Technical information
Malicious functions:
Sends SMS messages:
- 12114000372329: 0#75frzt
- 12114000372329: i2mPNk1AOWWu6IO69LttHIXkg==
Network activity:
Connecting to:
- s####.####.com
- 1####.####.151:8080
- u####.####.com
- i####.####.net
- beijin####.####.com
- ut####.cn
- c####.####.net
- z####.####.com
- p####.####.com
- c####.####.com
- d####.####.com
- e####.####.com
- w####.####.com
- h####.####.com
- 1####.####.59
- 1####.####.59:8080
- j####.####.net
- m####.####.com
- ut####.cn:8080
- so####.com
HTTP GET requests:
- i####.####.net/images/b-3.png
- m####.####.com/data/share/2017/03/d7/250942d7855dcc74865b37_m.jpg
- m####.####.com/data/share/2017/03/1e/2021331e501a1b5fee9ec8_m.jpg
- m####.####.com/data/game/images/2016/08/57b26debe099f.jpg
- m####.####.com/index.php?m=####&a=####&id=####
- p####.####.com/qcdm?rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=###...
- p####.####.com/rczm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- j####.####.net/c.php?s=Jnpvb####&p=aj0wJ####&srccpv=####
- m####.####.com/data/share/2017/03/86/2508098611c9de3ad7f871_m.jpg
- m####.####.com/data/share/2017/03/54/2223425434129e4aea55ce_m.jpg
- m####.####.com/data/share/2017/03/74/241230744ccf14bda29498_m.jpg
- m####.####.com/cate-13.html
- p####.####.com/qcdm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- m####.####.com/data/share/2017/03/ef/211309ef8e1bd3ea96d4e1_m.jpg
- p####.####.com/octm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- c####.####.com/cpro/exp/closead/img/bg_rb.png
- m####.####.com/data/share/2016/11/1e/071709582044c59400b_m.jpg
- i####.####.net/a/2017-03-23/14902613544014.jpg
- p####.####.com/jcpm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- m####.####.com/static/css/mobile_v2/album.css?v=####
- m####.####.com/album/96559
- m####.####.com/data/avatar/1/1/f/159u1489200662_32.jpg
- m####.####.com/data/share/2017/03/0a/2217420a94eb60d59093b4_m.jpg
- m####.####.com/data/share/2016/11/28/160830582ba88d3ce64_m.jpg
- c####.####.com/gpixel?google_gid=####&google_cver=####
- m####.####.com/share-549463.html
- m####.####.com/data/share/2016/11/48/172021582da0c6c8fbf_m.jpg
- m####.####.com/data/share/2017/03/1d/1820361da1fecfe69cd8e9_m.jpg
- m####.####.com/data/item_cate/2015/12/56762e74d2dac.jpg
- p####.####.com/rczm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- m####.####.com/data/share/2017/03/95/25140095d8f88a3ac2f64c_m.jpg
- m####.####.com/static/js/jquery/swiper/swiper.min.css
- i####.####.net/a/2017-03-21/14900829748658.jpg
- m####.####.com/data/avatar/e/4/c/12co1467644563_64.jpg
- m####.####.com/static/js/mobile_v2/zepto.cookie.min.js
- m####.####.com/data/avatar/8/8/6/158c1488932221_32.jpg
- c####.####.net/v.js?kc/th9jQw5ouy+f3cimorQcxt/QQH2m74iEitoP94lo=####
- j####.####.net/stats.php?adsid=####&planid=####&uid=####&siteid=####&plantype=####&zoneid=####&adtplid=####&sep=####
- m####.####.com/data/share/2016/02/9b/10020856ba2b1f7aa82_m.jpg
- m####.####.com/static/css/mobile_v2/images/icon_small.png
- m####.####.com/data/item_cate/2017/01/586a075d454c2.jpg
- m####.####.com/data/item_cate/2015/12/56762f0dce540.jpg
- m####.####.com/data/share/2017/03/48/2422034824a21acaf8cf3d_m.jpg
- s####.####.com/style/css/bootstrap.min.css
- m####.####.com/static/images/app/xc-v2.jpg
- m####.####.com/data/avatar/a/4/1/14d31482727862_32.jpg
- m####.####.com/data/avatar/b/a/b/14no1484794261_32.jpg
- s####.####.com/style/images/logo.gif
- m####.####.com/data/gggo/1512/13/566d11b5cfb83.jpg
- m####.####.com/data/share/2017/03/f2/161921f2804c3be01c0c00_m.jpg
- s####.####.com/style/css/main.css
- m####.####.com/data/share/2016/07/71/171109578af6e390e79_m.jpg
- m####.####.com/data/share/2016/08/7e/28221557c2f1e9c9e8b_m.jpg
- m####.####.com/data/share/2017/03/21/1020002122e05a6b3702d6_m.jpg
- p####.####.com/ccpm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- m####.####.com/data/static/819be947638520e22761f489a5ff66e9.js?v=####
- m####.####.com/data/item_cate/2015/12/56762ea27182f.jpg
- m####.####.com/data/share/2016/11/e6/051033581d44f2bd347_m.jpg
- p####.####.com/jcpm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- p####.####.com/mccm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- m####.####.com/data/share/2016/11/f0/07175158204e88a880b_m.jpg
- m####.####.com/data/avatar/f/3/c/15911489106042_32.jpg
- m####.####.com/data/share/2017/03/3e/2118063ed03aac38c3f23b_m.jpg
- h####.####.com/hm.gif?bs=####&cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja=####&ln=####&lo=####<=####&nv=####&rnd=####&si=####&st=####&v=####&...
