Technical information
Malicious functions:
Sends SMS messages:
- 10690133603: auto##1593667233##mpl_zhushou##log in with 360
Network activity:
Connecting to:
- sh####.####.com
- 1####.####.231
- 1####.####.154
- ope####.####.cn
- p####.####.com
- s####.####.cn
- a####.####.cn
- p####.####.cn
- e####.####.cn
- pro####.####.cn
- m####.####.com
- r####.####.com
- m####.####.cn
HTTP GET requests:
- p####.####.com/dr/160_160_/t01e8a459e5fa994e0e.png
- p####.####.com/dr/160_160_/t01ddbe317c4b8c1721.png
- p####.####.com/dc/412_131_100_0_61/t018dd550ddf14016c2.png
- p####.####.com/dc/502_160_100_0_269/t01025e2b6eb10df18c.jpg
- m####.####.cn/article/fresh?videosupport=####&prepage=####&curpage=####&is_first=####&ts=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####...
- p####.####.com/dr/160_160_/t019415e178f77a148f.png
- ope####.####.cn/AppPrivMap/getPrivMap?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=###...
- ope####.####.cn/iservice/appJar?v=####&jvn=####&jvc=####
- p####.####.com/t01587cc94edac12f66.png
- p####.####.com/t011742d16ef298a9a6.png
- p####.####.com/t01fd6315e0ed6c48f0.png
- ope####.####.cn/toolsManger/list?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=####&re=...
- p####.####.com/dr/160_160_/t0197513adbf2a581d6.png
- p####.####.com/t01f570f167020c5813.png
- p####.####.com/t01791e605a8dff80c8.png
- p####.####.com/dc/655_424_100_15_24/t01ccfe03932a41187d.jpg
- p####.####.com/dr/160_160_/t019a55b8346a977fe8.png
- p####.####.com/t01a3551aceb4a806b1.png
- ope####.####.cn/Iservice/ServerConfig?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=###...
- ope####.####.cn/Cloud/getSoConf?name=####&so_ver=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=###...
- p####.####.com/dr/160_160_/t01b2b3eae4598c2ef4.png
- p####.####.com/dc/462_299_100_0_161/t01b087723f0645cad6.jpg
- p####.####.com/dr/160_160_/t010415e5a7e5b1c0fa.png
- p####.####.com/t01fd56c570283073d5.jpg
- p####.####.com/t01f06bfb4f39f8c5aa.png
- p####.####.com/t01d6e53443b95ac0f9.png
- p####.####.com/t01790898933da22113.jpg
- p####.####.com/dr/160_160_/t01bc2d3b199c5e3f61.png
- p####.####.com/dr/160_160_/t01a8fe30cb424d88ad.png
- p####.####.com/dr/160_160_/t01287a9606ad2bf368.png
- p####.####.com/dr/160_160_/t014f7bdf5b9f75d402.png
- ope####.####.cn/AppStore/getRecomendAppsBytype?type=####&withext=####&prepage=####&curpage=####&page=####&os=####&vc=####&v=####&md=####&sn=####&cpu=#...
- p####.####.com/t01d56a6f297bbc3bd5.jpg
- s####.####.cn/360baohe/c.html?para1=J####
- p####.####.com/t01427f9bce73c0f368.png
- p####.####.com/dc/462_299_100_0_151/t012646cd31f5e6fdae.jpg
- m####.####.cn/baohe/list?version=####&toid=####&pst=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=...
- p####.####.com/dr/160_160_/t01a0683d257d2f3a45.png
- p####.####.com/t01bed22d225a375da4.png
- m####.####.com/cfg/appkey-cf6b551afe338f43
- p####.####.com/t0108ddf5075c87e201.png
- ope####.####.cn/HuajiaoCtl/getZsSwitch?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=##...
- p####.####.com/t0180e9262f0b036868.png
- r####.####.com/360baohe/download.php?resurl=####&m=####&m2=####&nt=####&snt=####&ntt=####&sntt=####&isWifi=####&isData=####&isMeter=####&canUseDataNet...
- ope####.####.cn/weishi/bibei?src=####&withext=####&prepage=####&curpage=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&...
- 1####.####.154/index.html
- p####.####.com/t01b0ceb13f1b361fb3.png
- p####.####.com/t015a5cc8c8651e335a.png
- ope####.####.cn/Iservice/GetIndexHeader?iszip=####&logo_type=####&deflate_field=####&bannertype=####&apiversion=####&prepage=####&curpage=####&os=####...
