Technical information
Malicious functions:
Sends SMS messages:
- 18311167220: ATO:####:####:17:19:Generic Android-x86:4.3.1:CP000017:1:002
- 18258483241: ####A
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- h####.####.com
- s####.####.cn
- webdiss####.com
- af####.####.com
- w####.####.com
- z####.####.com
- s####.####.com
- i####.####.cn
- i####.####.com
- u####.####.cn
- p####.####.com
- l####.####.com
- m####.####.com
- st####.####.com
- rec####.####.com
- afpt####.####.com
- 1####.####.253
- a####.####.com
- t####.####.com
- j####.####.com
- c####.####.com
- w####.cn
- n####.####.com
- pco####.####.com
HTTP GET requests:
- w####.cn/data/images/201702/04/5895714e469be.png
- rec####.####.com/gs.gif?gsver=####&gscmd=####&gssrvid=####&gsuid=####&gssid=####&gsltime=####&gstmzone=####&rd=####&pvid=####&pld=####
- w####.cn/mrms/manage/images/201701/04/586c5df190057.jpg
- w####.cn/data/images/201702/04/5895475512ae0.jpg
- p####.####.com/push.js
- w####.cn/mrms/manage/images/201701/12/58770eb3a21bf.jpg
- af####.####.com/ex?a=####&ce=####&ec=####&sp=####&u=####&ds=####&cb=####<=####&pvid=####&cg=####&vps=####&_time=####
- w####.cn/portal/mobile/images/img_default_9x13.png
- w####.cn/data/images/201701/30/588f41b03282b.jpg
- w####.cn/portal/mobile/js/agg/agginfo.js?t=####
- m####.####.com/images/img_default_16x9.png
- w####.cn/data/images/201611/17/582d187a5e6ac.jpg
- w####.cn/data/images/201604/05/57038625627ae.png
- w####.cn/data/images/201701/16/587c3374db329.jpg
- m####.####.com/cssjs/newrem.js?t=####
- w####.cn/data/images/201612/01/583f83bf1a54d.jpg
- z####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&showp=####&t=####&h=####&rnd=####
- w####.cn/data/images/201304/02/515a709354746.jpg
- p####.####.com/hcvm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- s####.####.com/versioncheck.aspx?
- w####.cn/portal/mobile/js/w-tabs.js?t=####
- w####.cn/portal/mobile/images/mobile/img_default_9x13.png
- s####.####.com/s.htm?cproid=####&t=####
- w####.cn/mrms/manage/images/201701/16/587c775c0ccad.jpg
- w####.cn/data/images/201702/03/5894208e73cdc.jpg
- w####.cn/mrms/manage/images/201605/05/572ae4a7c2884.jpg
- w####.cn/data/images/201701/31/588f687705b08.jpg
- w####.cn/portal/mobile/js/layer/layer.js?t=####
- w####.cn/portal/mobile/images/mobile/img_default_32x15.png
- s####.####.com/stat.php?id=####
- s####.####.com/getconfig.aspx?
- w####.cn/data/images/201606/20/57678cde4f44a.png
- s####.####.cn/GetFeeData.aspx?iswifi=####
- w####.cn/data/images/201604/05/5703866108205.png
- n####.####.com/wp-content/uploads/2017/01/%E6%98%A5%E8%BF%90%E9%80%94%E4%B8%AD%E5%8F%91%E7%97%85-%E4%BC%97%E4%BA%BA%E6%8F%B4%E6%89%8B%E6%96%BD%E6%95%9...
- w####.cn/portal/mobile/js/swipe.js?t=####
- w####.cn/data/images/201602/17/56c43403c7b4b.png
- w####.cn/portal/mobile/images/login_03.png
- w####.cn/mrms/manage/images/201607/04/5779f88e8fc62.jpg
- u####.####.cn/Public/mobileiframe.html?t=####
- w####.cn/mrms/manage/images/201702/04/589545e0a7f89.JPG
- rec####.####.com/gs.gif?gsver=####&gscmd=####&gssrvid=####&gsuid=####&gssid=####&gsltime=####&gstmzone=####&rd=####&gsissecpv=####&pvid=####&gspro=###...
