Technical information
Malicious functions:
Sends SMS messages:
- 12114516416: <IMSI>A
Network activity:
Connecting to:
- con####.com
- i####.####.com:10003
- j####.####.la
- jn####.com
- lier####.com
- ope####.com
- p####.####.com
- pass####.####.cn
- qvo####.com
- re####.####.com
- re####.####.com:10002
- s####.####.com
- s####.####.com:8888
- ve####.com
- w####.####.la
- wd####.com
HTTP GET requests:
- con####.com/apptj01.html?channelid=####
- j####.####.la/18941584.js
- jn####.com/adclickcv.php
- lier####.com/adclickcv.php
- ope####.com/adclicks.php
- p####.####.com/cityjson?ie=####
- pass####.####.cn/client/authRequest
- qvo####.com/adclickcv.php
- re####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sd...
- re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
- s####.####.com/GetFeeData.aspx?iswifi=####
- s####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sdk...
- s####.####.com:8888/v1/sdk/init?net_name=####&imei=####&package_name=###...
- ve####.com/adclicks.php
- w####.####.la/go.asp?svid=####&id=####&tpages=####&ttimes=####&tzone=###...
- wd####.com/adclickcv.php
HTTP POST requests:
- i####.####.com:10003/v2/chis
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/db_feeList
- <Package Folder>/databases/db_feeList-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/plus.jar
- <Package Folder>/shared_prefs/sms.txt.xml
- <Package Folder>/shared_prefs/ui.xml
- <Package Folder>/shared_prefs/ui.xml.bak
- <Package Folder>/shared_prefs/zzconfig.xml
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
