Technical information
Malicious functions:
Sends SMS:
- 18974129280: <IMEI>22
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) weib####.g####.sina####.com:80
- TCP(HTTP/1.1) api.h####.cn:81
- TCP(TLS/1.0) i.l####.net:443
- TCP(TLS/1.0) 1####.217.19.206:443
- TCP(TLS/1.0) weib####.g####.sina####.com:443
DNS requests:
- api.h####.cn
- i.l####.net
- ws1.sin####.cn
- ww1.sin####.cn
- ww3.sin####.cn
- ww4.sin####.cn
- wx1.sin####.cn
- wx2.sin####.cn
- wx3.sin####.cn
- wx4.sin####.cn
HTTP GET requests:
- api.h####.cn:81/mf/json.txt
- weib####.g####.sina####.com/large/0060lm7Tly1fobhirdep9j303c03cwec.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fqi47x1heoj2020020748.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fqi4cgzdv6j2020020q2v.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1frc0qchto4j20e80e9wgd.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fs1p0kha6wj20qn0qnq46.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fs2fvatvwwj203c03cmxk.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fsk4j4mbwqj206n05dmxj.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fsool1hakbj205v053gn1.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fsop2jy4klj206o05kwf7.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fsoqb5ffq4j2064052mxe.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fsyulcw2g9j204602waa4.jpg
- weib####.g####.sina####.com/large/87c01ec7ly1fr5d5uty0mj2046046t95.jpg
- weib####.g####.sina####.com/large/87c01ec7ly1fr5dlbjj3xj204501u0sl.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fqdf8vdeuwj30sg0sgmxt.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fqi3dtothcj305c05cjrp.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fr222o0cg8j30ku0kuwei.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fu0z1tlm0lj303603674s.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fu1054sd9cj304q042dfo.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fu1100a52kj303m03cwec.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fu11evou6aj303d03cwec.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fu6svpgz93j304q0440sl.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fucnaos2wgj305004dwef.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fucnlukcdej3050050q4u.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fucnzjjtxoj30890a0gmg.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fucoafu9myj30dw0dwq5k.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fucp4kz968j303c03caab.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fucqpv6wdej304h0420sm.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fupe5f1jjtj304103owee.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fv07ook1kpj30sg0sgmz9.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fvjc0tkg9kj301w01tgle.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fw7u4v52woj304m04cjs9.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fw834mqtmbj30sg0sgjut.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwmqgltbsqj30e80e8wg0.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwmqmf39xqj30sg0sgwij.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwmqo8bw08j30sg0sgn0s.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwmqq9l066j304p04jt8u.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwmqsluhscj304q04qt8o.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwmqvf02ijj30sg0sgwib.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwvecxt5ywj307s08040d.jpg
File system changes:
Creates the following files:
- /data/data/####/ck732093061.xml
- /data/data/####/com.e4a.runtime.android.mainActivity.xml
- /data/media/####/.nomedia
- /data/media/####/1jj5ewik55hm6qpjkenqxvvk2.tmp
- /data/media/####/1z37f8sva459xvytdcx2dot0c.tmp
- /data/media/####/2beypn6t53xf5ca3lp71nqhk6.tmp
- /data/media/####/2fupb4gc1mtkfs6fdszpyq5k4.tmp
- /data/media/####/2jffixf5uu9et8wvuu6o2uovx.tmp
- /data/media/####/2k0jy0hqyb4rnq2a6bcxz5cy1.tmp
- /data/media/####/2nxwhirudugp3ke15h583to3w.tmp
- /data/media/####/2r2d0pfq4et7ufj9ibcvvh4zi.tmp
- /data/media/####/2s0t5xh9kons5yl5a34v0vfz4.tmp
- /data/media/####/2t6cjmkh0inaitrz2p7fpy7pu.tmp
- /data/media/####/2uo8kx8w1cssbzyim3tunxp95.tmp
- /data/media/####/2ylpzns3w5ipl7wl5ark0lv1i.tmp
- /data/media/####/3bw84n3ym7uom8r3wcmlt9ijh.tmp
- /data/media/####/3g7xbd559ppkho3yfccx04cuq.tmp
- /data/media/####/3jxw2qa9n10g0kvk95lqpsssq.tmp
- /data/media/####/3k7w8m9v2co5wk8k21vr6es41.tmp
- /data/media/####/3kv19i8v0b4xzp3asi2swubq7.tmp
- /data/media/####/3rli8gaocbsu5vat4itugvopl.tmp
- /data/media/####/3w42j7p3rlx1k77vxvk7lb3bz.tmp
- /data/media/####/481n0ex70xrw8v2gr4lozyhov.tmp
- /data/media/####/4bi3f3pfmp3qeb8xs9rb7zn6e.tmp
- /data/media/####/4dijg7n14532g4izd4sh8af6k.tmp
- /data/media/####/4expzjnjzipydg57k17itb3y6.tmp
- /data/media/####/4i9v276wo7v5w2u5ijzu8re0g.tmp
- /data/media/####/4j77z4404i6p5l46xai89ivgr.tmp
- /data/media/####/4kv9wkr7so9m88qzfknuradrj.tmp
- /data/media/####/4la2fipr5ra2uliyhtx83pm3i.tmp
- /data/media/####/4snsltquahkui3oaga98ayb5f.tmp
- /data/media/####/4st3zk7w767ov85q4dbapwj0m.tmp
- /data/media/####/4u0t98cec6u7ii6yasjw8bwp4.tmp
- /data/media/####/4uoo55m015mfjzbde534trk6w.tmp
- /data/media/####/50a5gk16uobtw7v1iyllciof6.tmp
- /data/media/####/5975k64vapyrqv2vmsmub7kir.tmp
- /data/media/####/5a41tzce70m21v7k0f0axmcv3.tmp
- /data/media/####/5icghtuolt2ehb1j0fwagjp8r.tmp
- /data/media/####/640f3lpmwa91gh4jvar5i4sby.tmp
- /data/media/####/697gws92frn1joq4tgdyb6q0j.tmp
- /data/media/####/6abos0clngt4i7n16v0ssq57t.tmp
- /data/media/####/6ss40dxeghzyk6u18gbsa1kny.tmp
- /data/media/####/6tuc9qy4yv5ifzd1s3qszita.tmp
- /data/media/####/6ws6cf8kd4tk7fezq0x2q5cyg.tmp
- /data/media/####/6ykmcblo57d98p00rgnoyohr8.tmp
- /data/media/####/76zetts7z1euzezf2s67rg1tv.tmp
- /data/media/####/786x1e1u5ghtkqq85tph4kazf.tmp
- /data/media/####/7jid66ovfbw3gixj7hp3g00vt.tmp
- /data/media/####/7keuu26mvqgl0fu0wtrc6o6re.tmp
- /data/media/####/8ch5pgkmz6u44i0ycfqsjpzu.tmp
- /data/media/####/i155mzhqwpdtqdrzm0yzabi4.tmp
- /data/media/####/zpgtrfsz7z5c43wdlmltjrh5.tmp
Miscellaneous:
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Parses information from SMS.
Gets information about sent/received SMS.