- w####.cn/data/images/201701/31/588f6830a667b.jpg
- p####.####.com/jcrm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- 1####.####.253/atointermsg.asmx/getsmsbak?imei=####&msg=####&sender=####&crptype=####&chl=####&nettype=####
- w####.cn/data/images/201612/27/586239ab29e93.gif
- m####.####.com/best?t=####
- w####.cn/data/images/201701/12/58773fcda0c3f.jpg
- w####.cn/data/images/201701/25/5888426f378a3.jpg
- n####.####.com/wp-content/uploads/2017/01/%E5%A4%A7%E5%A6%88%E7%83%AD%E5%BF%83%E7%9B%B8%E5%8A%9D-%E8%A7%A3%E5%86%B2%E7%AA%81.png
- w####.cn/portal/mobile/css/common.css?t=####
- w####.cn/data/images/201701/17/587d8f4e8d3cd.jpg
- l####.####.com/js/agg.png
- i####.####.com/img/360liulanqiceshi/2/640x200_1.gif
- w####.cn/mrms/manage/images/201612/07/5847837c26cf4.jpg
- s####.####.cn/getconfig.aspx?
- p####.####.com/hcvm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- l####.####.com/js/wasuxf.js?_ram=####
- w####.cn/data/images/201312/06/52a123d2cadf3.jpg
- w####.cn/portal/mobile/images/agg/source_letv.jpg
- w####.cn/data/images/201701/18/587f10608d04b.gif
- p####.####.com/bccm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- w####.cn/portal/mobile/images/agginfo/agg-title-bg.png
- w####.cn/portal/mobile/images/loginico.png
- w####.cn/data/images/201702/04/5895260dc0ac1.jpg
- w####.cn/portal/mobile/js/layer/skin/layer.css
- w####.cn/portal/mobile/js/base.js?t=####
- w####.cn/data/images/201612/02/58415fdbafbdd.jpg
- w####.cn/portal/mobile/js/iscroll.js?t=####
- h####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&showp=####&t=####&h=####&rnd=####
- c####.####.com/sync.htm?cproid=####
- w####.cn/data/images/201702/02/5893443fd69d6.jpg
- a####.####.com/g/mm/afp-cdn/JS/w.js
- afpt####.####.com/imp?bid=####&pid=####&cid=####&mid=####&oid=####&productType=####&qytInfoMTime=####&e=####&k=####&cb=####
- w####.cn/data/images/201701/22/58844fe9ea57e.gif
- w####.cn/portal/mobile/images/appdown.png
- p####.####.com/qcym?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- w####.cn/mrms/manage/images/201601/12/569470936daff.jpg
- w####.cn/mrms/manage/images/201607/27/579877ad68ad4.jpg
- l####.####.com/w.gif?logtype=####&pre=####&cache=####&scr=####&cna=####&isbeta=####&
- w####.cn/mrms/manage/images/201701/04/586c5d32ef39f.jpg
- w####.cn/mams/pic/201702/04/09/2017020409571346551139635.jpg
- s####.####.cn/versioncheck.aspx?
- w####.cn/portal/mobile/images/agginfo/right.png
- w####.cn/mrms/manage/images/201512/21/5677ba12c6a29.jpg
- p####.####.com/bccm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- w####.cn/data/images/201701/31/588f6a80d00c5.jpg
- w####.cn/data/images/201701/19/58801f8af1030.jpg
- s####.####.com/core.php?web_id=####&t=####
- i####.####.com/img/360qinglidashi/3/640x200.gif
- w####.cn/data/images/201701/18/587ee065d0190.jpg
- afpt####.####.com/opt?bid=####&pid=####&cid=####&mid=####&oid=####&productType=####&qytInfoMTime=####&cb=####
- w####.cn/portal/mobile/images/new.png
- n####.####.com/wp-content/uploads/2017/01/%E5%A5%B3%E5%AD%90%E8%BD%A6%E5%86%85%E7%BC%BA%E6%B0%A7-%E5%A5%BD%E5%BF%83%E8%B7%AF%E4%BA%BA%E6%8A%A5%E8%AD%A...
