Technical information
Malicious functions:
Sends SMS messages:
- 106904006189121: myqxt####
Executes code of the following detected threats:
- Android.SmsSpy.527.origin
- Android.SmsSend.16791
- Android.DownLoader.441.origin
- Android.SmsSend.11446
Downloads the following detected threats from the Web:
- Android.Backdoor.285.origin
Network activity:
Connecting to:
- pus####.####.cn
- pus####.####.net
- p####.####.com:7820
- do####.####.info:8010
- d####.####.net
- g####.####.info
- do####.####.info
- a####.####.com
HTTP GET requests:
- g####.####.info/?igtcmd=####&nativePayCmd=####
- pus####.####.cn/upfile/v1/2017-02-09143ccc4c-66da-4d20-bc3c-0e539c9b359d.jpg
- g####.####.info/?igtcmd=####
- pus####.####.cn/upfile/v1/2017-02-09a47568d5-0784-44a0-88dc-17f2a12a692a.jpg
- pus####.####.cn/upfile/v1/2017-02-09e2446f1d-cb44-481d-940c-77a9ce5c1323.jpg
- pus####.####.cn/upfile/v1/2017-02-10f0a86a4e-f300-48aa-ae2e-90994f193eff.jpg
- g####.####.info/?zckjvideocmd=####&platform=####
- pus####.####.cn/upfile/v1/2017-02-09fcc1cb82-f18c-4bf9-ac6b-2b167ddf82fe.jpg
- pus####.####.cn/czfiles/shangan-2017-51017-old5
- g####.####.info/earth/video/needshow2?channel=####
- pus####.####.cn/czfiles/mysdk1703091900
- g####.####.info/?igtcmd=####&nativePayCmd=####&iccid=####&price=####&imsi=####&imei=####&gameid=####&channel=####&payperiod=####&pointid=####
- g####.####.info/?igtcmd=####&nativePayCmd=####&gameid=####&imsi=####&iccid=####
- g####.####.info/?igtcmd=####&gameid=####
- p####.####.com:7820/?igtcmd=####&nativePayCmd=####&iccid=####&price=####&imsi=####&imei=####&gameid=####&payperiod=####&pointid=####
- pus####.####.cn/upfile/v1/2017-02-09f6ac751c-2fc2-4b2f-acf3-9fae3dbf83ff.jpg
- pus####.####.cn/czfiles/yingmei170220
- pus####.####.cn/upfile/v1/2017-02-1080430a48-f898-40d0-855e-b506e2f9ee8e.jpg
- pus####.####.net/czfiles/payApk-release.apk
- pus####.####.cn/upfile/v1/2017-02-10c8c472e9-ab9d-4e3b-9ef3-dc54a2e26853.jpg
- g####.####.info/earth/enable?deviceid=####&version=####&imsi=####
- g####.####.info/?igtcmd=####&nativePayCmd=####&gameid=####&imsi=####
- pus####.####.cn/upfile/v1/2017-02-0929c7de1a-d3a3-42c2-b237-046d5df8a7e7.jpg
- pus####.####.cn/upfile/v1/2017-02-094a88162d-bb7d-4928-a9bb-e6811ebf8035.jpg
- d####.####.net/update/plugin-release-v4.9.3.zip
- g####.####.info/?igtcmd=####&nativePayCmd=####&iccid=####&imsi=####&imei=####&sdk=####&price=####&payorder=####&umeng=####&msg=####&stepcode=####&cpid...