- m####.####.com/data/share/2016/11/63/162045582c54d157c63_m.jpg
- m####.####.com/data/share/2017/03/25/21204525078f1ca62c89f5_m.jpg
- m####.####.com/data/share/2017/03/80/2123368041a7c0f5e97554_m.jpg
- m####.####.com/data/share/2017/03/18/0922091807c18d27433e29_m.jpg
- u####.####.com/je3a1ecf96f2cdf531db0b7ddfeff332e641f7c4113aec7fe1103c.js
- beijin####.####.com/apks/load.bat
- m####.####.com/data/share/2017/03/48/0916574882ff1850f69472_m.jpg
- m####.####.com/data/share/2017/03/41/240836415eb8ce45976e08_m.jpg
- m####.####.com/static/images/mobile/icon_search.png
- m####.####.com/data/share/2016/11/50/162257582c73d2ec59d_m.jpg
- m####.####.com/cate-9.html
- m####.####.com/
- c####.####.com/sync.htm?cproid=####
- m####.####.com/data/share/2017/03/37/22194837a1f682aff3ab3f_m.jpg
- m####.####.com/data/item_cate/2015/12/56762f42ca045.jpg
- j####.####.net/vs.php?id=####
- m####.####.com/data/avatar/f/3/c/15911489106042_64.jpg
- m####.####.com/data/item_cate/2015/12/56762e8fd5781.jpg
- m####.####.com/data/avatar/c/b/5/155s1488250263_32.jpg
- z####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&showp=####&t=####&umuuid=####&h=####&rnd=####
- m####.####.com/static/js/mobile_v2/layer/layer.js?v=####
- c####.####.com/cpro/ui/noexpire/js/3.1.6/cpro.js
- m####.####.com/data/share/2017/03/c2/210833c2e661f55b0c09b2_m.jpg
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####
- m####.####.com/data/share/2017/02/47/26171847b83b74b301fe33_m.jpg
- m####.####.com/share-549439.html
- m####.####.com/static/css/mobile_v2/images/g_loading.gif
- p####.####.com/octm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- m####.####.com/data/share/2017/02/e7/282109e76e7280414c5a1f_m.jpg
- c####.####.com/cpro/ui/c.js
- i####.####.net/a/2017-03-20/14899986212167.jpg
- s####.####.com/core.php?web_id=####&t=####
- s####.####.com/z_stat.php?id=####&web_id=####
- m####.####.com/data/share/2017/02/d9/241330d95cb5f685bb678b_m.jpg
- m####.####.com/data/share/2017/03/01/251100014104113fbbb3e3_m.jpg
- p####.####.com/ccpm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- d####.####.com/libs/jquery/2.1.4/jquery.min.js
- m####.####.com/data/share/2017/03/da/250939da112ad07ebc9584_m.jpg
- m####.####.com/static/images/mobile/icon_back.png
- m####.####.com/data/share/2017/03/9a/2018129aa91a9115ca9edb_m.jpg
- m####.####.com/data/share/2017/03/42/0616214215e3d26096214a_m.jpg
- m####.####.com/data/avatar/0/3/5/158n1489030441_32.jpg
- m####.####.com/data/share/2017/03/f7/241606f70424fd941b5569_m.jpg
- c####.####.com/9.gif?abc=####&rnd=####
- m####.####.com/data/avatar/e/4/c/12co1467644563_32.jpg
- c####.####.com/cpro/ui/cm.js
- i####.####.net//images/close.png
- m####.####.com/data/share/2017/03/a3/232027a36fc7d6edbb1e45_m.jpg
- m####.####.com/data/share/2017/03/74/21164874bcdee767b5923a_m.jpg
- m####.####.com/data/share/2017/03/a1/241412a18d0cc0f5ca11fa_m.jpg
- m####.####.com/static/js/jquery/swiper/swiper.jquery.min.js
- m####.####.com/data/share/2016/11/f3/181600582eb518d3b69_m.jpg
- m####.####.com/data/share/2017/03/2b/2320242b5606b645a7d9f7_m.jpg
- m####.####.com/data/share/2017/03/c9/250845c9af9561b28b886b_m.jpg
- i####.####.net/a/2017-03-20/14899986612791.jpg
- m####.####.com/data/avatar/1/e/7/14sm1486083602_32.jpg
- m####.####.com/data/share/2017/03/65/2114126576cd6b0555439e_m.jpg