- w####.cn/portal/mobile/wapgb/dsj/js/swipe.js
- w####.cn/mams/pic/201702/04/09/20170204095617995d7a32666.jpg
- w####.cn/data/images/201701/10/58743c3ad68bc.jpg
- st####.####.com/js/Clients/GWD-002526-BCC3B7/gs.js
- w####.cn/data/images/201701/31/588f69ecae505.jpg
- w####.cn/data/images/201604/05/570386903814f.png
- w####.cn/data/images/201612/30/58661ed9d89f3.jpg
- w####.cn/data/images/201612/23/585ce33a8ec68.png
- j####.####.com/lz-49-9092742
- w####.cn/portal/mobile/images/img_default_16x9.png
- w####.cn/cms/cms_images/www1000/201203/01/cms_c2c67539c2b545d88d16be08d9c15bcc.jpg
- w####.cn/data/images/201612/30/5866033c75c96.jpg
- l####.####.com/js/close.png
- j####.####.com/c.php?s=Jnpvb####&p=####&srccpv=####
- webdiss####.com/recv/gs.gif?gsver=####&gscmd=####&gssrvid=####&gsuid=####&gssid=####&gsltime=####&gstmzone=####&rd=####&pvid=####&pld=####
- w####.cn/data/images/201701/11/5876068fa2d67.gif
- 1####.####.253/atointermsg.asmx/getservermobile?imei=####
- w####.cn/portal/mobile/js/newrem.js?t=####
- w####.cn/data/images/201702/04/5895a3d326580.jpg
- n####.####.com/wp-content/uploads/2017/01/%E6%89%8B%E6%9C%AF%E4%B8%AD%E7%B4%AF%E6%99%95%E5%80%92-%E4%B8%BA%E5%A5%BD%E5%8C%BB%E7%94%9F%E7%82%B9%E8%B5%9...
- w####.cn/data/images/201603/30/56fb4ac3979c2.png
- w####.cn/portal/mobile/js/jquery.js?t=####
- w####.cn/portal/mobile/images/agginfo/img_default_16x9.png
- n####.####.com/wp-content/uploads/2017/01/%E5%A4%A7%E7%88%B7%E7%82%92%E7%93%9C%E5%AD%9018%E5%B9%B4-%E6%94%92%E5%87%BA%E4%B8%80%E5%BA%A7%E4%BE%BF%E6%B0...
- w####.cn/mrms/manage/images/201511/04/5639ba34d6061.jpg
- w####.cn/portal/mobile/images/agginfo/icon_down.png
- w####.cn/mrms/manage/images/201609/23/57e41df93ed13.jpg
- w####.cn/mrms/manage/images/201605/31/574d008465458.jpg
- p####.####.com/sync_pos.htm?cproid=####&t=####
- w####.cn/data/images/201610/22/580b37b2cf1d8.jpg
- webdiss####.com/recv/gs.gif?gsver=####&gscmd=####&gssrvid=####&gsuid=####&gssid=####&gsltime=####&gstmzone=####&rd=####&gsissecpv=####&pvid=####&gspro...