- pus####.####.cn/upfile/v1/2017-02-093e7ae36c-a608-4af6-a81c-1380ec3936f9.jpg
- pus####.####.cn/upfile/v1/2017-02-097779ce00-4452-4ea6-906b-7568253d6049.jpg
- pus####.####.cn/upfile/v1/2017-02-103bc32c26-5e94-48a9-9fa1-79e986a73358.jpg
- pus####.####.cn/upfile/v1/2017-02-091570b9d3-5442-4c51-89b2-ad4ceadf7165.jpg
- g####.####.info/?igtcmd=####&order=####&state=####&paymsg=####&fingerprint=####
- g####.####.info/?igtcmd=####&nativePayCmd=####&imsi=####
- g####.####.info/?zckjvideocmd=####&channelid=####&inmainview=####
HTTP POST requests:
- do####.####.info:8010/
- a####.####.com/app_logs
- do####.####.info/
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/.config
- /sdcard/com.zckj.files/net.tt.plugin.shangan
- /data/data/####/files/net.tt.plugin.mysdk.apk
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_09f6ac751c_2fc2_4b2f_acf3_9fae3dbf83ff_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_09a47568d5_0784_44a0_88dc_17f2a12a692a_jpg
- /data/data/####/shared_prefs/ShareFiles.xml
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_09143ccc4c_66da_4d20_bc3c_0e539c9b359d_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_093e7ae36c_a608_4af6_a81c_1380ec3936f9_jpg
- /data/data/####/cache/volley/-1856264845-976731837
- /data/data/####/Plugin/net.tt.plugin.yingmei/Signature/Signature_0.key
- /data/data/####/files/net.tt.plugin.shangan.apk
- /data/data/####/Plugin/net.tt.plugin.shangan/Signature/Signature_0.key
- /data/data/####/cache/volley/1036775397-1755473654
- /data/data/####/cache/volley/-920679137-1825201208
- /data/data/####/shared_prefs/userinfo_file.xml
- /data/data/####/Plugin/net.tt.plugin.shangan/dalvik-cache/base-1.dex
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_094a88162d_bb7d_4928_a9bb_e6811ebf8035_jpg
- /data/data/####/Plugin/net.tt.plugin.utadv/dalvik-cache/base-1.dex
- /data/data/####/files/mobclick_agent_cached_####
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_09fcc1cb82_f18c_4bf9_ac6b_2b167ddf82fe_jpg
- /data/data/####/files/net.tt.plugin.yingmei.apk
- /data/data/####/cache/volley/89194866051747312
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_091570b9d3_5442_4c51_89b2_ad4ceadf7165_jpg
- /data/data/####/Plugin/net.tt.plugin.mysdk/dalvik-cache/base-1.dex
- /data/data/####/cache/volley/368117834-410387428
- /data/data/####/Plugin/net.tt.plugin.yingmei/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.mysdk/apk/base-1.apk
- /data/data/####/cache/volley/-1958014815-1119654520
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/files/net.tt.plugin.myadv.apk
- /data/data/####/Plugin/net.tt.plugin.myadv/apk/base-1.apk
- /sdcard/com.zckj.files/zcpf.apk
- /data/data/####/shared_prefs/game_state_file.xml
- /sdcard/com.zckj.files/net.tt.plugin.mysdk
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_10c8c472e9_ab9d_4e3b_9ef3_dc54a2e26853_jpg
- /data/data/####/Plugin/net.tt.plugin.yingmei/dalvik-cache/base-1.dex
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_1080430a48_f898_40d0_855e_b506e2f9ee8e_jpg
- /data/data/####/cache/volley/-1990989554-762936486
- /data/data/####/files/net.ttpay.apkYingmei.apk
- /data/data/####/cache/volley/-1591133931269507520
- /data/data/####/databases/trinea_android_common.db-journal
- /data/data/####/cache/volley/-5385092791037151021
- /sdcard/com.zckj.files/zcpf.apk_t
- /data/data/####/Plugin/net.tt.plugin.mysdk/Signature/Signature_0.key
- /data/data/####/files/net.tt.plugin.utadv.apk
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
- /sdcard/com.zckj.files/net.tt.plugin.yingmei
- /data/data/####/Plugin/net.tt.plugin.myadv/dalvik-cache/base-1.dex
- /data/data/####/cache/volley/-1366703207-340804778
- /data/data/####/cache/volley/-1212491106-628482428
- /data/data/####/cache/volley/-18892569701457824087
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_10f0a86a4e_f300_48aa_ae2e_90994f193eff_jpg
- /data/data/####/files/net.tt.plugin.skypay.apk
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_0929c7de1a_d3a3_42c2_b237_046d5df8a7e7_jpg
- /data/data/####/Plugin/net.tt.plugin.utadv/apk/base-1.apk
- /data/data/####/shared_prefs/ShareFiles.xml.bak
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_09e2446f1d_cb44_481d_940c_77a9ce5c1323_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_097779ce00_4452_4ea6_906b_7568253d6049_jpg
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_103bc32c26_5e94_48a9_9fa1_79e986a73358_jpg
- /data/data/####/Plugin/net.tt.plugin.shangan/apk/base-1.apk
- /data/data/####/files/libcryptooperad.so
Miscellaneous:
Executes next shell scripts:
- dumpsys meminfo
- procrank
- cat /data/anr/traces.txt
Contains functionality to send SMS messages automatically.