Technical information
Malicious functions:
Sends SMS messages:
- 106904006189121: myqxt####
- 10658000: CJTX
Executes code of the following detected threats:
- Android.Backdoor.285.origin
- Android.Triada.120
- Android.DownLoader.441.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.285.origin
Network activity:
Connecting to:
- pus####.####.net
- g####.####.info:7820
- t####.####.net
- d####.####.com:8083
- as####.####.com
- d####.####.com
- up####.####.info:6020
- d####.####.net
- g####.####.info
- t####.####.cn
- a####.####.com
- up####.####.info
HTTP GET requests:
- pus####.####.net/upfile/v1/2016-11-25174c3b4c-e4ae-4fe7-bd8a-f213b819c03e.jpg
- pus####.####.net/upfile/v1/2016-11-25d429be91-1899-4316-a8fc-0fa97d25afe2.jpg
- as####.####.com/uploads/advertisement/apk/1133/xt107QFX
- as####.####.com/uploads/advertisement/apk/980/1
- pus####.####.net/upfile/v1/2016-11-25027a14d8-634f-43e0-b64c-790fbc30ac53.jpg
- as####.####.com/uploads/advertisement/apk/981/0
- g####.####.info/?igtcmd=####&nativePayCmd=####
- pus####.####.net/upfile/v1/2016-11-251bcabccc-da50-496b-89ad-afa09e9c5643.jpg
- a####.####.com/api/v1/applications?api_key=####
- g####.####.info/?igtcmd=####&nativePayCmd=####&iccid=####&price=####&imsi=####&imei=####&gameid=####&payperiod=####&pointid=####
- pus####.####.net/upfile/v1/2016-11-250c5f7319-31ac-4e11-be1d-e3d2dfebbbf1.jpg
- g####.####.info/earth/video/needshow?platform=####
- g####.####.info/?igtcmd=####&nativePayCmd=####&iccid=####&price=####&imsi=####&imei=####&gameid=####&channel=####&payperiod=####&pointid=####
- g####.####.info/?zckjvideocmd=####&platform=####
- pus####.####.net/upfile/v1/2016-11-2526e97f59-d5ba-46eb-80ef-c5dd16c9f43b.jpg
- as####.####.com/uploads/advertisement/apk/1021/sese2344
- g####.####.info/?igtcmd=####&nativePayCmd=####&gameid=####&imsi=####&iccid=####
- g####.####.info:7820/?igtcmd=####
- pus####.####.net/upfile/v1/2016-11-25e2615351-ad9e-4ea9-94f3-3d7a325c0f92.jpg
- pus####.####.net/upfile/v1/2016-11-25fc4b0a00-af8e-4d47-bc9e-78fd445f2e89.jpg
- pus####.####.net/upfile/v1/2016-11-252b12a48d-2102-4876-bbc1-13efe5491b54.jpg
- pus####.####.net/upfile/v1/2016-11-2553af617f-933f-4bda-8ce4-116575bbaf76.jpg
- pus####.####.net/czfiles/payApk-release.apk
- g####.####.info/?igtcmd=####&iccid=####&imsi=####&imei=####&order=####&umeng=####&price=####&cpid=####&gameid=####&sdk=####&gamename=####&sdkpaypoint=...
- as####.####.com/uploads/advertisement/apk/1033/%E6%B5%B4%E5%AE%A4%E5%A5%B3%E7%A5%9E22
- g####.####.info/earth/enable?deviceid=####&version=####&imsi=####
- g####.####.info/?igtcmd=####&nativePayCmd=####&gameid=####&imsi=####
- pus####.####.net/upfile/v1/2016-11-25e4434d6a-467a-429b-b87c-632ddacfa9ff.jpg
- as####.####.com/uploads/advertisement/apk/982/16
- d####.####.net/update/plugin-release-v4.9.3.zip
- g####.####.info/?igtcmd=####&nativePayCmd=####&iccid=####&imsi=####&imei=####&sdk=####&price=####&payorder=####&umeng=####&msg=####&stepcode=####&cpid...