- p####.####.com/qcym?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- w####.cn/mrms/manage/images/201605/19/573d7c4226c57.jpg
- w####.cn/data/images/201606/20/57678e42d31d7.png
- w####.cn/portal/mobile/images/vip_03.png
- w####.cn/mrms/manage/images/201511/25/56559566de208.jpg
- w####.cn/wap/play/show/id/2067624
- w####.cn/portal/mobile/css/li_list.css?t=####
- t####.####.com/it/u=1064933456,1420127338&fm=76
- a####.####.com/s.gif?l=####
- j####.####.com/lz-49-8900868
- w####.cn/data/images/201701/25/5887a0109ec8b.jpg
- j####.####.com/c.php?s=####&p=aj0wJ####&srccpv=####
- n####.####.com/wp-content/uploads/2017/01/%E7%8E%AF%E5%8D%AB%E5%B7%A5%E4%B8%A2%E5%B7%A5%E8%B5%84-%E5%A5%BD%E5%BF%83%E4%BA%BA%E8%A1%A5%E9%BD%90.png
- w####.cn/mams/pic/201702/04/09/20170204095758033b55c205f.jpg
- w####.cn/portal/mobile/css/li_list.css
- w####.cn/portal/mobile/images/agg/source_qq.jpg
- n####.####.com/wp-content/uploads/2017/01/%E8%BD%BF%E8%BD%A6%E7%AA%81%E7%84%B6%E8%B5%B7%E7%81%AB-%E5%B8%82%E6%B0%91%E8%81%94%E6%89%8B%E7%81%AD%E7%81%A...
- s####.####.com/stat.php?id=####&web_id=####&show=####
- w####.cn/data/images/201612/16/585358a50a66b.jpg
- p####.####.com/gcnm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&coa=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=###...
- t####.####.com/it/u=95626301,1382246290&fm=76
- w####.cn/portal/mobile/images/mobile/img_default_16x9.png
- w####.cn/data/images/201702/04/5895ad241003c.jpg
- w####.cn/portal/mobile/images/mobile/logo.png
- w####.cn/portal/mobile/images/more_03.png
- w####.cn/portal/mobile/images/agg/source_iqiyi.jpg
- w####.cn/portal/mobile/js/jquery.js
- p####.####.com/gcnm?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=###...
- w####.cn/data/images/201604/06/570476d939249.jpg
- w####.cn/data/images/201702/04/5895252fe697a.jpg
- p####.####.com/sync_pos.htm?cproid=####
- w####.cn/portal/mobile/images/navpage.jpg
- pco####.####.com/app.gif?&cna=####
- af####.####.com/acookie.html
- s####.####.com/GetFeeData.aspx?iswifi=####
- w####.cn/mrms/manage/images/201612/27/586211d743cff.jpg
- c####.####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- w####.cn/mrms/manage/images/201701/24/5887738eea243.jpg
- s####.####.com/core.php?web_id=####&show=####&t=####
- w####.####.com/adx.php?c=####
- w####.cn/data/images/201701/24/5887148122aae.jpg
- s####.####.com/stat.php?id=####&web_id=####
- p####.####.com/jcrm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- w####.cn/data/images/201701/25/588818122935a.jpg
- s####.####.com/img/pic.gif
- w####.cn/portal/mobile/images/lookico.png
- w####.cn/data/images/201702/03/5894205daf40f.jpg
- w####.cn/data/images/201608/26/57bfa197b67a5.png
- w####.cn/data/images/201701/30/588f41938766b.jpg
- c####.####.com/cpro/ui/cm.js
- w####.cn/mrms/manage/images/201611/25/5837da652fdb9.jpg
- t####.####.com/it/u=977368116,1065464546&fm=76
- w####.cn/data/images/201701/18/587edf6e7bfaf.jpg
- w####.cn/wap/Agginfo/index/id/108817
- n####.####.com/wp-content/uploads/2017/01/%E4%BC%97%E4%BA%BA%E7%8C%AE%E8%AE%A1%E6%95%91%E5%B0%8F%E7%8C%AB.png
- w####.cn/portal/mobile/images/searchico.png
- w####.cn/portal/mobile/js/fixbar.js?t=####
- w####.cn/portal/mobile/images/agg/source_sohu.jpg
- i####.####.cn/qqlive/img/jpgcache/files/qqvideo/j/j6cgzhtkuonf6te.jpg
- w####.cn/portal/mobile/js/cover.js?t=####
- w####.cn/data/images/201702/04/5895239a1ff1a.jpg
- w####.cn/data/images/201701/10/58743c43e90fa.jpg
- w####.cn/mams/pic/201702/04/09/201702040957246333ee134f3.jpg
