Technical information
Malicious functions:
Sends SMS messages:
- 13023680732: ####A
- 12114516416: ####A
Network activity:
Connecting to:
- s####.####.com
- h####.####.com
- s####.####.cn
- r####.####.com
- y####.####.com
- b####.####.cn
- t####.####.cn
- st####.####.com
- m####.####.com
HTTP GET requests:
- m####.####.com/mlive-h5/static/images/room/icon-time2.png
- st####.####.com/group16/M00/83/61/tz0M9VIpeZsAAAAAAAA8TG-TSOw524.png
- t####.####.cn/mobile/g/img/uc/logo_4.3.8.png
- t####.####.cn/play?uc_param_str=####&ch=####&ch2=####&id=####&src_id=####&video_type=####&channel=####&title=####&play_url=####&play_mode=####&hls_url...
- st####.####.com/group16/M00/83/5F/tz0M9VIpeM4AAAAAAABWXTQPUjA633.png
- st####.####.com/group16/M00/83/61/tz0M9VIpecQAAAAAAABKqUxDWXg007.png
- st####.####.com/group16/M00/83/5F/tz0M9VIpeNkAAAAAAABRXhJzG9g469.png
- st####.####.com/group16/M00/0C/28/tz0M9VgA148AAAAAAAA0bmWXePw991.jpg
- s####.####.com/versioncheck.aspx?
- t####.####.cn/mobile/4.5.8/index.html?uc_param_str=####
- st####.####.com/group16/M00/9C/78/tz0M9VI-xFYAAAAAAAAxskhL85w449.png
- y####.####.com/j.gif?act=####&eventid=####&class1=####&class2=####&bak1=####&bak2=####&bak3=####&parm1=####&parm2=####&uid=####&time=####&ui=####&user...
- st####.####.com/group16/M00/83/5F/tz0M9VIpeMQAAAAAAAAvISsCyEw885.png
- t####.####.cn/mobile/??mobile/####&855####
- m####.####.com/mlive-h5/static/js/index/MliveStorage.js
- st####.####.com/group16/M00/2439/20170111_2053471224708.jpg
- r####.####.com/pay/auth/js/auth.js
- s####.####.com/getconfig.aspx?
- m####.####.com/mlive-h5/static/images/room/poster.jpg
- m####.####.com/mlive-h5/static/js/room/index.js?v=####
- s####.####.cn/GetFeeData.aspx?iswifi=####
- t####.####.cn/c/mobile/4.5.8/footer/img/footer-logo.png
- st####.####.com/group16/M00/83/5F/tz0M9VIpeKQAAAAAAABECA_afAc406.png
- st####.####.com/group16/M00/D5/AF/tz0M9VcY14IAAAAAAAA9UH-7OOQ419.png
- st####.####.com/group16/M00/83/60/tz0M9VIpeO8AAAAAAABg6CnsAqg504.png
- m####.####.com/mlive-h5/static/js/jquery/jquery.cookie.min.js
- m####.####.com/mlive-h5/static/images/room/icon-gift.png
- st####.####.com/group16/M00/81/A3/tz0M9VIoKDIAAAAAAAA-S2jvcok941.png
- m####.####.com/mlive-h5/static/images/room/45x45dp.png
- s####.####.cn/getconfig.aspx?
- st####.####.com/group16/M00/83/60/tz0M9VIpeVMAAAAAAAAzckBbhdQ541.png
- st####.####.com/group16/M00/83/60/tz0M9VIpeQwAAAAAAABJBHt1RDI990.png
- m####.####.com/mlive-h5/static/images/room/flow-light.png
- t####.####.cn/js/c.click.event.page-view.error.query.scroll.night.timespent.orientation.performance.send-uae-bench.js?t=####
- st####.####.com/group16/M00/01/8A/2jxiV1g54HoAAAAAAAA361S6MzY936.jpg
- st####.####.com/group16/M00/8B/9C/tz0M9VIwFk0AAAAAAABHOyP2XHs196.png
- m####.####.com/mlive-h5/static/js/commons/hiido.js
- st####.####.com/group16/M00/83/5F/tz0M9VIpeIIAAAAAAABP6XcEneQ214.png
- st####.####.com/group16/M00/0A/C9/tz0M9Vf8wpUAAAAAAAA45FSb1wY810.png
- t####.####.cn/mobile/4.5.8/main.js?19hup####
- m####.####.com/mlive-h5/static/js/jquery/jquery.url.min.js
- st####.####.com/group16/M00/83/60/tz0M9VIpeVoAAAAAAABIp2yCmQM600.png
- s####.####.cn/versioncheck.aspx?
- t####.####.cn/click?v=####&uuid=####&nv=####&br=####&brv=####&sid=####&cd=####&tz=####&rs=####&ht=####&app=####&appve=####&uc_param_str=####&ch=####&c...