- pus####.####.net/upfile/v1/2016-11-2558b4a69e-29ed-45b3-8981-77b1e2d2f280.jpg
- pus####.####.net/upfile/v1/2016-11-25c861387d-b043-41db-9258-d9d16eb7b49c.jpg
- g####.####.info/?igtcmd=####&gameid=####
- pus####.####.net/upfile/v1/2016-11-2520a113b0-1ce9-4133-ab48-018b010417f2.jpg
- g####.####.info/?igtcmd=####&order=####&state=####&paymsg=####&fingerprint=####
- g####.####.info/?igtcmd=####&nativePayCmd=####&imsi=####
- g####.####.info/?zckjvideocmd=####&channelid=####&inmainview=####
HTTP POST requests:
- t####.####.cn/api/q/a/35313985d3b9ccc38ab579d35065afe66
- t####.####.net/g/d?crc=####
- up####.####.info/
- d####.####.com:8083/
- up####.####.info:6020/
- a####.####.com/app_logs
- d####.####.com/
Modified file system:
Creates the following files:
- /data/data/####/Plugin/com.fyfejk.lnmwwhw.ysys/dalvik-cache/base-1.dex
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/.config
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_252b12a48d_2102_4876_bbc1_13efe5491b54_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_251bcabccc_da50_496b_89ad_afa09e9c5643_jpg
- /data/data/####/app_downloads_all/16
- /data/data/####/shared_prefs/pref.xml
- /data/data/####/Plugin/cn.com.sexymovie6/apk/base-1.apk
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml
- /sdcard/iapppay/statistics/cn.com.sexymovie6/statistics.log
- /data/data/####/shared_prefs/TDCloudSettingsConfig0C7E1513D76E9F11B6452053987B4BDA.xml
- /data/data/####/databases/cc/cc.db
- /data/data/####/shared_prefs/TDpref_longtime.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/Plugin/com.fyfejk.lnmwwhw.ysys/lib/libdnlocal.so
- /data/data/####/app_downloads_all/xt107QFX
- /data/data/####/files/mpush_gateway_preferences_file
- /data/data/####/files/mpush_version_preferences_file
- /data/data/####/Plugin/cn.com.sexymovie6/dalvik-cache/base-1.dex
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25d429be91_1899_4316_a8fc_0fa97d25afe2_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25e4434d6a_467a_429b_b87c_632ddacfa9ff_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_2553af617f_933f_4bda_8ce4_116575bbaf76_jpg
- /data/data/####/shared_prefs/TDpref_shorttime.xml
- /data/data/####/files/tdlock.txt
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_250c5f7319_31ac_4e11_be1d_e3d2dfebbbf1_jpg
- /data/data/####/app_downloads_all/sese2344
- /data/data/####/shared_prefs/TDpref_longtime.xml.bak
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25027a14d8_634f_43e0_b64c_790fbc30ac53_jpg
- /data/data/####/databases/mpush_app.db-journal
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/zip/485d3abc-cbb6-4d9e-bd9b-e85a8dcc2dde.zip
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_2520a113b0_1ce9_4133_ab48_018b010417f2_jpg
- /data/data/####/shared_prefs/TDCloudSettingsConfig0C7E1513D76E9F11B6452053987B4BDA.xml.bak
- /sdcard/.tcookieid
- /data/data/####/app_payload_odex/A5jG35DLdlD_payload.apk
- /data/data/####/files/td.lock
- /sdcard/com.zckj.files/zcpf.apk_t
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25e2615351_ad9e_4ea9_94f3_3d7a325c0f92_jpg
- /data/data/####/files/mobclick_agent_cached_####281620002
- /data/data/####/Plugin/com.fyfejk.lnmwwhw.ysys/lib/tmp.Oz2115
- /data/data/####/files/TDtcagent.db
- /data/data/####/app_Plugins/com.fyfejk.lnmwwhw.ysys
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/Plugin/com.fyfejk.lnmwwhw.ysys/Signature/Signature_0.key
- /data/data/####/app_downloads_all/%E6%B5%B4%E5%AE%A4%E5%A5%B3%E7%A5%9E22
- /data/data/####/databases/cc/cc.db-journal
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_2558b4a69e_29ed_45b3_8981_77b1e2d2f280_jpg
- /data/data/####/app_downloads_all/1
- /data/data/####/app_downloads_all/0
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/shared_prefs/pref.xml.bak
- /data/data/####/files/TDtcagent.db-journal
- /data/data/####/Plugin/cn.com.sexymovie6/Signature/Signature_0.key
- /data/data/####/shared_prefs/TDpref_shorttime.xml.bak
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25174c3b4c_e4ae_4fe7_bd8a_f213b819c03e_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_2526e97f59_d5ba_46eb_80ef_c5dd16c9f43b_jpg
- /data/data/####/Plugin/cn.com.sexymovie6/lib/tmp.Bi2115
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25c861387d_b043_41db_9258_d9d16eb7b49c_jpg
- /sdcard/com.zckj.files/zcpf.apk
- /data/data/####/Plugin/com.fyfejk.lnmwwhw.ysys/apk/base-1.apk
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_11_25fc4b0a00_af8e_4d47_bc9e_78fd445f2e89_jpg
- /data/data/####/app_payload_odex/HNgc7C1kngl_payload.apk
Sets the 'executable' attribute to the following files:
- /data/data/####/Plugin/com.fyfejk.lnmwwhw.ysys/lib/libdnlocal.so
Miscellaneous:
Contains functionality to send SMS messages automatically.