Technical information
Malicious functions:
Sends SMS messages:
- 106575206321505460: dyl#####,####,6000050-1-83-ZYXD_P13863_1093-0
- 12114: dyl#####,####,6000050-1-83-ZYXD_P13863_1093-0
Executes code of the following detected threats:
- Android.Spy.205.origin
- Android.SmsSend.1848.origin
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- huangda####.com
- cha####.####.com
- 1####.####.182:8090
- 1####.####.56:9039
- p####.####.com
- 1####.####.182
- 1####.####.56
- m####.####.com
- a####.####.com
HTTP GET requests:
- 1####.####.56//gamesit/xysdk/init
- p####.####.com/cityjson?ie=####
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- m####.####.com/get.php?apiKey=####&imsi=####
- 1####.####.56:9039/gamesit/jysdk/inix
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- 1####.####.56/gamesit/jysdk/inix
- 1####.####.56/gamesit/jysdk/initsdk?os_info=####&os_model=####&net_info=...
HTTP POST requests:
- huangda####.com/shop/shop_upload_log
- a####.####.com/app_logs
- cha####.####.com/channel/paymentHandle.action?v=####&requestId=####
- 1####.####.182/storage/receive
- 1####.####.182:8090/storage/receive
Modified file system:
Creates the following files:
- /data/data/####/baea/tmb.jar
- /data/data/####/shared_prefs/Cocos2dxPrefsFile.xml
- /data/data/####/shared_prefs/lxdMoblieAgent_sys_config.xml.bak
- /data/data/####/shared_prefs/ma_data.xml
- /data/data/####/shared_prefs/game_data.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/mj.apk
- /data/data/####/shared_prefs/dispatch_log.xml
- /data/data/####/files/noend.ini
- /data/data/####/shared_prefs/ma_call.xml
- /data/data/####/databases/database-journal
- /data/data/####/shared_prefs/b_share.xml
- /data/data/####/shared_prefs/lxdMoblieAgent_config_####.xml
- /data/data/####/shared_prefs/lxdMoblieAgent_upload_####.xml
- /data/data/####/shared_prefs/new_vvsion.xml
- /sdcard/.tpservice/####/download/jar/qsha_80001_5094.jar
- /data/data/####/shared_prefs/game_e_c_data.xml
- /data/data/####/shared_prefs/lxdMoblieAgent_event_####.xml
- /data/data/####/shared_prefs/nnt_data.xml
- /data/data/####/shared_prefs/zzconfig.xml
- /data/data/####/shared_prefs/pretw.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/files/.imprint
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/actlxd0
- /data/data/####/shared_prefs/zhangpay_sms_info.xml
- /data/data/####/files/syslxd2
- /data/data/####/databases/webview.db
- /data/data/####/app_my_dex/tmb.dex
- /data/data/####/shared_prefs/Cocos2dxPrefsFile.xml.bak
- /data/data/####/files/evnlxd1
- /data/data/####/app_my_dex/entrance.dex
- /data/data/####/files/mj.dex
- /data/data/####/databases/MA_epay_db
- /data/data/####/files/mobclick_agent_cached_####83
- /data/data/####/shared_prefs/lxdMoblieAgent_state_####.xml
- /data/data/####/databases/bil_db-journal
- /data/data/####/shared_prefs/zhangpay_share.xml.bak
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/b_setting.xml
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/lxdMoblieAgent_sys_config.xml
- /data/data/####/baea/entrance.jar
- /data/data/####/shared_prefs/edition.xml
- /sdcard/.twservice/qshp_3003_2244.zip
- /sdcard/.twservice/qshp_3003_2244/tw
- /data/data/####/shared_prefs/lxdMoblieAgent_upload_####.xml.bak
- /data/data/####/shared_prefs/zhangpay_share.xml
- /data/data/####/databases/bil_db
- /data/data/####/databases/MA_epay_db-journal
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/dexopt --dex 27 40 40 213440 /storage/emulated/0/.tpservice/####/download/jar/qsha_80001_5094.jar 1248298237 -1297833896 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/f
- /system/bin/dexopt --dex 27 69 40 124432 /data/data/####/files/mj.apk 1221296832 -232897668 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framew
- cat /sys/block/mmcblk0/device/cid
- /system/bin/dexopt --dex 27 71 40 124432 /data/data/####/files/mj.apk 1221296832 -232897668 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framew
- /system/bin/dexopt --dex 27 77 40 124432 /data/data/####/files/mj.apk 1221296832 -232897668 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framew
- /system/bin/dexopt --dex 27 60 40 60932 /data/data/####/baea/entrance.jar 1247445111 -2040847232 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f
- /system/bin/dexopt --dex 27 55 40 279508 /storage/emulated/0/.twservice/qshp_3003_2244/tw.jar 1248743589 1623017091 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
- /system/bin/dexopt --dex 27 69 40 167700 /data/data/####/baea/tmb.jar 1247445146 -1810655209 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/frame
- /system/bin/dexopt --dex 27 80 40 124432 /data/data/####/files/mj.apk 1221296832 -232897668 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framew
Contains functionality to send SMS messages automatically.