- ope####.####.cn/html/data/save_uninstall.json
- p####.####.com/dr/160_160_/t016ad87ce6e5073c39.png
- p####.####.com/t01bb6912aca33f6f96.png
- a####.####.cn/intf.php?method=####&devtype=####&m1=####&m2=####&_t=####&model=####&sdkversioncode=####&sdkversionname=####&versioncode=####&versionnam...
- 1####.####.231/360baohe/c.html?para=Jm####
- p####.####.com/dr/160_160_/t01fed80e846c3cc937.png
- p####.####.com/t019f8ef4eda051d287.png
- ope####.####.cn/Iservice/FailOver?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=####&re...
- p####.####.com/t01deedb07307cf69af.png
- sh####.####.com/160812/198a24f34b6e80650ee011ac08cac3de/9471e1fbfd3b656d?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=#...
- p####.####.com/t01656c8b102705e16b.png
- ope####.####.cn/iservice/getAppDetail?s_stream_app=####&market_id=####&sort=####&pname=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&c...
- m####.####.cn/article/apprec/notice?article_id=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&...
- p####.####.com/t013bd1400ed98ed875.jpg
- p####.####.com/dr/160_160_/t01a3aa3836a423e3b7.png
- a####.####.cn/intf.php?method=####&model=####&sdkversioncode=####&sdkversionname=####&versioncode=####&versionname=####&appid=####&_token=####&apivers...
- p####.####.com/dr/160_160_/t01440a61fb803b2cf2.png
- p####.####.com/t01e89d596cefabd546.png
- s####.####.cn/appstore/info.htm?method=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCou...
- p####.####.com/dr/160_160_/t0178f4940163b7d350.png
- p####.####.com/dr/160_160_/t01205669e4c51910a5.png
- ope####.####.cn/AppStore/getIsUpdate?ext=####&pname=####&sr=####&mysrc=####&toid=####&sa=####&inma=####&launcher=####&isnle=####&issys=####&vid=####&p...
- p####.####.com/dr/160_160_/t01d7ba4f1b488506b9.png
- ope####.####.cn/iservice/pluginStatus?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCount=###...
- p####.####.com/dc/480_153_100_0_7/t01f08ad1586c6fc170.jpg
- p####.####.com/t0183f4984e54d5a8f1.png
- ope####.####.cn/AppStore/getHotWordsIconsOfSearch?pos=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&pp...
- p####.####.com/dr/160_160_/t017269344dd6357b76.png
- sh####.####.com/160812/198a24f34b6e80650ee011ac08cac3de/9471e1fbfd3b656d
- p####.####.com/t01174fbc06273e114a.png
- p####.####.com/dr/160_160_/t01777fb7d47bb1b6ef.png
- p####.####.com/dr/160_160_/t01bbf8ba43ec508004.png
- pro####.####.cn/profile/setting/getsetting?os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=####&startCoun...
- p####.####.com/t0157a44f5cc40b5a3f.png
- p####.####.com/t018c8cd65592b003f2.png
- p####.####.com/dr/160_160_/t018f8e95a01bcfb383.png
- p####.####.com/t0186ad3466a04954e1.jpg
- s####.####.cn/ak/3416a75f4cea9109507cacd8e2f2aefc.html?m2=####
- p####.####.com/dr/160_160_/t014094d746ad4b4ce1.png
- p####.####.com/t0149b7779fa31ca4e2.jpg
HTTP POST requests:
- ope####.####.cn/NecessaryInstalled/checkPop?appnum=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2=####&m=####&m2=####&ch=####&ppi=#...
- ope####.####.cn/mintf/getAppsByPackNames?src=####&&silent=####&plugver=####&callFrom=####&os=####&vc=####&v=####&md=####&sn=####&cpu=####&ca1=####&ca2...