- m####.####.com/data/avatar/c/3/6/14hr1483662841_32.jpg
- m####.####.com/data/share/2017/03/94/1707279413aa4b39956576_m.jpg
- m####.####.com/data/share/2016/11/49/182039582ef668d8f2b_m.jpg
- m####.####.com/static/js/mobile_v2/layer/need/layer.css
- s####.####.com/s.htm?cproid=####&t=####
- j####.####.net/v.php?siteid=####&id=####&p=####&l=####
- j####.####.net/c.php?s=Jnpvb####&p=####&srccpv=####
- m####.####.com/data/share/2017/03/08/23132408a3c485465613a6_m.jpg
- m####.####.com/static/js/mobile_v2/zepto.min.1.1.6.js
- m####.####.com/data/share/2017/03/31/14124831377279879a93e6_m.jpg
- m####.####.com/data/avatar/5/c/9/13sn1478822403_32.jpg
- m####.####.com/data/avatar/5/5/b/13v21479439021_32.jpg
- e####.####.com/hmt/icon/21.gif
- c####.####.com/cpro/ui/noexpire/js/4.0.0/adClosefeedbackUpgrade.min.js
- m####.####.com/data/share/2017/03/90/051157906c6a572f8c448a_m.jpg
- m####.####.com/cate-23.html
- p####.####.com/sync_pos.htm?cproid=####&t=####
- so####.com/mobile
- m####.####.com/data/share/2016/12/3d/011209583fa277efa4b_m.jpg
- m####.####.com/static/css/mobile_v2/item.css?v=####
- p####.####.com/tccm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- m####.####.com/gggo/tgo/id/90
- m####.####.com/data/share/2017/03/47/12074547d7ef0d03775101_m.jpg
- m####.####.com/data/share/2016/10/bb/16180358035072301de_m.jpg
- h####.####.com/hm.gif?bs=####&cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####<=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&...
- m####.####.com/data/gggo/1512/13/566d11cfbf947.jpg
- p####.####.com/tccm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- c####.####.net/pixel?google_nid=####&google_cm=####&google_tc=####
- c####.####.com/cpro/expire/time2.js
- m####.####.com/data/avatar/0/3/0/15h61490057461_32.jpg
- m####.####.com/data/item_cate/2015/12/56762ec925fb4.jpg
- c####.####.net/pixel?google_nid=####&googl####
- m####.####.com/data/share/2017/03/11/231030119b10c2607e1156_m.jpg
- m####.####.com/data/share/2017/03/ca/241945ca284ed668fc5978_m.jpg
- m####.####.com/static/images/mobile/icon_home.png
- m####.####.com/data/avatar/5/1/2/14p41485130622_32.jpg
- h####.####.com/h.js?0474b4d####
- m####.####.com/static/css/mobile_v2/images/small_icon.png
- m####.####.com/data/share/2016/10/e5/1513515801c3db33bea_m.jpg
- m####.####.com/data/avatar/8/d/b/157j1488763023_32.jpg
- m####.####.com/data/avatar/7/6/0/15761488673021_32.jpg
- m####.####.com/static/css/mobile_v2/base.css?v=####
- m####.####.com/static/js/mobile_v2/album.js
- m####.####.com/data/share/2017/03/55/07144255f2299aff8151fa_m.jpg
- m####.####.com/data/share/2017/03/82/1123158227f360fdc5e2ab_m.jpg
- m####.####.com/data/share/2017/03/75/21200675120644abd119fd_m.jpg
- m####.####.com/album/96336
- i####.####.net/a/2017-03-24/14903398452479.jpg
- m####.####.com/static/images/mobile/user_face.png
- m####.####.com/data/share/2017/03/16/17091816679c62953728db_m.jpg
- c####.####.com/cpro/ui/noexpire/img/4.0.0/pc_ads_bear.1x.png
- m####.####.com/data/share/2017/03/2e/1716062ec77f528d5c803c_m.jpg
- c####.####.com/cpro/ui/noexpire/img/4.0.0/pc_ads.1x.png
- p####.####.com/sync_pos.htm?cproid=####
- m####.####.com/data/share/2016/08/c6/15132157b15140623d7_m.jpg
- h####.####.com/hm.gif?bs=####&cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####&tt=####
