICCf6X8xGT2sBB2yo=.new
- /data/data/####/61ySLOBZFfXtRK2pr6an6d3hp8s=.new
- /data/data/####/6FJXE2qES1gr142C2acUIjAaJDo=.new
- /data/data/####/E953WNDUR5mASUeIlgcasYkmnw1AwvlFGIeTV4lI5fk=.new
- /data/data/####/FDXp5LW8SsWE7AFijESLEGgGxHRoKtfq.new
- /data/data/####/Gp6a9hOVKxEQmororpWSIjTkdFV8onpA.new
- /data/data/####/HB52DKMeMTs6ZC11vJm_OdPs_WRdMlVP
- /data/data/####/HB52DKMeMTs6ZC11vJm_OdPs_WRdMlVP.new
- /data/data/####/HB52DKMeMTs6ZC11vJm_OdPs_WRdMlVP.old (deleted)
- /data/data/####/KAdnHHmro03oKhdh8VFvhxtCZ0U=
- /data/data/####/KAdnHHmro03oKhdh8VFvhxtCZ0U=.new
- /data/data/####/LMPkSm8ngJcvJlq2Mmwnsw==
- /data/data/####/LMPkSm8ngJcvJlq2Mmwnsw==.new
- /data/data/####/LMh1-YsKVLXBBct_xaZoHfZqSOcP5aAizTiRPw==.new
- /data/data/####/LZ7QdstL3yBk-uUItgbWPg==
- /data/data/####/LZ7QdstL3yBk-uUItgbWPg==.new
- /data/data/####/LZ7QdstL3yBk-uUItgbWPg==.old (deleted)
- /data/data/####/Leak3vfVlyk=.jar
- /data/data/####/Mf9OIrYfaUc_M6idIwqo8bxm2_1T3ouA.new
- /data/data/####/Pom8DJbMabe5Ne9-ZyVimwOz5crGYLNw.new
- /data/data/####/WXdczIEEA6deZ0QoYZWsf7ZHn8lheRnzkqvsUA==.new
- /data/data/####/XJ6D_P2lw90h-zX2kJsBYA==
- /data/data/####/XJ6D_P2lw90h-zX2kJsBYA==.new
- /data/data/####/Zp6JCZShOz90oNsPni7KJg5cG4fwoIc8eBwl7A==.new
- /data/data/####/_foenbh-NkAtEtF0d3rpWZ5eREc=
- /data/data/####/b3bO2k2RoTiZ7U0D
- /data/data/####/base-1.apk
- /data/data/####/base-1.dex
- /data/data/####/com.dyl.pay.ui.apk
- /data/data/####/com.souying.pay.plugmain_p_config.xml
- /data/data/####/com.souying.pay.plugmain_sy_pay_record-journal
- /data/data/####/com.souying.pay.xml
- /data/data/####/cpMsg.xml
- /data/data/####/crash-1496218650407.log
- /data/data/####/data.dat.tmp
- /data/data/####/device_id.xml.xml
- /data/data/####/dispatch_log.xml
- /data/data/####/exchangeIdentity.json
- /data/data/####/gCs74RtqiavWdXHx
- /data/data/####/getFlag.xml
- /data/data/####/h0ZkKPYK3OQZCPQkr2gfY7-1cBBtBR2Q_2nP6AF09j2TmnbLF
- /data/data/####/h0ZkKPYK3OQZCPQkr2gfY7-1cBBtBR2Q_2nP6AF09j2TmnbLF-journal
- /data/data/####/h0ZkKPYK3OQZCPQkr2gfY7-1cBBtBR2Q_IKVh-107vxmLxiAbn5o5Kg==-journal
- /data/data/####/h0ZkKPYK3OQZCPQkr2gfY7-1cBBtBR2Q_r3PdjCnHh0Ab0cG02ipDq19vy1Y=
- /data/data/####/h0ZkKPYK3OQZCPQkr2gfY7-1cBBtBR2Q_r3PdjCnHh0Ab0cG02ipDq19vy1Y=-journal
- /data/data/####/h0ZkKPYK3OQZCPQkr2gfY7-1cBBtBR2Q_xBKo45HO_ELdJflesk9N1g==-journal
- /data/data/####/iD_Agbk5-fXip7wXYdvClA==
- /data/data/####/mobclick_agent_cached_com.four.pet.color.hm1
- /data/data/####/mp.db
- /data/data/####/mp.db-journal
- /data/data/####/noend.ini
- /data/data/####/plugin-20170105-2.1.8.6.1.bin
- /data/data/####/plugins.installed.xml
- /data/data/####/plugins.serviceMapping.xml
- /data/data/####/port.xml
- /data/data/####/port.xml.bak
- /data/data/####/pretw.xml
- /data/data/####/rdata_comsadfwjbfq.new
- /data/data/####/recordInfo-journal
- /data/data/####/runner_info.prop
- /data/data/####/runner_info.prop.new
- /data/data/####/smp.apk
- /data/data/####/smp.apk.apk
- /data/data/####/sms.apk
- /data/data/####/sms.apk.apk
- /data/data/####/snyaa_f.zip
- /data/data/####/sy_pay_config.xml
- /data/data/####/sy_pay_config.xml.bak
- /data/data/####/tongyu-pay-lib.apk
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_it.cache
- /data/data/####/wFJvK929NhBTXpbL.new
- /data/data/####/webview.db-journal
- /data/data/####/xfNNxTxTaVO95u5jH8fIY9pMkR9Ipa03g16fSBVtizU=.new
- <Package Folder>/shared_prefs/PrefFirst.xml
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/.tpservice/####/qsha_80001_5094.jar
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3003_2247.zip
- <SD-Card>/pointupdate/Wdajl.jpg
- <SD-Card>/tianyuwodeanjila.apk
Miscellaneous:
Executes next shell scripts:
- /data/data/com.four.pet.color.hm/code-8118937/gCs74RtqiavWdXHx -p com.four.pet.color.hm -c com.sadf.wjbfq.ufzhaq.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
- cat /sys/class/net/wlan0/address
- sh /data/data/com.four.pet.color.hm/code-8118937/gCs74RtqiavWdXHx -p com.four.pet.color.hm -c com.sadf.wjbfq.ufzhaq.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
