Technical information
Malicious functions:
Sends SMS messages:
- 12114516412: systemcGx1dG8yNTAwMjY2OTkxODc3NDM=
Executes code of the following detected threats:
- Android.Triada.133
Downloads the following detected threats from the Web:
- Android.Triada.133
Network activity:
Connecting to:
- w####.####.com
- reso####.####.com
- tpb24iO####.####.cn
- 2####.####.134:8080
- 2####.####.111:8080
- p####.####.com
- 1####.####.45:10002
- 2####.####.112:8080
- c####.####.com
- 1####.####.219
- f####.####.com
- apm-col####.####.com
- 1####.####.com
- p####.####.cn
- ne####.####.com
- res####.####.com
- i####.####.cn
- c####.####.net
- m####.####.cn
HTTP GET requests:
- 1####.####.com/ic.asp
- ne####.####.com/wp-content/uploads/2016/07/zsq25.jpg
- ne####.####.com/wp-content/uploads/2016/07/zsq64.jpg
- w####.####.com/rdo/order?mcpid=####&orderNo=####&feeCode=####&reqTime=####&sign=####&cm=####&vt=####&key=####
- p####.####.com/handao_img/newsp/shikan_148.jpg
- i####.####.cn/iplookup/iplookup.php?format=####
- m####.####.cn/mtin.db.shcut.zip
- ne####.####.com/wp-content/uploads/2016/07/zsq77.jpg
- p####.####.com/json2/visitor1.php?pay_Id=####&package=####&appid=####
- ne####.####.com/wp-content/uploads/2016/07/zsq27.jpg
- w####.####.com/rdo/order/invalid;jsessionid=2B18FBA639C9379DD6778AFA3DD3B97F.8ngFvPKeA.1.0?rc=####&ln=####&orderNo=####&feeCode=####&sign=####&cm=####...
- w####.####.com/rdo/order/invalid;jsessionid=40638EC72AD63209421F602171562FE8.8ngFvPKeA.1.0?rc=####&ln=####&orderNo=####&feeCode=####&sign=####&cm=####...
- res####.####.com/v3/ip?output=####&key=####
- m####.####.cn/mtin.db.unacc_TH_2017011601.zip
- ne####.####.com/wp-content/uploads/2016/07/zsq8.jpg
- 1####.####.219/payConfig/sdkPriori.html
- ne####.####.com/wp-content/uploads/2016/07/zsq84.jpg
- ne####.####.com/wp-content/uploads/2016/07/zsq32.jpg
- ne####.####.com/wp-content/uploads/2016/08/zsq9.jpg
- p####.####.com/handao_img/newsp/shikan_107.jpg
- c####.####.com/20170317/tongyu-pay-lib-2144.apk
- m####.####.cn/mtin.db.mild.zip
- f####.####.com/p/16/05/17/p3_0878cc63f0da43f7035bbb0c1998c787.png_128X128.png
- m####.####.cn/mtin.db.meng.zip
- ne####.####.com/wp-content/uploads/2016/07/zsq76.jpg
- reso####.####.com/gslb/gslb/getbucket.asp
- p####.####.com/sdkMis/getRdoUrl
- p####.####.com/json2/stat.php?pay_Id=####&package=####&appid=####&v=####&channel=####&imei=####&md5=####&sj=####
- ne####.####.com/wp-content/uploads/2016/11/z102-300x424.jpg
- p####.####.com/handao_img/newsp/shikan_73.jpg
- ne####.####.com/wp-content/uploads/2016/07/zsq56.jpg
- ne####.####.com/wp-content/uploads/2016/11/z93-300x429.jpg
HTTP POST requests:
- p####.####.com/sdkMis/sdk-update
- 1####.####.45:10002/admgr/admgrsurvey.do
- tpb24iO####.####.cn/tmpay/initlist
- p####.####.com/sdkMis/mobile-submit
- p####.####.cn/index.php/API
- 2####.####.112:8080/mtin-traf/shcut/chks
- tpb24iO####.####.cn/tmpay/initv2
- tpb24iO####.####.cn/tmpay/newaccountv2
- apm-col####.####.com/cpi/crash
- 2####.####.134:8080/mtin/home
- p####.####.com/sdkMis/init-submit
- 2####.####.111:8080/mild/mg/packet
- c####.####.net/cat.php/Cat/SCR?ver=####&tp=####
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/gud.xml
- /data/data/####/databases/db_feeList
- /data/data/####/shared_prefs/TestinCrash.xml.bak
- /data/data/####/cache/picasso-cache/2d7aa59e6ef0fa04c5a028b3cdb6bc2c.1.tmp
- /data/data/####/databases/sms_db-journal
- /data/data/####/files/mj.apk
- /data/data/####/files/mtin.db.shcut.zip
- /data/data/####/cache/picasso-cache/88dbe8f32f0ed8f4ff7088c9fd547e95.0.tmp