- m####.####.com/data/avatar/c/b/7/13hg1476406801_32.jpg
- m####.####.com/data/avatar/3/8/6/14u11486301266_32.jpg
- m####.####.com/data/share/2017/03/21/1618182142eee69eeda9bc_m.jpg
- c####.####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja=####&ln=####&lo=####&nv=####&rnd=####&si=####&st=####&v=####&lv=####
- w####.####.com/adx.php?c=####
- m####.####.com/data/share/2017/03/05/23083005812315ef702101_m.jpg
- j####.####.net/v.php?siteid=####&id=####&p=aj0wJ####&l=####
- c####.####.com/cpro/ui/uijs.php?en=####&c=####&fv=####&itm=####&kdi0=####&kdi1=####&kdi2=####&kdi3=####&kdi4=####&kdi5=####&lukid=####&mscf=####&n=###...
- c####.####.com/cpro/exp/closead/img/bd_logo.png
- m####.####.com/data/static/9157c7b36ac464a0fab8b0dbbfe17a60.js?v=####
- m####.####.com/data/avatar/4/1/c/15921489107602_32.jpg
- m####.####.com/data/avatar/3/6/4/154p1487983862_32.jpg
- m####.####.com/data/share/2017/03/2b/2320242b5606b645a7d9f7.jpg
- m####.####.com/static/css/mobile_v2/style_v2.css?v=####
- h####.####.com/hm.js?97e30f1####
- m####.####.com/data/share/2017/03/e5/241348e5e9a53e9d232080_m.jpg
- m####.####.com/data/share/2017/03/ca/251227caa10bef326d4c98_m.jpg
- u####.####.com/2e4d96dca598a574d213.js
- i####.####.net/images/b-1.png
- m####.####.com/data/avatar/f/6/d/150l1486864803_32.jpg
- m####.####.com/static/css/mobile_v2/images/logo_new.png
- d####.####.com/js/dm.js
- p####.####.com/mccm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- m####.####.com/data/share/2017/03/e2/241509e29ba335a145a7a3_m.jpg
- m####.####.com/data/share/2017/03/a6/212324a64affce68db5929_m.jpg
- m####.####.com/data/share/2016/11/47/141036582923158b324_m.jpg
- m####.####.com/static/images/mobile/icon_menu.png
- m####.####.com/data/share/2017/03/f1/011409f1a2c6ed35e8a34c_m.jpg
- i####.####.net//images/b-1.png
- m####.####.com/data/avatar/1/2/a/151o1487210402_32.jpg
- m####.####.com/data/avatar/2/3/7/156n1488506401_32.jpg
HTTP POST requests:
- so####.com/mobiles
- ut####.cn/excalibur/avalon/sdk/queryResult.aspx
- 1####.####.59/BusiService/@intf@/i0001
- 1####.####.59:8080/BusiService/@intf@/i2001
- 1####.####.59/BusiService/@intf@/i0003
- 1####.####.151:8080/astrolinkSDK/info/getUpUrlInfo
- ut####.cn/excalibur/avalon/sdk/pay.aspx
- ut####.cn:8080/excalibur/avalon/sdk/init.aspx
Modified file system:
Creates the following files:
- /data/data/####/app_dex/utopay.jar
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/app_dex/utopay_icon.gif
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/shared_prefs/setting.xml
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_3
- /sdcard/Download/AST_DOWN/load.bat
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000015
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/databases/utopay.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/webviewCacheChromium/f_000017
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/databases/d_aosd56dg
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/shared_prefs/sp_haoapp.xml
- /data/data/####/app_dex/utopay_close.png
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/databases/d_aosd56dg-journal
Miscellaneous:
Executes next shell scripts:
- getprop apps.customerservice.device
Contains functionality to send SMS messages automatically.