Technical information
Malicious functions:
Sends SMS:
- 106901332942: rg|549|AhB3j.S11wiZPLfC4voMlAPLf5l4OMLO8Og5z74T387kLNxXb6eCKY7LDm9A,ad,4KI3AUmVWWUzTTIYrYWD4u1zfn5IXKSFrzVbGBEZKZk!
Executes code of the following detected threats:
- Android.Spy.373.origin
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.55.161.68:29092
- TCP(HTTP/1.1) csk.mc####.com:9003
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
DNS requests:
- csk.mc####.com
- pl####.funu####.com
HTTP GET requests:
- ti####.c####.l####.####.com/
- ti####.c####.l####.####.com/cocos2d.js
- ti####.c####.l####.####.com/jquery-min.js
- ti####.c####.l####.####.com/res/armatures/delete.ExportJson
- ti####.c####.l####.####.com/res/armatures/delete0.plist
- ti####.c####.l####.####.com/res/armatures/delete0.png
- ti####.c####.l####.####.com/res/armatures/em.ExportJson
- ti####.c####.l####.####.com/res/armatures/em0.plist
- ti####.c####.l####.####.com/res/armatures/em0.png
- ti####.c####.l####.####.com/res/armatures/m_1.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_10.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_10.plist
- ti####.c####.l####.####.com/res/armatures/m_10.png
- ti####.c####.l####.####.com/res/armatures/m_100.plist
- ti####.c####.l####.####.com/res/armatures/m_100.png
- ti####.c####.l####.####.com/res/armatures/m_11.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_110.plist
- ti####.c####.l####.####.com/res/armatures/m_110.png
- ti####.c####.l####.####.com/res/armatures/m_12.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_120.plist
- ti####.c####.l####.####.com/res/armatures/m_120.png
- ti####.c####.l####.####.com/res/armatures/m_13.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_130.plist
- ti####.c####.l####.####.com/res/armatures/m_130.png
- ti####.c####.l####.####.com/res/armatures/m_14.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_140.plist
- ti####.c####.l####.####.com/res/armatures/m_140.png
- ti####.c####.l####.####.com/res/armatures/m_15.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_150.plist
- ti####.c####.l####.####.com/res/armatures/m_150.png
- ti####.c####.l####.####.com/res/armatures/m_15_skill.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_15_skill0.plist
- ti####.c####.l####.####.com/res/armatures/m_15_skill0.png
- ti####.c####.l####.####.com/res/armatures/m_2.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_20.plist
- ti####.c####.l####.####.com/res/armatures/m_20.png
- ti####.c####.l####.####.com/res/armatures/m_3.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_30.plist
- ti####.c####.l####.####.com/res/armatures/m_30.png
- ti####.c####.l####.####.com/res/armatures/m_4.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_40.plist
- ti####.c####.l####.####.com/res/armatures/m_40.png
- ti####.c####.l####.####.com/res/armatures/m_5.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_50.plist
- ti####.c####.l####.####.com/res/armatures/m_50.png
- ti####.c####.l####.####.com/res/armatures/m_6.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_60.plist
- ti####.c####.l####.####.com/res/armatures/m_60.png
- ti####.c####.l####.####.com/res/armatures/m_7.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_70.plist
- ti####.c####.l####.####.com/res/armatures/m_70.png
- ti####.c####.l####.####.com/res/armatures/m_8.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_80.plist
- ti####.c####.l####.####.com/res/armatures/m_80.png
- ti####.c####.l####.####.com/res/armatures/m_9.ExportJson
