Technical information
Malicious functions:
Sends SMS messages:
- 12114516412: systemcGx1dG8yNTAwMjY2OTkxODc3NDM=
Executes code of the following detected threats:
- Android.Triada.133
Downloads the following detected threats from the Web:
- Android.Triada.133
Network activity:
Connecting to:
- s####.####.com
- g####.####.com
- w####.####.com
- 1####.####.219
- b####.com
- p####.####.com
- 1####.####.45:10002
- 2####.####.112:8080
- c####.####.com
- reso####.####.com
- apm-col####.####.com
- p####.####.cn
- ne####.####.com
- res####.####.com
- 2####.####.134:8080
- c####.####.net
- m####.####.cn
HTTP GET requests:
- g####.####.com/hwwh5/images/_lcby.png
- ne####.####.com/wp-content/uploads/2016/07/zsq38.jpg
- ne####.####.com/wp-content/uploads/2016/08/zsq15.jpg
- b####.com/
- ne####.####.com/wp-content/uploads/2016/11/z90-300x426.jpg
- m####.####.cn/mtin.db.shcut.zip
- p####.####.com/json2/visitor1.php?pay_Id=####&package=####&appid=####
- ne####.####.com/wp-content/uploads/2016/07/zsq66.jpg
- s####.####.com/versioncheck.aspx?
- ne####.####.com/wp-content/uploads/2016/07/zsq6.jpg
- m####.####.cn/mtin.db.unacc_TH_2017011601.zip
- w####.####.com/rdo/order/invalid;jsessionid=B959A97626B339491BE53623F63D...
- 1####.####.219/payConfig/sdkPriori.html
- w####.####.com/rdo/order?mcpid=####&orderNo=####&feeCode=####&reqTime=##...
- s####.####.com/GetFeeData.aspx?iswifi=####
- ne####.####.com/wp-content/uploads/2016/07/zsq45.jpg
- ne####.####.com/wp-content/uploads/2016/07/zsq31-1.jpg
- ne####.####.com/wp-content/uploads/2016/07/zsq43.jpg
- p####.####.com/handao_img/newsp/shikan_97.jpg
- s####.####.com/getconfig.aspx?
- p####.####.com/json2/stat.php?pay_Id=####&package=####&appid=####&v=####...
- ne####.####.com/wp-content/uploads/2016/07/zsq62.jpg
- c####.####.com/20170317/tongyu-pay-lib-2144.apk
- ne####.####.com/wp-content/uploads/2016/07/zsq22.jpg
- res####.####.com/v3/ip?output=####&key=####
- p####.####.com/handao_img/newsp/shikan_13.jpg
- p####.####.com/handao_img/newsp/shikan_152.jpg
- reso####.####.com/gslb/gslb/getbucket.asp
- p####.####.com/sdkMis/getRdoUrl
- ne####.####.com/wp-content/uploads/2016/11/z97-300x425.jpg
- p####.####.com/handao_img/newsp/shikan_109.jpg
- w####.####.com/rdo/order/invalid;jsessionid=190E1778B35A6CE601AFC87CDEAB...
- ne####.####.com/wp-content/uploads/2016/07/zsq3.jpg
HTTP POST requests:
- p####.####.com/sdkMis/sdk-update
- 1####.####.45:10002/admgr/admgrsurvey.do
- p####.####.com/sdkMis/mobile-submit
- p####.####.cn/index.php/API
- 2####.####.112:8080/mtin-traf/shcut/chks
- apm-col####.####.com/cpi/crash
- 2####.####.134:8080/mtin/home
- p####.####.com/sdkMis/mobile-status-quo
- p####.####.com/sdkMis/init-submit
- c####.####.net/cat.php/Cat/SCR?ver=####&tp=####
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/gud.xml
- /data/data/####/databases/db_feeList
- /data/data/####/shared_prefs/TestinCrash.xml.bak
- /data/data/####/cache/picasso-cache/ef927b4571355d41efabf89399f9f007.0.tmp
- /data/data/####/cache/picasso-cache/eea69bd863eb73daa71d291cbc5c626a.0.tmp
- /data/data/####/cache/picasso-cache/470d5bd8f8c518515e2bac61b17b65d2.1.tmp
- /data/data/####/shared_prefs/config.xml
- /data/data/####/files/mj.apk
- /data/data/####/cache/picasso-cache/34768c7ca680f4aeefb343ef075e8eff.1.tmp
- /data/data/####/databases/down.db-journal
- /data/data/####/cache/picasso-cache/eea69bd863eb73daa71d291cbc5c626a.1.tmp
