Technical information
Malicious functions:
Sends SMS messages:
- 15556699192: <SMS Content>
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pub.idq####.com.####.com:80
- TCP(HTTP/1.1) s####.qq.com:80
- TCP(HTTP/1.1) ping####.qq.com:80
- TCP(HTTP/1.1) t####.qq.com:80
- TCP(HTTP/1.1) cgi.con####.qq.com:80
- TCP(HTTP/1.1) sup####.qq.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(TLS/1.0) www.hack####.cn:443
- TCP(TLS/1.0) t####.qq.com:443
- TCP(TLS/1.0) p####.tc.qq.com:443
- TCP(TLS/1.0) sup####.qq.com:443
DNS requests:
- cgi.con####.qq.com
- imgc####.qq.com
- j####.qq.com
- pi####.qq.com
- ping####.qq.com
- ping####.qq.com
- pub.idq####.com
- s####.qq.com
- sup####.qq.com
- t####.qq.com
- www.hack####.cn
HTTP GET requests:
- cgi.con####.qq.com/report/report?strValue=####&nValue=####&tag=####&t=####
- ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=####&ty=####...
- ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=qq=####&sig=...
- ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=tid####&num=...
- ping####.qq.com/pingd?dm=####&url=####&rdm=####&rurl=####&rarg=####&pvid...
- pub.idq####.com.####.com/wpa/images/bg.jpg
- pub.idq####.com.####.com/wpa/images/bg2.jpg
- pub.idq####.com.####.com/wpa/images/logo.jpg
- pub.idq####.com.####.com/wpa/images/s_add.png
- pub.idq####.com.####.com/wpa/js/old/LiteAjaxEngine.js
- pub.idq####.com.####.com/wpa/js/old/ceshi_shengji.js
- s####.qq.com/cgi-bin/wpa_stop?type=####&qq=####&sig=####
- s####.qq.com/email/stop/email_stop.html?qq=####&sig=####&tttt=####
- s####.qq.com/favicon.ico
- s####.tc.qq.com/cdn_djl.js
- s####.tc.qq.com/tcss.ping.js
- sup####.qq.com/cgi-bin/content_new?tid=####&num=####&order=####&fid=####...
- sup####.qq.com/discuss/515_1.shtml
- sup####.qq.com/include/js/all.js
- sup####.qq.com/include/js/qmtool.js
- sup####.qq.com/include/qqmaileditor/editor.js
- sup####.qq.com/include/style/comm2010.css
- sup####.qq.com/js/forum/forum_515.js
- sup####.qq.com/js/isd_speed.js
- sup####.qq.com/portal/discuss_pdt/515_1.html
- t####.qq.com/ping_hotclick_min.js
- t####.qq.com/stats?sId=####
HTTP POST requests:
- sup####.qq.com/cgi-bin/loginInfo
Miscellaneous:
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
Parses information from SMS messages.
Gains access to information about sent/received SMS messages.