- ti####.c####.l####.####.com/res/armatures/m_90.plist
- ti####.c####.l####.####.com/res/armatures/m_90.png
- ti####.c####.l####.####.com/res/armatures/p_1.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_10.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_10.plist
- ti####.c####.l####.####.com/res/armatures/p_10.png
- ti####.c####.l####.####.com/res/armatures/p_100.plist
- ti####.c####.l####.####.com/res/armatures/p_100.png
- ti####.c####.l####.####.com/res/armatures/p_1_hurt.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_1_hurt0.plist
- ti####.c####.l####.####.com/res/armatures/p_1_hurt0.png
- ti####.c####.l####.####.com/res/armatures/p_2.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_20.plist
- ti####.c####.l####.####.com/res/armatures/p_20.png
- ti####.c####.l####.####.com/res/armatures/p_2_energy.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_2_energy0.plist
- ti####.c####.l####.####.com/res/armatures/p_2_energy0.png
- ti####.c####.l####.####.com/res/armatures/p_3.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_30.plist
- ti####.c####.l####.####.com/res/armatures/p_30.png
- ti####.c####.l####.####.com/res/armatures/p_4.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_40.plist
- ti####.c####.l####.####.com/res/armatures/p_40.png
- ti####.c####.l####.####.com/res/armatures/p_5.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_50.plist
- ti####.c####.l####.####.com/res/armatures/p_50.png
- ti####.c####.l####.####.com/res/armatures/p_5_hurt.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_5_hurt0.plist
- ti####.c####.l####.####.com/res/armatures/p_5_hurt0.png
- ti####.c####.l####.####.com/res/armatures/p_6.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_60.plist
- ti####.c####.l####.####.com/res/armatures/p_60.png
- ti####.c####.l####.####.com/res/armatures/p_7.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_70.plist
- ti####.c####.l####.####.com/res/armatures/p_70.png
- ti####.c####.l####.####.com/res/armatures/p_7_hurt.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_7_hurt0.plist
- ti####.c####.l####.####.com/res/armatures/p_7_hurt0.png
- ti####.c####.l####.####.com/res/armatures/p_8.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_80.plist
- ti####.c####.l####.####.com/res/armatures/p_80.png
- ti####.c####.l####.####.com/res/armatures/p_8_hurt.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_8_hurt0.plist
- ti####.c####.l####.####.com/res/armatures/p_8_hurt0.png
- ti####.c####.l####.####.com/res/armatures/p_9.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_90.plist
- ti####.c####.l####.####.com/res/armatures/p_90.png
- ti####.c####.l####.####.com/res/armatures/p_9_bullet.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_9_bullet0.plist
- ti####.c####.l####.####.com/res/armatures/p_9_bullet0.png
- ti####.c####.l####.####.com/res/armatures/p_9_hurt.ExportJson
- ti####.c####.l####.####.com/res/armatures/p_9_hurt0.plist
- ti####.c####.l####.####.com/res/armatures/p_9_hurt0.png
- ti####.c####.l####.####.com/res/armatures/skill_1.ExportJson
- ti####.c####.l####.####.com/res/armatures/skill_10.plist
- ti####.c####.l####.####.com/res/armatures/skill_10.png
- ti####.c####.l####.####.com/res/armatures/skill_2.ExportJson
- ti####.c####.l####.####.com/res/armatures/skill_20.plist
- ti####.c####.l####.####.com/res/armatures/skill_20.png
- ti####.c####.l####.####.com/res/armatures/skill_3.ExportJson
- ti####.c####.l####.####.com/res/armatures/skill_30.plist
