Technical information
Malicious functions:
Sends SMS messages:
- 106575206321505460: dyl#null,<IMEI>,6000005-1-4-6_kh5s0339_-0
- 10691009: @8DYL#null,<IMEI>,6000005-1-4-6_kh5s0339_-0
- 12114516420: <IMSI>
Network activity:
Connecting to:
- 1####.####.226
- 1####.####.238
- 1####.####.238:8977
- 7j####.####.com
- a####.####.com
- and####.####.com
- and####.####.com:8077
- c-h####.####.com
- huangda####.com
- i####.####.cn
- m####.####.com
- p####.####.com
- re####.####.com
- re####.####.com:10002
- s####.####.com
- so####.com
- v####.####.com
- w####.####.com
HTTP GET requests:
- 1####.####.238/dex/version.txt
- 1####.####.238:8977/dex/version.txt
- 7j####.####.com/tdata_xzR429
- a####.####.com/fetch.php?gid=####&ch=####&key=####
- a####.####.com/location/ip?ak=####&mcode=####
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- i####.####.cn/iplookup/iplookup.php?format=####
- m####.####.com/course/504703.html?cm=####
- p####.####.com/cityjson?ie=####
- re####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sd...
- re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
- s####.####.com/config/hz-hzv3.conf
- so####.com/qsxa/qgpay/report_error/56019568?vncode=####&channel=####&err...
- v####.####.com/version/tcmn/app/mmplay
- w####.####.com/r/p/lyxy.jsp?ln=####&t1=####&cm=####
HTTP POST requests:
- 1####.####.226/api/qxt/tel/get
- and####.####.com/android/sms/netpay/prefetch.do
- and####.####.com:8077/page-switching-plat/clientPageSwitchingAction/getP...
- c-h####.####.com/api.php?format=####&t=####
- s####.####.com/api.php?format=####&t=####
- v####.####.com/api/payment/mobileInit.html
Modified file system:
Creates the following files:
- <Package Folder>/app_Wyzf_plg/5.0.7.jar
- <Package Folder>/app_dex/classes.jar
- <Package Folder>/app_workbench27724/apk.zip
- <Package Folder>/app_workbench33250/apk.zip
- <Package Folder>/app_workbench94422/apk.zip
- <Package Folder>/cache/####/-1264684123-888367103
- <Package Folder>/cache/####/-1546591655568052698
- <Package Folder>/cache/####/-2062276414430026185
- <Package Folder>/cache/####/-2102762250-2020766984
- <Package Folder>/cache/####/-2452093751366704580
- <Package Folder>/cache/####/-24520937597760693
- <Package Folder>/cache/####/-443644035-1389147947
- <Package Folder>/cache/####/-639546784-88113277
- <Package Folder>/cache/####/-7543602952108138002
- <Package Folder>/cache/####/-756349925-1589982848
- <Package Folder>/cache/####/1098038915918526444
- <Package Folder>/cache/####/12850355181928396572
- <Package Folder>/cache/####/16217717201149669204
- <Package Folder>/cache/####/16488862781558972158
- <Package Folder>/cache/####/18191730871263860944
- <Package Folder>/cache/####/19914581831928396572
- <Package Folder>/cache/####/2037421046-292466713
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/Data_sync.db-journal
- <Package Folder>/databases/increment.db-journal
- <Package Folder>/databases/pushext.db-journal
- <Package Folder>/databases/pushg.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/databases/tmpd8.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/plus.jar
- <Package Folder>/files/gdaemon_20161017
- <Package Folder>/files/init.pid
- <Package Folder>/files/libabc
- <Package Folder>/files/mobclick_agent_cached_<Package>4
- <Package Folder>/files/noend.ini
- <Package Folder>/files/push.pid
- <Package Folder>/files/run.pid
- <Package Folder>/files/tdata_CbF394.jar
- <Package Folder>/files/tdata_CbF394.tmp
- <Package Folder>/files/tdata_xzR429.jar
- <Package Folder>/files/tdata_xzR429.tmp
- <Package Folder>/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
- <Package Folder>/shared_prefs/BOOT_SMS_INFO.xml
- <Package Folder>/shared_prefs/BOOT_SMS_SENT_TIME.xml
- <Package Folder>/shared_prefs/DB_MTS.xml
- <Package Folder>/shared_prefs/QugouUser.xml
- <Package Folder>/shared_prefs/QugouUserTag.xml
- <Package Folder>/shared_prefs/UNICOM_LOG_UA.xml
- <Package Folder>/shared_prefs/VistorNo.xml
- <Package Folder>/shared_prefs/dispatch_log.xml
- <Package Folder>/shared_prefs/first_pref.xml
- <Package Folder>/shared_prefs/first_register.xml
- <Package Folder>/shared_prefs/jmsdk.dat.xml
- <Package Folder>/shared_prefs/jmsdk.dat.xml.bak
- <Package Folder>/shared_prefs/mgsdkfin1.xml
- <Package Folder>/shared_prefs/mgsdkfin1.xml.bak
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/sp_name_config20723719.xml
- <Package Folder>/shared_prefs/syndatabackup.xml
- <Package Folder>/shared_prefs/tpservices.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/version.dat.xml
- <Package Folder>/shared_prefs/wyzf_config20723719.xml
- <Package Folder>/shared_prefs/wyzf_config20723719.xml.bak
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.9whv1A8A2418D5C6D9B8795F5E82u2l/####/6rm6g8ldhzjk4n085zss875y14f206bw
- <SD-Card>/.9whv1A8A2418D5C6D9B8795F5E82u2l/####/Crash-2017-05-31-09-13-49-1496222029671.log
- <SD-Card>/.9whv1A8A2418D5C6D9B8795F5E82u2l/####/o2enbs887bdsa40lrf6b900vpo4z6729
- <SD-Card>/.9whv1A8A2418D5C6D9B8795F5E82u2l/####/ttqa0h892bzzf130gd8d3riib16740va
- <SD-Card>/.9whv1A8A2418D5C6D9B8795F5E82u2l/user.sys
- <SD-Card>/.tpservice/####/qsha_80001_5096.jar
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3003_2270.zip
- <SD-Card>/<Package>/####/f42a2f3be7be22d7413a108337d7f9e0
- <SD-Card>/CrashLog/WyyyCrashLog_20170531091349_2246.log
- <SD-Card>/libs/<Package>.db
- <SD-Card>/libs/app.db
- <SD-Card>/libs/com.getui.sdk.deviceId.db
- <SD-Card>/libs/com.igexin.sdk.deviceId.db
- <SD-Card>/system/####/tdata_CbF394
- <SD-Card>/system/####/tdata_xzR429
Miscellaneous:
Executes next shell scripts:
- /data/data/com.uehjqklz.bzfizequ/files/gdaemon_20161017 0 com.uehjqklz.bzfizequ/com.igexin.sdk.PushService 25169 300 0
- <dexopt>
- cat /sys/block/mmcblk0/device/cid
- chmod 700 /data/data/com.uehjqklz.bzfizequ/files/gdaemon_20161017
- chmod 700 <Package Folder>/files/gdaemon_20161017
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25169 300 0
