Technical information
Malicious functions:
Prompts to install third-party applications.
Network activity:
Connecting to:
- collec####.####.com
- d####.####.com:8085
- huangda####.com
- i####.####.com:10003
- m####.####.com
- m####.####.com:81
- re####.####.com:10002
- sm####.####.com
- z####.####.com
HTTP GET requests:
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
- z####.####.com/apk/extremelyapkdir/20170605100959.apk
- z####.####.com/img/20151208/193208/closeimg_20151208193203.png
HTTP POST requests:
- collec####.####.com/pay-data-collect/collectAppStartUserData.json
- d####.####.com:8085/hladserver/apiserver/7
- i####.####.com:10003/v2/chis
- m####.####.com/hladserver/api/4
- m####.####.com:81/hladserver/api/1
- sm####.####.com/pay-sms-access//getAccessPayChannel.json
Modified file system:
Creates the following files:
- /data/data/####/1496215345571_2257
- /data/data/####/1496215345765_2257
- /data/data/####/1496215346046_2257
- /data/data/####/1496215346113_2257
- /data/data/####/3db355750bea842d8ee0cece950aa5ecd|account_file.xml
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/TD_app_pefercen_profile.xml.bak
- /data/data/####/TDpref_game.xml
- /data/data/####/TDpref_longtime.xml
- /data/data/####/TDpref_longtime.xml.bak
- /data/data/####/TDpref_longtime3.xml
- /data/data/####/TDpref_longtime3.xml.bak (deleted)
- /data/data/####/TDpref_shorttime.xml
- /data/data/####/base-1.apk
- /data/data/####/base-1.dex
- /data/data/####/com.no.bb_preferences.xml
- /data/data/####/com.souying.pay.plugmain_sy_pay_record-journal
- /data/data/####/com.souying.pay.xml
- /data/data/####/crash-1496215345470.log
- /data/data/####/lol.so
- /data/data/####/map.apk
- /data/data/####/map.apk.apk
- /data/data/####/plugins.installed.xml
- /data/data/####/plugins.serviceMapping.xml
- /data/data/####/plugins.serviceMapping.xml.bak
- /data/data/####/plus.jar
- /data/data/####/pretw.xml
- /data/data/####/pretw.xml.bak
- /data/data/####/recordInfo-journal
- /data/data/####/sdk.xml
- /data/data/####/sm.apk
- /data/data/####/sm.apk.apk
- /data/data/####/sy_pay_config.xml
- /data/data/####/sy_pay_config.xml.bak
- /data/data/####/tdid.xml
- /data/data/####/twc.xml
- /data/data/####/twc.xml.bak
- /data/data/####/webview.db-journal
- /data/data/####/zzconfig.xml
- <Package Folder>/databases/vastpaydb
- <Package Folder>/databases/vastpaydb-journal
- <Package Folder>/files/####/core.jar
- <Package Folder>/shared_prefs/hlcsdpf.xml
- <Package Folder>/shared_prefs/hlcsdpf.xml.bak
- <SD-Card>/.android/3294005e3b30d63b99f4c834cf94b7db.apk.tmp
- <SD-Card>/.android/back.png
- <SD-Card>/.android/c4e4e5eb274ffc938704c568bb96883e.apk.tmp
- <SD-Card>/.android/close.png
- <SD-Card>/.android/dev.txt
- <SD-Card>/.android/fatpot.png
- <SD-Card>/.android/thinpot.png
- <SD-Card>/.tcookieid
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/tkddbp_3001_2275.zip
- <SD-Card>/Android/####/.nomedia
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- <dexopt>
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
- getprop