- ti####.c####.l####.####.com/res/armatures/skill_30.png
- ti####.c####.l####.####.com/res/bar_bg.png
- ti####.c####.l####.####.com/res/bullet/m14_6.png
- ti####.c####.l####.####.com/res/bullet/p1_0.png
- ti####.c####.l####.####.com/res/bullet/p5_0.png
- ti####.c####.l####.####.com/res/bullet/p7_0.png
- ti####.c####.l####.####.com/res/bullet/p8_0.png
- ti####.c####.l####.####.com/res/bullet/p9_0.png
- ti####.c####.l####.####.com/res/chapterMenu/back_btn_cn.png
- ti####.c####.l####.####.com/res/chapterMenu/chapter_bg.jpg
- ti####.c####.l####.####.com/res/chapterMenu/chapter_btn.png
- ti####.c####.l####.####.com/res/chapterMenu/lock.png
- ti####.c####.l####.####.com/res/chapterMenu/tap_0.png
- ti####.c####.l####.####.com/res/chapterMenu/tap_1.png
- ti####.c####.l####.####.com/res/encyclopediaMenu/a1.png
- ti####.c####.l####.####.com/res/encyclopediaMenu/a2.png
- ti####.c####.l####.####.com/res/encyclopediaMenu/a3.png
- ti####.c####.l####.####.com/res/encyclopediaMenu/bg.png
- ti####.c####.l####.####.com/res/encyclopediaMenu/eInfoBg.png
- ti####.c####.l####.####.com/res/encyclopediaMenu/infoBg.png
- ti####.c####.l####.####.com/res/energy.png
- ti####.c####.l####.####.com/res/energy_bg.png
- ti####.c####.l####.####.com/res/font/aller_bd-webfont.svg
- ti####.c####.l####.####.com/res/font/aller_bd-webfont.ttf
- ti####.c####.l####.####.com/res/gameMenu/clickHint.plist
- ti####.c####.l####.####.com/res/gameMenu/clickHint.png
- ti####.c####.l####.####.com/res/gameMenu/delete_btn.png
- ti####.c####.l####.####.com/res/gameMenu/infoBtn.png
- ti####.c####.l####.####.com/res/gameMenu/loseText.png
- ti####.c####.l####.####.com/res/gameMenu/m1.png
- ti####.c####.l####.####.com/res/gameMenu/m10.png
- ti####.c####.l####.####.com/res/gameMenu/m11.png
- ti####.c####.l####.####.com/res/gameMenu/m12.png
- ti####.c####.l####.####.com/res/gameMenu/m13.png
- ti####.c####.l####.####.com/res/gameMenu/m14.png
- ti####.c####.l####.####.com/res/gameMenu/m15.png
- ti####.c####.l####.####.com/res/gameMenu/m2.png
- ti####.c####.l####.####.com/res/gameMenu/m3.png
- ti####.c####.l####.####.com/res/gameMenu/m4.png
- ti####.c####.l####.####.com/res/gameMenu/m5.png
- ti####.c####.l####.####.com/res/gameMenu/m6.png
- ti####.c####.l####.####.com/res/gameMenu/m7.png
- ti####.c####.l####.####.com/res/gameMenu/m8.png
- ti####.c####.l####.####.com/res/gameMenu/m9.png
- ti####.c####.l####.####.com/res/gameMenu/mainmenu_btn_cn.png
- ti####.c####.l####.####.com/res/gameMenu/musicoff_btn_cn.png
- ti####.c####.l####.####.com/res/gameMenu/musicon_btn_cn.png
- ti####.c####.l####.####.com/res/gameMenu/next_btn_cn.png
- ti####.c####.l####.####.com/res/gameMenu/pause.png
- ti####.c####.l####.####.com/res/gameMenu/restart_btn_cn.png
- ti####.c####.l####.####.com/res/gameMenu/resume_btn.png
- ti####.c####.l####.####.com/res/gameMenu/skill1.png
- ti####.c####.l####.####.com/res/gameMenu/skill2.png
- ti####.c####.l####.####.com/res/gameMenu/skill3.png
- ti####.c####.l####.####.com/res/gameMenu/skill_1_0.png
- ti####.c####.l####.####.com/res/gameMenu/skill_2_0.png
- ti####.c####.l####.####.com/res/gameMenu/skill_3_0.png
- ti####.c####.l####.####.com/res/gameMenu/winShine.png
- ti####.c####.l####.####.com/res/gameMenu/winStar.png
- ti####.c####.l####.####.com/res/gameMenu/winText.png
- ti####.c####.l####.####.com/res/lr_btn.png
- ti####.c####.l####.####.com/res/mainMenu/encyclopediaBtn_cn.png
- ti####.c####.l####.####.com/res/mainMenu/logo.png
- ti####.c####.l####.####.com/res/mainMenu/mainmenu_bg.jpg
