Technical information
Malicious functions:
Sends SMS messages:
- 1069013352371: SWA#383937303130323636393931383737343336
Network activity:
Connecting to:
- s####.####.com
- g####.####.com
- h####.####.com
- 7j####.####.com
- 1####.####.com
- c-h####.####.com
- d####.####.com
- m####.####.com
- st####.####.com
- a####.####.com
- pass####.####.com
HTTP GET requests:
- g####.####.com/app/models/ty/statistics_ty_v1.js
- st####.####.com/cms/web/center/res/forum.css
- a####.####.com/store/platform/app/recommend/list?iAppId=####&iCategoryId...
- 1####.####.com/ck?jscall=####
- st####.####.com/cms/web/res/sky_v2/data/sheet.js?2016####
- st####.####.com/cms/upload/generalHeadline/201608/2016081513162422.png
- a####.####.com/cms/freestore/android/cms/forumHomepage/forumHomepage.jso...
- a####.####.com/location/ip?ak=####
- 1####.####.com/_u.gif
- st####.####.com/appSpace/0/0/234/234403/302/icon.png
- a####.####.com/cms/freestore/android/cms/terminalMng/client/systemConfig...
- s####.####.com/actionimp.json?game_id=####&server_id=####&act_id=####&ac...
- a####.####.com/store/platform/center/headpage/city
- st####.####.com/cms/freestore/systemConf/splash/1495622304282.jpg
- a####.####.com/cms/web/res/core/sky2_loader.js
- a####.####.com/store/platform/center/headpage/general/free?cImei=####
- st####.####.com/cms/upload/homepage/201608/2016081616091564.png
- st####.####.com/appSpace/0/0/234/234303/37/icon.png
- st####.####.com/cms/web/res/sky_v2/data/ajax.js?2016####
- st####.####.com/appSpace/0/0/233/233503/12/icon.png
- h####.####.com/hm.js?d977828####
- a####.####.com/appSpace/0/0/234/234306/detail.json
- a####.####.com/cms/web/center/script/forum.js?2016####
- a####.####.com/cms/html/config.js
- st####.####.com/cms/web/res/imgs/loading.gif
- a####.####.com/store/platform/center/check/version?cVersionCode=####&iPl...
- s####.####.com/config/hz-hzv3.conf
- st####.####.com/cms/html/res/sky_v1/core.js?_2014####
- st####.####.com/cms/html/res/sky_v1/api.js?_2014####
- a####.####.com/store/platform/center/announcement/type/1
- 7j####.####.com/tdata_oIB717
- a####.####.com/store/platform/center/announcement/type/4
- a####.####.com/cms/html/ios/forum.html
- a####.####.com/appSpace/0/0/233/233503/detail.json
- a####.####.com/store/platform/member/channel/app/v1?iChannelId=####
- st####.####.com/cms/web/res/sky_v2/sky.js?2016####
- st####.####.com/cms/web/res/core/sky2/api.js?2016####
- a####.####.com/cms/freestore/android/cms/depositApps/depositApps.json
- st####.####.com/cms/web/res/sky_v2/data/comm.js?2016####
- st####.####.com/cms/web/res/sky_v2/dom/dom.js?2016####
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln...
- 7j####.####.com/tdata_IJr270
- a####.####.com/cms/web/center/forum.html
- st####.####.com/appSpace/0/0/234/234306/150/icon.png
- a####.####.com/store/platform/center/headpage/general/discover?cImei=####
- st####.####.com/cms/web/res/sky_v2/dom/anim.js?2016####
- a####.####.com/store/platform/center/headpage/v2?cImei=####&iNum=####&sC...
- 1####.####.com/_t.gif?lh=####&re=####&mt=####&kw=####&mk=####&scT=####&m...
- a####.####.com/cms/freestore/android/mobileApps/collection/45/45_1.json
- a####.####.com/store/platform/channel/list
- st####.####.com/cms/web/res/sky_v2/data/template.js?2016####
- st####.####.com/cms/web/res/core/app_interface.js?2016####
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja...
HTTP POST requests:
- s####.####.com/api.php?format=####&t=####
- m####.####.com/passport/queryConfig.do
- d####.####.com/_event.gif
- pass####.####.com/fbi/passport/mobile/queryImsi.do
- a####.####.com/app_logs
- c-h####.####.com/api.php?format=####&t=####
- a####.####.com/store/platform/app/patch/list
Modified file system:
Creates the following files:
- <Package Folder>/databases/statistics.db-journal
- <Package Folder>/shared_prefs/freeStoreXmlData.xml.bak
- <Package Folder>/files/run.pid
- <Package Folder>/databases/downloads.db-journal
- <Package Folder>/databases/hmdb
- <Package Folder>/shared_prefs/freeStoreXmlData.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/a/e/journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/databases/logdb.db
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/snail_app_store.db-journal
- <Package Folder>/files/a/e/journal.tmp
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/files/.umeng/exchangeIdentity.json
- <Package Folder>/shared_prefs/TestinAgent.xml
- <Package Folder>/databases/hmdb-journal
- <Package Folder>/files/tdata_IJr270.jar
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/tdata_IJr270.tmp
- <Package Folder>/shared_prefs/disk_entries_list_image_cache_-127445869.xml
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/files/a/e/97107178990413.0
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes2047969057.zip
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/image_cache/v2.ols100.1/35/djuhcHCyrZoALzBMiIX0c9fpDwE.-1114037535.tmp
- <Package Folder>/databases/increment.db-journal
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/files/a/e/24107113265001.0
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes-231002063.zip
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/databases/pushg.db-journal
- <Package Folder>/files/temp_photo.jpg
- <Package Folder>/files/init.pid
- <Package Folder>/databases/logdb.db-journal
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/files/push.pid
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- <dexopt>
Contains functionality to send SMS messages automatically.
