Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.1699.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) i####.cn.com:80
- TCP(HTTP/1.1) gaand####.talking####.net:80
- TCP(HTTP/1.1) td.m####.cn:80
DNS requests:
- a####.u####.com
- gaand####.talking####.net
- i####.cn.com
- q####.qi1####.com
- td.m####.cn
HTTP GET requests:
- i####.cn.com/a/3f565628a54ead6c51c0987c43b0fff91
HTTP POST requests:
- a####.u####.com/app_logs
- gaand####.talking####.net/g/d?crc=####
- td.m####.cn/api/q/a/3f565628a54ead6c51c0987c43b0fff91
File system changes:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/3f565628a54ead6c51c0987c43b0fff91;account_file.xml
- /data/data/####/91de44280c06425c8f92933f4f93c702
- /data/data/####/helper
- /data/data/####/mobclick_agent_cached_qrp.floct.redsvt.HWP2016_5811004
- /data/data/####/mobclick_agent_online_setting_qrp.floct.redsvt....81.xml
- /data/data/####/mpush_game.db
- /data/data/####/mpush_game.db-journal
- /data/data/####/mpush_gateway_preferences_file
- /data/data/####/mpush_version_preferences_file
- /data/data/####/pid
- /data/data/####/pref_file.xml
- /data/data/####/qrp.floct.redsvt.HWP2016_581-1.dex
- /data/data/####/qrp.floct.redsvt.HWP2016_581_preferences.xml
- /data/data/####/qy_db_pay
- /data/data/####/qy_db_pay-journal
- /data/data/####/td_database_push
- /data/data/####/td_pefercen_profile.xml
- /data/data/####/tdandroidgame
- /data/data/####/tdid.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/unknown.xml
- /data/data/####/webview.db
- /data/data/####/webview.db-journal
- /data/data/####/yr900nzvkdykdaj9.dex
- /data/media/####/.tcookieid
- /data/media/####/91de44280c06425c8f92933f4f93c702
Miscellaneous:
Executes the following shell scripts:
- /system/bin/sh
- /system/bin/sh /system/bin/am startservice --user 0 -n <Package>/com.xx.a.e
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.xx.a.e
- cat /sys/block/mmcblk0/device/cid
- chmod 777 <Package Folder>/helper
- dd if=<Package Folder>/lib/libhelper.so of=<Package Folder>/helper
- ls -l /sbin/su
- ls -l /system/bin/su
- ls -l /system/sbin/su
- ls -l /system/xbin/su
- ls -l /vendor/bin/su
- sh
Loads the following dynamic libraries:
- cocos2dcpp
- libhelper
- libqygame
- libsmsmanagerhelper
- taegi7scagm8dawa
Uses the following algorithms to encrypt data:
- DES-ECB-NoPadding
Accesses the ITelephony private interface.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.
Parses information from SMS.
Gets information about sent/received SMS.
