Technical information
Malicious functions:
Sends SMS messages:
- 4446: SKLN AF01 VIDEOPU150v3.1.4 android ####
Network activity:
Connecting to:
- v####.####.com
- 2####.####.5:8765
- slm####.####.com
- b####.com
- iq####.com
- iq####.com:8999
HTTP GET requests:
- slm####.####.com/video/7.jpg
- iq####.com/india/static/js/plugins/fastclick.js
- b####.com/
- slm####.####.com/video/1.jpg
- iq####.com/india/static/images/title_bg_img.png
- slm####.####.com/music/4.jpg
- slm####.####.com/video/2.jpg
- slm####.####.com/video/10.jpg
- iq####.com/india/static/fonts/iconfont/iconfont.ttf
- slm####.####.com/video/9.jpg
- slm####.####.com/wallpaper/7.jpg
- v####.####.com/portal/ZipRoot/20161021/1477032716753.zip
- slm####.####.com/wallpaper/3.jpg
- iq####.com/india/static/js/index.js
- iq####.com/india/static/css/swiper.min.css
- slm####.####.com/video/4.jpg
- iq####.com/india/static/js/plugins/jquery.min.js
- iq####.com/india/static/js/plugins/jquery.swipebox.js
- slm####.####.com/wallpaper/8.jpg
- iq####.com/india/video-play-1.jsp?cover=####&src=####
- iq####.com/india/static/css/style.css
- slm####.####.com/wallpaper/5.jpg
- iq####.com/india/static/css/appbox.css
- slm####.####.com/video/11.jpg
- slm####.####.com/music/5.jpg
- slm####.####.com/music/3.jpg
- slm####.####.com/wallpaper/6.jpg
- slm####.####.com/music/6.jpg
- iq####.com/india/static/js/plugins/swiper.min.js
- iq####.com:8999/india/skylindex.jsp
- slm####.####.com/video/Sunshine.mp4
- iq####.com/india/static/js/plugins/jquery.fittext.js
- iq####.com/wapinit
- iq####.com/india/static/css/swipebox.min.css
- slm####.####.com/wallpaper/1.jpg
- slm####.####.com/video/5.jpg
- slm####.####.com/video/3.jpg
- slm####.####.com/music/1.jpg
- slm####.####.com/wallpaper/4.jpg
- slm####.####.com/wallpaper/9.jpg
- slm####.####.com/video/8.jpg
- slm####.####.com/video/6.jpg
- slm####.####.com/wallpaper/2.jpg
- iq####.com/india/static/css/iconfont.css
- slm####.####.com/music/2.jpg
- iq####.com/india/static/js/plugins/ios-orientationchange-fix.js
- iq####.com/india/api/img/banner.jpg
- slm####.####.com/video/12.jpg
HTTP POST requests:
- v####.####.com/GetShellFile.aspx
- 2####.####.5:8765/sdkinitencode
- v####.####.com/AddMobile.aspx
- v####.####.com/GetMasterControlFile.aspx
Modified file system:
Creates the following files:
- /sdcard/Android/data/.com.android.zservice/Report/sys_Operator
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /sdcard/Android/data/.com.sys/.tw3.jpg
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /sdcard/time.cfg
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/files/Config/sys_config.ziptemp
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/shared_prefs/WebViewSettings.xml
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /sdcard/Android/data/.com.android.zservice/Report/update_DownloadApk
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/files/Config/ShellConfig
- /sdcard/Android/data/.com.android.zservice/Report/update_Operator
- /sdcard/Android/data/.com.android.zservice/Report/Operator
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /sdcard/Android/data/.com.android.zservice/Report/sys_DownFile
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/shared_prefs/System_Shell.xml
- /sdcard/Android/data/.com.android.zservice/Report/DownloadApk
- /data/data/####/files/shell_Daemon
- /data/data/####/shared_prefs/profile.xml.bak
- /data/data/####/shared_prefs/profile.xml
- /data/data/####/cache/webviewCacheChromium/index
Sets the 'executable' attribute to the following files:
- /data/data/####/files/shell_Daemon
Miscellaneous:
Executes next shell scripts:
- sh
Contains functionality to send SMS messages automatically.