- p####.####.cn/pstat/plog.php
- p####.####.cn/update/update.php?p=####
- e####.####.cn/b/pv?&st=####&m2=####&model=####&mid=####
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/crash.xml
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/36/4_BX2cRPvXBQbC7ZMEstkGjvhJ4.-374985041.tmp
- /data/data/####/shared_prefs/PermissionMap.xml
- /sdcard/360Log/downloadLog_delegate
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/15/6cRWvzRcpdIt-N_6wjPtIS8efLs.1525622716.tmp
- /data/data/####/databases/new_downloads.db
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/14/V-nBFsfDAVl8bNTJRfIMnAGXNTM.1892851818.tmp
- /data/data/####/code_cache/secondary-dexes/####-1.apk.classes1483538099.zip
- /data/data/####/files/uninstallRetainJson
- /data/data/####/shared_prefs/crash.xml.bak
- /sdcard/Android/data/####/cache/http/-21387179572080191382
- /data/data/####/shared_prefs/multidex.version.xml
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/76/ccvDovjDxhaDDrz-J6XQFaVKTwo.-991186069.tmp
- /sdcard/360Download/so_imagepipeline_1.apk.temp
- /data/data/####/files/dir_uninstallretain_pic/pic_5.png
- /data/data/####/files/dir_uninstallretain_pic/pic_6.png
- /data/data/####/files/screen/9FA6DC55A81065A78983A2BD18F721DC
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/10/eXVo1aAKNYrPBFj8niautDKBJI8.401079170.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/83/mPRu6VzIRUYELMqdxKK7INv2UwY.437221643.tmp
- /sdcard/Android/data/####/cache/http/-15674667242080191382
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/15/V0CJwfMNet-YHpz-Bqp4Y_wOX0E.-19289850.tmp
- /data/data/####/files/dir_uninstallretain_pic/pic_4.png
- /data/data/####/shared_prefs/share_data.xml
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/8/8ICJ7z-8L1sl97bA700V-wrTA8g.707534422.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/5/alXdl58m0569z0E0LP76plPzFIo.-163062273.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/5/_atNp2iiSLchgbva62rcrD9O81M.-1478969534.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/86/gS2MnckAXIVbzYiZKDbt8o_HVmg.242517420.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/14/FHLNy5xqCw-PQjiz3TQN0tmCFSE.-1934681809.tmp
- /data/data/####/localApkInfo.json
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/37/s1LoCJOW8iW_k5s_iJYPxAxu4uQ.823412380.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/16/VzM4iQwP_O-4EKapOVh65TcZQeg.404114826.tmp
- /data/data/####/files/libsucore.so
- /sdcard/360Log/downloadLog_statMan
- /data/data/####/files/libsuav_nopie.so
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/57/MCdPqmPsBfkWQldQ07AgQ9GU-gs.-633056406.tmp
- /data/data/####/shared_prefs/clear_shortcut.xml
- /data/data/####/databases/360appstoreInstallHistory.db
- /sdcard/360Log/downloadLog_main
- /data/data/####/shared_prefs/battery.xml
- /data/data/####/files/dir_uninstallretain_pic/pic_2.png
- /data/data/####/files/dir_uninstallretain_pic/pic_3.png
- /data/data/####/shared_prefs/game_redirect.xml
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/87/lSQK6ORsJR4O1Dih6TZnH7gOyng.1900495115.tmp
- /data/data/####/files/personal_center_setting_new
- /data/data/####/files/dir_uninstallretain_pic/pic_7.png
- /data/data/####/databases/ignoreupdate_appinfo.db
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/20/395XYemYrOzBkagbDX0jvYDc3cc.1828313466.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/16/eCaGXxJqgW_RD8i723I7G8r5cMA.-2106184609.tmp
- /data/data/####/files/dir_uninstallretain_pic/pic_8.png
- /sdcard/Android/data/####/cache/http/-830439275-1272045569
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/58/kYnCoB0n2EC1ksp1Pmugwb3b19U.-914982506.tmp
- /sdcard/360Download/so_imagepipeline_1.apk.temp!