- t####.####.cn/event?v=####&uuid=####&nv=####&br=####&brv=####&sid=####&cd=####&tz=####&rs=####&ht=####&app=####&appve=####&category=####&action=####&v...
- m####.####.com/mlive-h5/static/images/room/icon_hua.png
- st####.####.com/group16/M00/83/61/tz0M9VIpeY0AAAAAAABGWg6rHdY159.png
- m####.####.com/mlive-h5/static/js/jquery/jquery-2.1.4.min.js
- st####.####.com/group16/M00/B3/94/tz0M9VRq8i8AAAAAAAA89RHTdV4979.png
- st####.####.com/group16/M00/D1/D0/d7wtWVea8nUAAAAAAAA9n3J1ByY806.jpg
- st####.####.com/group16/M00/83/60/tz0M9VIpeQAAAAAAAABS6Ty1h-8985.png
- st####.####.com/group16/M00/161/20170112_1300495448731.png
- m####.####.com/mlive-h5/20933109/?agent=####
- m####.####.com/mlive-h5/static/images/room/icon-follow2.png
- st####.####.com/group16/M00/3421/20170113_1825109497183.jpg
- t####.####.cn/pageview?v=####&uuid=####&nv=####&br=####&brv=####&sid=####&cd=####&tz=####&rs=####&ht=####&app=####&appve=####&url=####&route=####&page...
- m####.####.com/mlive-h5/static/css/room/index.css?v=####
- st####.####.com/group16/M00/953/20170124_1608165356316.png
- m####.####.com/mlive-h5/static/js/room/room-subscribe.js
- h####.####.com/js/commons/webpcucount.js
- st####.####.com/group16/M00/E0/A9/tz0M9VdMK3sAAAAAAAAO8nz2Sec142.png
- st####.####.com/group16/M00/8E/FE/tz0M9VMwDekAAAAAAAA7E1vdejc853.png
- st####.####.com/group16/M00/83/60/tz0M9VIpeX4AAAAAAABDIBkBLeo620.png
- m####.####.com/mlive-h5/static/images/room/follow.png
- t####.####.cn/mobile/subject/detail/1.0.0?tag=####&callback=####
- st####.####.com/group16/M00/B3/94/tz0M9VRq8kwAAAAAAAA9-ipu9v0150.png
- t####.####.cn/mobile/??lazyimg####&855####
- st####.####.com/group16/M00/B3/94/tz0M9VRq8fIAAAAAAAA6uzCs8mY881.png
- t####.####.cn/event?v=####&uuid=####&nv=####&br=####&brv=####&sid=####&cd=####&tz=####&rs=####&ht=####&app=####&appve=####&category=####&action=####&l...
- st####.####.com/group16/M00/4107/20170119_2156425497759.jpg
- st####.####.com/group16/M00/A4/E9/tz0M9VZFxtkAAAAAAAAYVnvgQTA065.png
- m####.####.com/mlive-h5/static/images/room/contribution-title.png
- st####.####.com/group16/M00/83/61/tz0M9VIpeaMAAAAAAABAnwPwh6M378.png
- m####.####.com/mlive-h5/static/js/room/svc_tunnel.js?v=####
- s####.####.com/GetFeeData.aspx?iswifi=####
- b####.####.cn/c?uc_param_str=####&path=####&v=####&uuid=####&nv=####&br=####&brv=####&sid=####&cd=####&tz=####&rs=####&ht=####&app=####&appve=####&dns...
- st####.####.com/group16/M00/A9/89/tz0M9VZVgVQAAAAAAABhGHa0wDE601.png
- t####.####.cn/mobile/4.5.8/img/video-img-default.png
- t####.####.cn/c/mobile/4.5.8/video-multi-list/img/gray-arrow.png
- st####.####.com/group16/M00/81/A4/tz0M9VIoKFAAAAAAAABSqRIaSFc641.png
- m####.####.com/mlive-h5/54880976/?agent=####
- st####.####.com/group16/M00/832/20170112_1258272639000.png
- h####.####.com/hiido_internal.js
- m####.####.com/mlive-h5/static/js/room/room-viewhist.js
- y####.####.com/j.gif?act=####&ht=####&siteid=####&speid=####&ui=####&sc=####&cl=####&pcmb=####&os=####&bs=####&mb=####&se=####&wd=####&rfh=####&rf=###...
- m####.####.com/mlive-h5/static/js/room/room.js?v=####
- st####.####.com/group16/M00/83/61/tz0M9VIpeZQAAAAAAABPd1r8juA997.png
- t####.####.cn/mobile/??undersc####&855####
Modified file system:
Creates the following files:
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/shared_prefs/uw.xml
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/shared_prefs/ui.xml
- /data/data/####/cache/webviewCacheChromium/f_00001f
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/cache/webviewCacheChromium/f_00001e
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000021
- /data/data/####/cache/webviewCacheChromium/f_000020
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/shared_prefs/ui.xml.bak
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/uw.xml.bak
Miscellaneous:
Contains functionality to send SMS messages automatically.