Technical information
Malicious functions:
Sends SMS messages:
- 106904006189121: myqxt####
- 10658000: CJTX
Network activity:
Connecting to:
- pus####.####.cn
- pus####.####.net
- page####.####.info:8088
- p####.####.com
- p####.####.com:7820
- page####.####.info
- a####.####.com
HTTP GET requests:
- pus####.####.net/upfile/v1/2016-11-25174c3b4c-e4ae-4fe7-bd8a-f213b819c03e.jpg
- pus####.####.net/upfile/v1/2016-11-25d429be91-1899-4316-a8fc-0fa97d25afe2.jpg
- page####.####.info/?zckjvideocmd=####&platform=####
- pus####.####.net/upfile/v1/2016-11-25027a14d8-634f-43e0-b64c-790fbc30ac53.jpg
- p####.####.com/?igtcmd=####&nativePayCmd=####
- pus####.####.net/upfile/v1/2016-11-250c5f7319-31ac-4e11-be1d-e3d2dfebbbf1.jpg
- pus####.####.net/upfile/v1/2016-11-2526e97f59-d5ba-46eb-80ef-c5dd16c9f43b.jpg
- p####.####.com/?igtcmd=####&nativePayCmd=####&iccid=####&imsi=####&imei=####&sdk=####&price=####&payorder=####&umeng=####&msg=####
- pus####.####.cn/czfiles/mysdk1702061655
- pus####.####.net/upfile/v1/2016-11-25e2615351-ad9e-4ea9-94f3-3d7a325c0f92.jpg
- pus####.####.net/upfile/v1/2016-11-2553af617f-933f-4bda-8ce4-116575bbaf76.jpg
- pus####.####.net/upfile/v1/2016-11-252b12a48d-2102-4876-bbc1-13efe5491b54.jpg
- page####.####.info/earth/video/needshow2?channel=####
- p####.####.com/?igtcmd=####&order=####&state=####&paymsg=####&fingerprint=####
- p####.####.com/?igtcmd=####&iccid=####&imsi=####&imei=####&order=####&umeng=####&price=####&cpid=####&gameid=####&sdk=####&gamename=####&sdkpaypoint=#...
- page####.####.info/?zckjvideocmd=####&channelid=####&inmainview=####
- page####.####.info:8088/earth/enable?deviceid=####&version=####&imsi=####
- pus####.####.net/upfile/v1/2016-11-25e4434d6a-467a-429b-b87c-632ddacfa9ff.jpg
- pus####.####.net/upfile/v1/2016-11-25fc4b0a00-af8e-4d47-bc9e-78fd445f2e89.jpg
- pus####.####.net/upfile/v1/2016-11-2558b4a69e-29ed-45b3-8981-77b1e2d2f280.jpg
- pus####.####.net/upfile/v1/2016-11-251bcabccc-da50-496b-89ad-afa09e9c5643.jpg
- pus####.####.net/upfile/v1/2016-11-25c861387d-b043-41db-9258-d9d16eb7b49c.jpg
- pus####.####.net/upfile/v1/2016-11-2520a113b0-1ce9-4133-ab48-018b010417f2.jpg
HTTP POST requests:
- p####.####.com/
- p####.####.com:7820/
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_252b12a48d_2102_4876_bbc1_13efe5491b54_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_251bcabccc_da50_496b_89ad_afa09e9c5643_jpg
- /data/data/####/shared_prefs/ShareFiles.xml
- /data/data/####/files/net.tt.plugin.mysdk.apk
- /data/data/####/files/ijiami.dat
- /data/data/####/Plugin/net.tt.plugin.mysdk/dalvik-cache/base-1.dex
- /data/data/####/files/mobclick_agent_cached_####
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25d429be91_1899_4316_a8fc_0fa97d25afe2_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25e4434d6a_467a_429b_b87c_632ddacfa9ff_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_2553af617f_933f_4bda_8ce4_116575bbaf76_jpg
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25027a14d8_634f_43e0_b64c_790fbc30ac53_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_250c5f7319_31ac_4e11_be1d_e3d2dfebbbf1_jpg
- /data/data/####/shared_prefs/game_state_file.xml
- /sdcard/com.zckj.files/net.tt.plugin.mysdk
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_2520a113b0_1ce9_4133_ab48_018b010417f2_jpg
- /data/data/####/app_cache/ijiami.jar
- /data/data/####/databases/trinea_android_common.db-journal
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25e2615351_ad9e_4ea9_94f3_3d7a325c0f92_jpg
- /sdcard/com.zckj.files/u.apk
- /data/data/####/Plugin/net.tt.plugin.mysdk/Signature/Signature_0.key
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_2558b4a69e_29ed_45b3_8981_77b1e2d2f280_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25174c3b4c_e4ae_4fe7_bd8a_f213b819c03e_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_2526e97f59_d5ba_46eb_80ef_c5dd16c9f43b_jpg
- /data/data/####/Plugin/net.tt.plugin.mysdk/apk/base-1.apk
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25c861387d_b043_41db_9258_d9d16eb7b49c_jpg
- /data/data/####/shared_prefs/userinfo_file.xml
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25fc4b0a00_af8e_4d47_bc9e_78fd445f2e89_jpg
Sets the 'executable' attribute to the following files:
- /data/data/####/Plugin/net.tt.plugin.mysdk/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.mysdk/dalvik-cache/base-1.dex
Miscellaneous:
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
