Technical information
Malicious functions:
Sends SMS messages:
- 1069028900588: 3f0f9ce59a8cf595d296036e89993b97######MiLi2
Network activity:
Connecting to:
- 5####.####.com
- 1####.####.236
- o####.####.com
- p####.####.com:13579
- p####.####.com
- s####.####.cn
- d####.####.com
- videoa####.####.me
- w####.####.com
- a####.####.com
- p####.####.com:6680
- 1####.####.167:8090
- 1####.####.230
HTTP GET requests:
- d####.####.com/ml212.jar
- o####.####.com/5wan/tdl/images/zrx/nearby/1.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/7.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/2.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/10.jpg
- videoa####.####.me/tdl/res/video/20160216001.MP4
- o####.####.com/5wan/tdl/images/zrx/nearby/13.jpg
- o####.####.com/5wan/tdl/images/zrx/meetgame/9.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/18.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/9.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/8.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/20.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/15.jpg
- 5####.####.com/sdkplugin/smssdk_v17.txt
- o####.####.com/5wan/tdl/images/zrx/nearby/16.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/4.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/11.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/17.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/3.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/5.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/14.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/12.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/6.jpg
- o####.####.com/5wan/tdl/images/zrx/nearby/19.jpg
HTTP POST requests:
- 1####.####.236/sdk/cn/smsSdk.do
- s####.####.cn/bill/pay.do
- p####.####.com/SmsPayServer/sms/passge
- p####.####.com:13579/SMSpay/api/updateVersion.do?
- p####.####.com/SmsPayServer/sms/initMobile/initInfoNew
- w####.####.com/r/409537514/409538554/index.htm?cm=####
- p####.####.com/SmsPayServer/sms/receiveError/result?
- 1####.####.230/sdk/wpay/phonebill/tool.do
- s####.####.cn/serverIP.do
- p####.####.com/SmsPayServer/sms/Receive/ZhiFuReqCount
- 1####.####.167:8090/dataCenter/ad/adapp/adSwitch.do
- s####.####.cn/bill/re.do
- 1####.####.230/sdk/cn/rcmdapp.do
- s####.####.cn/cn/startLog.do
- a####.####.com/app_logs
- w####.####.com/r/398646362/398647350/index.htm?cm=####
- videoa####.####.me/res/api/res.do
- p####.####.com/SmsPayServer/sms/extra/getbrushpuv
- p####.####.com/SmsPayServer/sms/initMobile/province
- p####.####.com/paypalt_res/offline/sms.txt
- p####.####.com:6680/paypalt_res/offline/sms.txt
- s####.####.cn/cn/prefetch.do
Modified file system:
Creates the following files:
- /sdcard/imageloader/Cache/929703215
- /data/data/####/files/bx-sdk-libs/201/70.apk
- /sdcard/imageloader/Cache/923238568
- /sdcard/imageloader/Cache/1141852882
- /data/data/####/shared_prefs/plugin.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/ergw/DsWAH7HH4-WM6CZkSa5RgXCG2Nc=/F4QcGqYUmtjt7nid8zzSqX68EgU=
- /data/data/####/files/ergw/TzxVa9cImSXWY3-DX1e7lhQh2-o=
- /data/data/####/databases/milipay_sms_one.db-journal
- /data/data/####/files/ee.rr.ff.jar
- /data/data/####/files/ergw/VTcJhWmfUI6zvrYHQ0kO63_GpIHWtI2t/abeeVY-sxrT_5Jvt/lib/libttv2.so
- /sdcard/imageloader/Cache/1144623445
- /sdcard/imageloader/Cache/-709408496
- /sdcard/imageloader/Cache/930626736
- /sdcard/imageloader/Cache/926932652
- /data/data/####/files/ergw/Gj9FCFCVDMZEpfFyXo2emNlosUY=/data.dat.tmp
- /sdcard/imageloader/Cache/927856173
- /data/data/####/files/jarinfo.info
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/imageloader/Cache/928779694
- /data/data/####/files/.imprint
- /data/data/####/cache/info/ml206.jar
- /data/data/####/files/ergw/zImbgVVxT9gLotLoQo92Uf2GrgA=
- /data/data/####/files/ergw/VTcJhWmfUI6zvrYHQ0kO63_GpIHWtI2t/abeeVY-sxrT_5Jvt/QsWnXGzdepfnm7BtNHfpmg==
- /data/data/####/files/cache.info
- /sdcard/imageloader/Cache/924162089
- /data/data/####/files/goonpost.info
- /data/data/####/files/ergw/DsWAH7HH4-WM6CZkSa5RgXCG2Nc=/Q6SoI48vGt6E7NJX.zip
- /sdcard/imageloader/Cache/1139082319
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/wiipay.xml
- /data/data/####/databases/webview.db-journal
- /sdcard/imageloader/Cache/1145546966
- /data/data/####/files/ee.rr.ff.dex
- /sdcard/imageloader/Cache/951867719
- /data/data/####/files/bx-sdk-libs/smssdk/17.apk
- /sdcard/imageloader/Cache/1140929361
- /data/data/####/files/ergw/VTcJhWmfUI6zvrYHQ0kO63_GpIHWtI2t/abeeVY-sxrT_5Jvt/WTd5Qn1HTltbB0Vc.dex
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/imageloader/Cache/1138158798
- /data/data/####/files/payinfo.info
- /sdcard/imageloader/Cache/1143699924
- /sdcard/imageloader/Cache/1140005840
- /sdcard/imageloader/Cache/931550257
- /sdcard/imageloader/Cache/1142776403
- /data/data/####/files/ergw/VTcJhWmfUI6zvrYHQ0kO63_GpIHWtI2t/abeeVY-sxrT_5Jvt/WTd5Qn1HTltbB0Vc.zip
- /data/data/####/files/ergw/DsWAH7HH4-WM6CZkSa5RgXCG2Nc=/e77DEMA7B7Csg5vqZqZvHg==
- /sdcard/imageloader/Cache/926009131
- /sdcard/imageloader/Cache/925085610
- /data/data/####/shared_prefs/wpay-plugin.xml
Miscellaneous:
Executes next shell scripts:
- getprop apps.customerservice.device
Contains functionality to send SMS messages automatically.