Technical information
Malicious functions:
Sends SMS messages:
- 15595005292: i2mPNk1AOWWu6IO69LttHIXkg==
Executes code of the following detected threats:
- Android.Rooter.10
Network activity:
Connecting to:
- wea####.####.com
- s####.####.com
- ba####.####.com
- j####.####.com
- akama####.####.com
- 1####.####.111
- mmt####.####.net
- tove####.####.net
- ut####.cn
- r####.####.com
- 1####.####.111:8001
- pi####.####.com
- s####.####.com:36800
- ping####.####.com
- ut####.cn:8080
- edgecas####.####.com
- a####.####.com
HTTP GET requests:
- 1####.####.111/APP/AppTask.aspx
- r####.####.com/bookshelf/js/mig-report.min.js
- pi####.####.com/tcss.ping.js
- r####.####.com/weather/css/pic/weather/sunny.png?__sprit####
- wea####.####.com/
- r####.####.com/weather/css/pic/weather/cloudy.png?__sprit####
- ping####.####.com/pingd?dm=####&url=####&rdm=####&rurl=####&rarg=####&pv...
- r####.####.com/weather/js/weather.min.20170424001.js
- j####.####.com/cdn_dianjiliu.js?a=####
- 1####.####.111:8001/APP/AppTask.aspx
- edgecas####.####.com/39222_cf6ba13e3b630272ff33efd470fb8a98.gif.0s?a=###...
- j####.####.com/cdn_djl.js
- r####.####.com/weather/js/bj-report.js
- 1####.####.111/APP/GetFeePoint.aspx
- a####.####.com/scheme/rpluIn/eql_29.png
- r####.####.com/weather/css/weather.min.20170419001.css
- mmt####.####.net/mmtest2/gqvgoOjo88qsdWfPhXOwg2yRN0NpF8BF/0?a=####&b=####
- a####.####.com/scheme/rpluIn/ajsbv_43.png
- tove####.####.net/30KB_5163091ba87da4af80917c702a83de37.gif?a=####&b=####
- r####.####.com/bookshelf/js/mig-report-start.min.js
- ba####.####.com/badjs?id=####&uin=####&from=####&msg[0]=####&rowNum[0]=#...
- a####.####.com/scheme/rpluIn/rpluIn_24.png
- wea####.####.com/index?action=####
- j####.####.com/rpt.png?plf=####&cnt=####&r0=####&r1=####&r2=####&r3=####
- r####.####.com/weather/css/pic/weather/hr.png?__sprit####
- akama####.####.com/30KB_5163091ba87da4af80917c702a83de37.gif?a=####&b=####
- wea####.####.com/get?api=####
- r####.####.com/weather/font/QBNumber-Thin.ttf
HTTP POST requests:
- a####.####.com/app_logs
- s####.####.com/configsc.action
- s####.####.com/feedbacksc.action
- ut####.cn/excalibur/avalon/sdk/init.aspx
- ut####.cn/excalibur/avalon/sdk/pay.aspx
- s####.####.com:36800/configsc.action
- ut####.cn:8080/excalibur/avalon/sdk/init.aspx
Modified file system:
Creates the following files:
- /data/data/####/files/.mylib/ajsbv.zip
- /sdcard/Android/system/etc/.daepkgs
- /data/data/####/app_dex/utopay.jar
- /sdcard/Android/system/etc/.RID
- /sdcard/Android/system/etc/.daeitfc
- /data/data/####/databases/utopay.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/pluginLib.xml.bak
- /data/data/####/cache/.cache/1493270989170
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /sdcard/Android/system/etc/.CHID
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/.cache/1493270989981
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/.cache/1493270994189
- /data/data/####/cache/.cache/1493270994964
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/.r.jar
- /data/data/####/files/.mylib/qweus
- /data/data/####/cache/.cache/1493270987635
- /data/data/####/cache/.cache/1493270995754
- /data/data/####/cache/.cache/1493270992418
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/files/.imprint
- /data/data/####/shared_prefs/pluginLib.xml
- /data/data/####/cache/.cache/1493270990808
- /data/data/####/cache/.cache/1493270991621
- /data/data/####/files/.mylib/ajsbv.apk
- /sdcard/Android/system/etc/.imei
- /data/data/####/shared_prefs/mlib.xml
- /data/data/####/files/.e.download
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/files/.rpluin.download
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/.ajsbv.download
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/files/.mylib/rf
- /data/data/####/files/.mylib/ts
- /data/data/####/files/.mylib/rpluin.zip
- /data/data/####/cache/.cache/1493270993353
- /sdcard/Android/system/etc/.imsi
- /data/data/####/files/.mylib/cr.sh
- /data/data/####/cache/webviewCacheChromium/index
Sets the 'executable' attribute to the following files:
- /data/data/####/files/.mylib/ajsbv.apk
Miscellaneous:
Executes next shell scripts:
- getprop apps.customerservice.device
- su
Uses elevated priveleges.
Contains functionality to send SMS messages automatically.