Technical information
Malicious functions:
Sends SMS messages:
- 13661436356: <IMSI>
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) sa.91m####.com:8080
- TCP(HTTP/???) sa.91m####.com:8080
DNS requests:
- sa.91m####.com
HTTP GET requests:
- sa.91m####.com:8080/sdk/gameSdkInfo/getPayInfo.action?parck_id=####&imei...
- sa.91m####.com:8080/sdk/hotupdateSdkrecord/checkNeedUpdateSdkOrNot.actio...
- sa.91m####.com:8080/sdk/mobileNum?imsi=####
HTTP POST requests:
- sa.91m####.com:8080/sdk/activate
- sa.91m####.com:8080/sdk/afdf
- sa.91m####.com:8080/sdk/init
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/ZTY.xml
- <Package Folder>/shared_prefs/mzgamesdk.xml
- <SD-Card>/Android/####/mz_gpay.jar
- <SD-Card>/ztylog_v.txt
Miscellaneous:
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
Gains access to information about sent/received SMS messages.