- /data/data/####/cache/picasso-cache/4dd76768c666e3b57d067cfc993312c5.1.tmp
- /data/data/####/cache/picasso-cache/3aecad2afc164b65e02cdfa266978b5c.0.tmp
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/databases/cc/cc.db
- /data/data/####/cache/picasso-cache/c618a45f7df64f8c30c56dd042af99ea.0.tmp
- /data/data/####/cache/picasso-cache/b278df286b5e0a718fc9d06d88717a74.0.tmp
- /data/data/####/shared_prefs/cpMsg.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/cache/picasso-cache/423865e5d38c43ace59567b81d5a0dd2.1.tmp
- /data/data/####/app_tongyu/plugins/download/tongyu-pay-lib.apk
- /data/data/####/cache/picasso-cache/decd62b949aa0deeb8d1d9bd3e7d8969.0.tmp
- /data/data/####/cache/picasso-cache/949aba01bb1b50c6ecf407d0d03ef43c.1.tmp
- /data/data/####/cache/picasso-cache/949aba01bb1b50c6ecf407d0d03ef43c.0.tmp
- /data/data/####/shared_prefs/port.xml.bak
- /data/data/####/cache/picasso-cache/b278df286b5e0a718fc9d06d88717a74.1.tmp
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/cache/picasso-cache/1a3e160c40b212065089e659771e0e7a.0.tmp
- /data/data/####/shared_prefs/port.xml
- /data/data/####/databases/TestinAgent.db-journal
- /data/data/####/cache/picasso-cache/470d5bd8f8c518515e2bac61b17b65d2.0.tmp
- /data/data/####/cache/picasso-cache/d7f5a712ca7fd7d88cbd7fa9bd615cd3.1.tmp
- /data/data/####/cache/picasso-cache/34768c7ca680f4aeefb343ef075e8eff.0.tmp
- /data/data/####/cache/picasso-cache/23fceccb1b9925c4564823018ed28065.0.tmp
- /data/data/####/cache/picasso-cache/8ffabd8f58c8c7d2fc57627a51cfc67f.1.tmp
- /data/data/####/databases/TestinAgent.db
- /data/data/####/cache/picasso-cache/decd62b949aa0deeb8d1d9bd3e7d8969.1.tmp
- /data/data/####/cache/picasso-cache/4dd76768c666e3b57d067cfc993312c5.0.tmp
- /data/data/####/shared_prefs/ui.xml
- /data/data/####/cache/picasso-cache/c618a45f7df64f8c30c56dd042af99ea.1.tmp
- /data/data/####/cache/picasso-cache/1a3e160c40b212065089e659771e0e7a.1.tmp
- /data/data/####/cache/picasso-cache/98cfa6f76f648a8e98c12070c53dd8fb.0.tmp
- /data/data/####/databases/sms_db
- /data/data/####/databases/down.db
- /data/data/####/cache/picasso-cache/3aecad2afc164b65e02cdfa266978b5c.1.tmp
- /data/data/####/databases/sms_db-journal
- /data/data/####/cache/picasso-cache/423865e5d38c43ace59567b81d5a0dd2.0.tmp
- /data/data/####/cache/picasso-cache/23fceccb1b9925c4564823018ed28065.1.tmp
- /sdcard/Download/jdapks/375546734252347773464d677a76747a3176416f55513d3d.png
- /data/data/####/app_tongyu/plugins/tongyu-pay-lib.apk
- /data/data/####/databases/mp.db-journal
- /data/data/####/cache/picasso-cache/journal.tmp
- /data/data/####/databases/db_feeList-journal
- /data/data/####/cache/picasso-cache/8ffabd8f58c8c7d2fc57627a51cfc67f.0.tmp
- /data/data/####/shared_prefs/ui.xml.bak
- /data/data/####/cache/picasso-cache/98cfa6f76f648a8e98c12070c53dd8fb.1.tmp
- /data/data/####/databases/mp.db
- /data/data/####/files/mtin.db.unacc_TH_2017011601.zip
- /data/data/####/files/mtin.db.shcut.zip
- /data/data/####/cache/picasso-cache/d7f5a712ca7fd7d88cbd7fa9bd615cd3.0.tmp
- /data/data/####/cache/picasso-cache/ef927b4571355d41efabf89399f9f007.1.tmp
- /data/data/####/shared_prefs/getFlag.xml
- /data/data/####/shared_prefs/config.xml.bak
- /data/data/####/shared_prefs/TestinCrash.xml
Miscellaneous:
Executes next shell scripts:
- cat /sys/class/net/wlan0/address
Contains functionality to send SMS messages automatically.