- /data/data/####/files/dir_uninstallretain_pic/pic_9.png
- /data/data/####/shared_prefs/MATSharedPreferences.xml
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/20/w1MD6pNkaXXX5Rf7rNC-NrZV1f4.907233939.tmp
- /sdcard/temp.tmp~
- /data/data/####/downloadStat.json
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/11/POKebSY65fw2LmkBwdRp9wx6s7Q.-1597455248.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/54/sRj2owQTq923YBwgt-vZ4ilni6o.-1837223559.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/31/0RV5TOmI4bFfn4sg6FgXaDwcq-E.-621580525.tmp
- /sdcard/Android/data/.nomedia
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/89/8UdUOG5EOA0LYkGInnfXM-a3oUs.654392380.tmp
- /data/data/####/databases/filelist.db-journal
- /data/data/####/files/dir_uninstallretain_pic/pic_1.png
- /data/data/####/databases/update_history.db
- /sdcard/Android/data/####/cache/http/-8306136071896038127
- /data/data/####/databases/new_downloads.db-journal
- /data/data/####/databases/account.db-journal
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/37/igBVDSHSqE1DXBAHLx3eOieR38k.-633006271.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/34/CDQfDYnVsD_QrZxiz9j0iPUpqfE.1258085863.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/35/Rq9RFEP4fLrKRNiB83XvaMLzU5M.-534792806.tmp
- /data/data/####/databases/update_history.db-journal
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/45/VzMsbKDibzNwMEcjSj_eyqv0mLU.-651094805.tmp
- /data/data/####/shared_prefs/save_myself_config.xml
- /sdcard/Android/data/####/cache/.nomedia
- /sdcard/360Log/downloadLog_p2p
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/58/HLGPfohjmmNlu0AYwrvcXAzyCUE.1710344812.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/71/7lHsUZ5WpO_y0x7VMKMCoZI9ocM.-1582069975.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/28/url_LLZwjogaJLfKkJLi6Kbn8ws.572219951.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/79/yEjh1ML1-M4cb-y9ShFqItq81VI.387825410.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/74/apfMkPRGTFnZQe-uBPEus-ttJZ8.-179289765.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/41/xDjjqdTlbLHOBoH_42y_yymuvRQ.-1085675228.tmp
- /data/data/####/databases/download5.db-journal
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/21/xkX7W_yfK1O7Ci9NvnX-Asb9b2s.-793155602.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/81/IHVfgb1j9VIXWMs8VW8zPY6GwhY.-895091924.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/45/n3OvvWsThsLAgudUYHQugbrC_YA.257123338.tmp
- /data/data/####/shared_prefs/BaoHe_only_pref.xml.bak
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/95/El2yFH5MF3Y7VSdiuHck8toytzg.-2109611048.tmp
- /data/data/####/files/imagepipeline_1.so
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/21/na_5kKJz2Am0_BbA1XzZwzVBsFU.170357149.tmp
- /data/data/####/files/360/sdk/persistence/data/Y29tLnFpaG9vLmFwcHN0b3Jl
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/32/GKE06sgetJkg870KYQyjbd5cy-c.1680808841.tmp
- /data/data/####/files/rooter.jar
- /data/data/####/databases/articlelist.db-journal
- /data/data/####/databases/_ire-journal
- /data/data/####/shared_prefs/BaoHe_only_pref.xml
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/13/12sb2mXqq2Hg89pPbo_N45MaSSE.974357344.tmp
- /data/data/####/shared_prefs/PermissionMap.xml.bak
- /data/data/####/databases/account.db
- /data/data/####/files/temp.tmp~
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/38/qYZMlsfsQnmuhDQa8Lde0S5xX0E.2022679023.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/23/Tuyzecja9SkzSxhW5jERHk_ZVZE.-43833174.tmp
- /data/data/####/shared_prefs/share_data.xml.bak
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/53/eNjNseY8nOiS4XPBfx1tiPwQWzE.-1085263666.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/75/0CPhE8Y2v3MPrpiMJltRnkmHEdI.-591822305.tmp
- /data/data/####/files/pluginconfigcache
- /data/data/####/databases/360appstoreInstallHistory.db-journal
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/61/MZXmZl6pA_y6PhBxeyk0BhH3Kdo.2124856199.tmp
- /data/data/####/shared_prefs/MATSharedPreferences.xml.bak
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/54/z33hcTCempbSRv5bI3nMGRVpaXU.-1050969452.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/12/i47b8W_V4oqd5JsUN3elB71uAjc.-1659358227.tmp
- /sdcard/Android/data/####/cache/image/image_cache/v2.ols100.1/59/joP2k8Vf9qRU2RgPgfVL3bhgPL8.-515477757.tmp
- /data/data/####/databases/ignoreupdate_appinfo.db-journal
Sets the 'executable' attribute to the following files:
- /data/data/####/files/libsuav_nopie.so
Miscellaneous:
Executes next shell scripts:
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 111.13.66.125
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 182.118.31.142
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 182.118.31.99
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 106.120.160.207
- su
- /system/bin/ping -i 0.5 -s 56 -w 10 -c 10 221.130.199.208
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.