- ti####.c####.l####.####.com/res/mainMenu/musicoff.png
- ti####.c####.l####.####.com/res/mainMenu/musicon.png
- ti####.c####.l####.####.com/res/mainMenu/start_btn_cn.png
- ti####.c####.l####.####.com/res/monster/m_1.png
- ti####.c####.l####.####.com/res/monster/m_10.png
- ti####.c####.l####.####.com/res/monster/m_11.png
- ti####.c####.l####.####.com/res/monster/m_12.png
- ti####.c####.l####.####.com/res/monster/m_13.png
- ti####.c####.l####.####.com/res/monster/m_14.png
- ti####.c####.l####.####.com/res/monster/m_15.png
- ti####.c####.l####.####.com/res/monster/m_2.png
- ti####.c####.l####.####.com/res/monster/m_3.png
- ti####.c####.l####.####.com/res/monster/m_4.png
- ti####.c####.l####.####.com/res/monster/m_5.png
- ti####.c####.l####.####.com/res/monster/m_6.png
- ti####.c####.l####.####.com/res/monster/m_7.png
- ti####.c####.l####.####.com/res/monster/m_8.png
- ti####.c####.l####.####.com/res/monster/m_9.png
- ti####.c####.l####.####.com/res/p10_0.png
- ti####.c####.l####.####.com/res/plant_1.png
- ti####.c####.l####.####.com/res/plant_10.png
- ti####.c####.l####.####.com/res/plant_2.png
- ti####.c####.l####.####.com/res/plant_3.png
- ti####.c####.l####.####.com/res/plant_4.png
- ti####.c####.l####.####.com/res/plant_5.png
- ti####.c####.l####.####.com/res/plant_6.png
- ti####.c####.l####.####.com/res/plant_7.png
- ti####.c####.l####.####.com/res/plant_8.png
- ti####.c####.l####.####.com/res/plant_9.png
- ti####.c####.l####.####.com/res/plant_btn.png
- ti####.c####.l####.####.com/res/skill_3_3.png
- ti####.c####.l####.####.com/res/skill_3_4.png
- ti####.c####.l####.####.com/res/softgames.png
- ti####.c####.l####.####.com/res/sound/bgm.mp3
- ti####.c####.l####.####.com/res/stage_1.jpg
- ti####.c####.l####.####.com/res/stage_2.jpg
- ti####.c####.l####.####.com/res/stage_3.jpg
- ti####.c####.l####.####.com/res/tutorial/arrow.png
- ti####.c####.l####.####.com/res/tutorial/t1.png
- ti####.c####.l####.####.com/res/tutorial/t2.png
- ti####.c####.l####.####.com/res/tutorial/teach.plist
- ti####.c####.l####.####.com/res/tutorial/teach.png
- ti####.c####.l####.####.com/sg.hooks.js
- ti####.c####.l####.####.com/single.js
HTTP POST requests:
- csk.mc####.com:9003/csk/c_s/g_f.json
- csk.mc####.com:9003/csk/st_c/cn_i_sec.json
- csk.mc####.com:9003/csk/st_c/cn_sk_Order.json
- csk.mc####.com:9003/csk/st_c/cn_sk_login.json
- csk.mc####.com:9003/csk/st_c/cn_sk_specialVersion.json
- csk.mc####.com:9003/csk/st_c/cn_sk_tj.json
- csk.mc####.com:9003/csk/st_c/getst_tegy.json
File system changes:
Creates the following files:
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/app_test.apk
- /data/data/####/brushs.xml
- /data/data/####/bt_bkg.xml
- /data/data/####/bt_grey.xml
- /data/data/####/cds.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/diag_bg.xml
- /data/data/####/diag_cls_ig.png
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/fmoonStore.db
- /data/data/####/fmoonStore.db-journal
- /data/data/####/fpsdktempfile
- /data/data/####/fs_dia_fir_ly.xml
- /data/data/####/fs_dia_fir_ly_old.xml
- /data/data/####/fs_dia_ret_ly.xml
- /data/data/####/fs_dia_snd_ly.xml
- /data/data/####/index
- /data/data/####/ojuljtyd
- /data/data/####/order_sp.xml
- /data/data/####/pro_activi_sho.png
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Loads the following dynamic libraries:
- wggwtmpq
Uses the following algorithms to encrypt data:
- AES
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
Gets information about sent/received SMS.