- /data/data/####/databases/down.db-journal
- /data/data/####/databases/TestinAgent.db-journal
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/databases/cc/cc.db
- /sdcard/Download/jdapks/416d596b78466959457a344c726956397664556a6e513d3d.png
- /data/data/####/shared_prefs/cpMsg.xml
- /data/data/####/cache/picasso-cache/2faf3951d51b07994737856058b9c126.1.tmp
- /data/data/####/files/mtin.db.meng2.zip
- /data/data/####/app_tongyu/plugins/download/tongyu-pay-lib.apk
- /data/data/####/cache/picasso-cache/7fae80c92b02b3942c9ceeaab5e17725.1.tmp
- /data/data/####/shared_prefs/port.xml.bak
- /data/data/####/cache/picasso-cache/66a4db1cf34e9be4d807b2c16e077de2.1.tmp
- /data/data/####/cache/picasso-cache/119ea588e24825f3bda4e4ce825294ea.1.tmp
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/port.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/cache/picasso-cache/7fae80c92b02b3942c9ceeaab5e17725.0.tmp
- /data/data/####/cache/picasso-cache/2d7aa59e6ef0fa04c5a028b3cdb6bc2c.0.tmp
- /data/data/####/cache/picasso-cache/88dbe8f32f0ed8f4ff7088c9fd547e95.1.tmp
- /data/data/####/databases/TestinAgent.db
- /data/data/####/files/mtin.db.mild.zip
- /data/data/####/cache/picasso-cache/d2b0d9c7d2797ce07c562a77ae5b4d0b.0.tmp
- /data/data/####/shared_prefs/shellinit.xml
- /data/data/####/cache/picasso-cache/44c2339d41c701a8ee79a9a2f39d1146.1.tmp
- /data/data/####/shared_prefs/ui.xml
- /data/data/####/cache/picasso-cache/f6819cb2e4e54bc863a9ac0e21c8e095.1.tmp
- /data/data/####/cache/picasso-cache/d2b0d9c7d2797ce07c562a77ae5b4d0b.1.tmp
- /data/data/####/databases/sms_db
- /data/data/####/databases/down.db
- /data/data/####/cache/picasso-cache/201e22871ec878bf3605597fba7c870a.0.tmp
- /data/data/####/cache/picasso-cache/3ff7dd00eb2b901416dcf1a68a8b9109.1.tmp
- /data/data/####/cache/picasso-cache/2faf3951d51b07994737856058b9c126.0.tmp
- /data/data/####/shared_prefs/config.xml
- /data/data/####/cache/picasso-cache/9bd635c93d9aa4684afa8189a756e1cb.0.tmp
- /data/data/####/cache/picasso-cache/44c2339d41c701a8ee79a9a2f39d1146.0.tmp
- /data/data/####/cache/picasso-cache/201e22871ec878bf3605597fba7c870a.1.tmp
- /data/data/####/shared_prefs/getFlag.xml
- /data/data/####/app_tongyu/plugins/tongyu-pay-lib.apk
- /data/data/####/cache/picasso-cache/ab16a234b10f3cdb0147d5533a9642bb.0.tmp
- /data/data/####/cache/picasso-cache/da22fc218bd0922d0a6def99b9df3ec6.0.tmp
- /data/data/####/cache/picasso-cache/journal.tmp
- /data/data/####/databases/db_feeList-journal
- /data/data/####/shared_prefs/ui.xml.bak
- /data/data/####/cache/picasso-cache/f6819cb2e4e54bc863a9ac0e21c8e095.0.tmp
- /data/data/####/databases/mp.db
- /data/data/####/cache/picasso-cache/66a4db1cf34e9be4d807b2c16e077de2.0.tmp
- /data/data/####/files/mtin.db.unacc_TH_2017011601.zip
- /data/data/####/cache/picasso-cache/9bd635c93d9aa4684afa8189a756e1cb.1.tmp
- /data/data/####/cache/picasso-cache/119ea588e24825f3bda4e4ce825294ea.0.tmp
- /data/data/####/cache/picasso-cache/3b4993aef27d83572ac250feba5c4dd5.1.tmp
- /data/data/####/databases/mp.db-journal
- /data/data/####/shared_prefs/config.xml.bak
- /data/data/####/cache/picasso-cache/da22fc218bd0922d0a6def99b9df3ec6.1.tmp
- /data/data/####/shared_prefs/6695_527_48884_1576.xml
- /data/data/####/cache/picasso-cache/3b4993aef27d83572ac250feba5c4dd5.0.tmp
- /data/data/####/shared_prefs/TestinCrash.xml
- /data/data/####/cache/picasso-cache/3ff7dd00eb2b901416dcf1a68a8b9109.0.tmp
Miscellaneous:
Executes next shell scripts:
- getprop
- /system/bin/sh
- cat /sys/class/net/wlan0/address
Contains functionality to send SMS messages automatically.