Technical information
Malicious functions:
Sends SMS messages:
- 12114: dyl#####,####,6000091-1-214748-TAM1040-2
- 106575206321505460: dyl#####,####,6000091-1-214748-TAM1040-2
Executes code of the following detected threats:
- Android.SmsSend.1848.origin
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- huangda####.com
- p####.####.com:9000
- a####.####.site
- 1####.####.140:2536
- apm-col####.####.com
- p####.####.cc
- sdkup####.####.com
- 1####.####.222
HTTP GET requests:
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=####&type=####&system=####&simid=####&v=####&smsc=####&et=####&imsi=####&imei=...
- a####.####.site/getdata?cpid=####&packagename=####
- a####.####.site/phoneget?cpid=####&ismi=####&calltime=####&callcount=####&smscount=####&appname=####&sign=####
- huangda####.com/resource!chargeUpdate?resTypes=####&dexId=####&dexVer=####&appid=####&appVer=####&channel=####
- a####.####.site/afee?cpid=####&appfee_id=####&fee=####&smsc=####&imsi=####&p=####&appname=####&sign=####
- p####.####.com:9000/versionpatch?updVersion=####&crc32=####&version=####&imsi=####
- sdkup####.####.com/version/28/patch/astep_A_J_3.0.0_28.apk_27_patch.apk
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&simid=####&v=####&smsc=####&et=####&imsi=####&imei=####
- 1####.####.140:2536/pluginServ/plugin/query?model=####&osversion=####&gameID=####&channel=####&deviceId=####&version=####&sign=####
HTTP POST requests:
- huangda####.com/shop/shop_upload_log
- apm-col####.####.com/cpi/crash
- 1####.####.222/GoAPI
- p####.####.cc/index.php/API
Modified file system:
Creates the following files:
- /data/data/####/baea/tmb.jar
- /sdcard/.twservice/qshp_3001_2236.zip
- /data/data/####/shared_prefs/b_share.xml
- /data/data/####/shared_prefs/TestinCrash.xml.bak
- /data/data/####/shared_prefs/ma_data.xml
- /data/data/####/databases/PluginDB-journal
- /data/data/####/shared_prefs/ma_call.xml
- /sdcard/qin_yuanlang/plugin.apk_28
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/databases/cc/cc.db
- /data/data/####/shared_prefs/DATE.xml
- /data/data/####/shared_prefs/cpMsg.xml
- /data/data/####/databases/TestinAgent.db-journal
- /data/data/####/files/plugin.dex
- /data/data/####/shared_prefs/new_vvsion.xml
- /data/data/####/shared_prefs/nnt_data.xml
- /data/data/####/shared_prefs/shareyuanlangfirst.xml
- /data/data/####/shared_prefs/pretw.xml
- /data/data/####/shared_prefs/yunchao_sp.xml.bak
- /data/data/####/files/plugin.apk
- /data/data/####/shared_prefs/ma_epay_share.xml
- /data/data/####/shared_prefs/DownloadData.xml
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/databases/bil_db-journal
- /data/data/####/shared_prefs/ma_phone.xml
- /data/data/####/shared_prefs/twj.xml
- /data/data/####/shared_prefs/yunchao_sp.xml
- /data/data/####/files/cp_block_201.dat
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/twc.xml
- /data/data/####/shared_prefs/ma_data.xml.bak
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/LANG_SDK_PREF.xml
- /data/data/####/databases/TestinAgent.db
- /data/data/####/databases/MA_epay_db
- /sdcard/qin_yuanlang/plugin.apk_27_28
- /data/data/####/shared_prefs/edition.xml
- /data/data/####/databases/mp.db-journal
- /data/data/####/shared_prefs/b_setting.xml
- /sdcard/gooogle/userid.cfg
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/baea/entrance.jar
- /data/data/####/shared_prefs/twj.xml.bak
- /data/data/####/databases/mp.db
- /sdcard/.twservice/qshp_3001_2236/tw
- /data/data/####/shared_prefs/getFlag.xml
- /data/data/####/databases/bil_db
- /data/data/####/files/libyunsvc
- /data/data/####/databases/MA_epay_db-journal
- /data/data/####/shared_prefs/TestinCrash.xml
- /data/data/####/files/second_block_201.dat
Sets the 'executable' attribute to the following files:
- /data/data/####/files/libyunsvc
- /sdcard/gooogle/userid.cfg
Miscellaneous:
Executes next shell scripts:
- cat /sys/block/mmcblk0/device/cid
- sh
Contains functionality to send SMS messages automatically.