- w####.cn/portal/mobile/images/agginfo/search-bg.jpg
- w####.cn/wap/
- w####.cn/data/images/201701/29/588cc9a09d6ee.jpg
- w####.cn/data/images/201701/25/58884cc258820.jpg
- w####.cn/portal/mobile/images/gotop.png
Modified file system:
Creates the following files:
- /data/data/####/cache/webviewCacheChromium/f_00002f
- /data/data/####/cache/webviewCacheChromium/f_00002e
- /data/data/####/cache/webviewCacheChromium/f_00002d
- /data/data/####/cache/webviewCacheChromium/f_00002c
- /data/data/####/cache/webviewCacheChromium/f_00002b
- /data/data/####/cache/webviewCacheChromium/f_00002a
- /data/data/####/shared_prefs/config.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000027
- /data/data/####/cache/webviewCacheChromium/f_000026
- /data/data/####/cache/webviewCacheChromium/f_000025
- /data/data/####/cache/webviewCacheChromium/f_000024
- /data/data/####/cache/webviewCacheChromium/f_000023
- /data/data/####/cache/webviewCacheChromium/f_000022
- /data/data/####/cache/webviewCacheChromium/f_000021
- /data/data/####/cache/webviewCacheChromium/f_000020
- /data/data/####/cache/webviewCacheChromium/f_000029
- /data/data/####/cache/webviewCacheChromium/f_000028
- /data/data/####/shared_prefs/uw.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_00003e
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/f_000034
- /data/data/####/cache/webviewCacheChromium/f_000035
- /data/data/####/cache/webviewCacheChromium/f_000036
- /data/data/####/cache/webviewCacheChromium/f_000037
- /data/data/####/cache/webviewCacheChromium/f_000030
- /data/data/####/cache/webviewCacheChromium/f_000031
- /data/data/####/cache/webviewCacheChromium/f_000032
- /data/data/####/cache/webviewCacheChromium/f_000033
- /data/data/####/cache/webviewCacheChromium/f_000038
- /data/data/####/cache/webviewCacheChromium/f_000039
- /data/data/####/cache/webviewCacheChromium/f_00003d
- /data/data/####/databases/mydata.db-journal
- /data/data/####/cache/webviewCacheChromium/f_00003f
- /data/data/####/cache/webviewCacheChromium/f_00003a
- /data/data/####/cache/webviewCacheChromium/f_00003b
- /data/data/####/cache/webviewCacheChromium/f_00003c
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/databases/mydata.db
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/shared_prefs/ui.xml
- /data/data/####/cache/webviewCacheChromium/f_00001f
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/cache/webviewCacheChromium/f_00001e
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/cache/webviewCacheChromium/f_00004e
- /data/data/####/cache/webviewCacheChromium/f_00004d
- /data/data/####/cache/webviewCacheChromium/f_00004a
- /data/data/####/shared_prefs/uw.xml
- /data/data/####/cache/webviewCacheChromium/f_00004c
- /data/data/####/cache/webviewCacheChromium/f_00004b
- /data/data/####/cache/webviewCacheChromium/f_000049
- /data/data/####/cache/webviewCacheChromium/f_000048
- /data/data/####/cache/webviewCacheChromium/f_000045
- /data/data/####/cache/webviewCacheChromium/f_000044
- /data/data/####/cache/webviewCacheChromium/f_000047
- /data/data/####/cache/webviewCacheChromium/f_000046
- /data/data/####/cache/webviewCacheChromium/f_000041
- /data/data/####/cache/webviewCacheChromium/f_000040
- /data/data/####/cache/webviewCacheChromium/f_000043
- /data/data/####/cache/webviewCacheChromium/f_000042
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/ui.xml.bak
Miscellaneous:
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
