Technical information
Malicious functions:
Sends SMS messages:
- 15595005292: i2mPNk1AOWWu6IO69LttHIXkg==
Network activity:
Connecting to:
- s####.####.com
- t####.####.com
- ut####.cn
- qiushib####.com
- 1####.####.111
- qb-m####.####.com
- p####.####.com
- c####.####.com
- be####.####.com
- w####.####.com
- z####.####.com
- s####.####.com:36800
- st####.####.com
- ut####.cn:8080
- a####.####.com
HTTP GET requests:
- st####.####.com/images/newarticle/like@1.5.png?v=####
- p####.####.com/system/pictures/9718/97182620/small/97182620.jpg?imageVi#...
- p####.####.com/system/avtnew/3303/33039105/thumb/2016121117103310.JPEG?i...
- p####.####.com/system/avtnew/2300/23001279/thumb/20141123015506.jpg?imag...
- be####.####.com/sr7e50c7dcf6cefe3a904b23dcf3ab67bf05.js
- c####.####.com/cpro/ui/uijs.php?en=####&c=####&fv=####&itm=####&kdi0=###...
- be####.####.com/2e4d96dca598a574c51b.js
- p####.####.com/system/avtnew/1052/10521377/thumb/20170316204507.JPEG?ima...
- p####.####.com/system/avtnew/208/2087591/thumb/2016072900563047.JPEG?ima...
- p####.####.com/system/avtnew/1245/12458785/thumb/20170119092805.JPEG?ima...
- a####.####.com/scheme/plan/ajsbv_1_32.png
- qiushib####.com/article/118461654
- t####.####.com/it/u=2594222363,3786436383&fm=76
- p####.####.com/system/avtnew/3162/31625780/thumb/20170326215352.JPEG?ima...
- p####.####.com/system/avtnew/3036/30364423/thumb/20150929171101.jpg?imag...
- t####.####.com/it/u=459735947,3342984475&fm=76
- p####.####.com/system/avtnew/1245/12458785/medium/20170119092805.JPEG
- p####.####.com/system/avtnew/2236/22364591/thumb/20170219010144.JPEG?ima...
- p####.####.com/system/avtnew/491/4916440/thumb/20141130145752.jpg?imageV...
- p####.####.com/system/avtnew/2537/25374662/thumb/20150304130220.jpg?imag...
- p####.####.com/system/avtnew/3337/33374237/thumb/2017020320134973.JPEG?i...
- p####.####.com/system/avtnew/2284/22845153/thumb/20170227133339.JPEG?ima...
- st####.####.com/images/newarticle/sad@1.5x.png
- p####.####.com/system/avtnew/214/2149125/thumb/20170308005526.JPEG?image...
- p####.####.com/system/pictures/9664/96647152/small/96647152.jpg?imageVi#...
- p####.####.com/system/avtnew/3123/31232304/thumb/20160410154255.jpg?imag...
- p####.####.com/system/avtnew/3020/30201529/thumb/20170118120709.JPEG?ima...
- p####.####.com/system/avtnew/2135/21353387/thumb/20150512200759.jpg
- t####.####.com/it/u=4228703483,1343260474&fm=76
- p####.####.com/system/avtnew/3215/32150919/thumb/20160710142700.jpg?imag...
- p####.####.com/system/avtnew/3030/30308766/thumb/2017040911495122.JPEG?i...
- p####.####.com/system/avtnew/3121/31215283/thumb/20170118191731.JPEG?ima...
- p####.####.com/system/avtnew/2679/26795512/thumb/20150320162309.jpg?imag...
- p####.####.com/system/avtnew/2419/24192866/thumb/20170128213715.JPEG?ima...
- p####.####.com/system/avtnew/3292/32923626/thumb/20170407212001.JPEG?ima...
- p####.####.com/system/avtnew/1570/15705493/thumb/20160209002027.jpg?imag...
- t####.####.com/it/u=3745356884,3826646265&fm=76
- p####.####.com/system/avtnew/3093/30936366/thumb/20170305174852.JPEG?ima...
- p####.####.com/system/avtnew/2258/22584397/thumb/20150712112239.jpg?imag...
- qb-m####.####.com/watermark/38d3a5eb68c8f7e81a5d22a61434a77b.gif!/gifto/...
- p####.####.com/system/pictures/11894/118944233/medium/app118944233.jpg
- p####.####.com/system/avtnew/2553/25535176/thumb/2016102615090923.JPEG?i...
- a####.####.com/scheme/plan/2161_1.png
- p####.####.com/system/avtnew/2430/24302109/thumb/20151008124610.jpg
- p####.####.com/system/avtnew/3127/31276309/thumb/20160224232500.jpg?imag...
- qiushib####.com/article/118488435
- p####.####.com/system/avtnew/2338/23382013/thumb/20141202201615.jpg?imag...
- qb-m####.####.com/watermark/49eb6f07dd9205d1c03d740678c86d80.gif!/gifto/...
- p####.####.com/system/avtnew/3246/32468919/thumb/2016081923580821.JPEG?i...
- p####.####.com/system/avtnew/3027/30272916/thumb/20150912205651.jpg?imag...
- p####.####.com/system/avtnew/3203/32035366/thumb/2017030722043226.JPEG?i...
- p####.####.com/system/avtnew/3297/32978189/thumb/2017022812460130.JPEG?i...
- p####.####.com/lcvm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- p####.####.com/scnm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- p####.####.com/system/avtnew/2151/21510897/thumb/20170409145503.JPEG?ima...
- t####.####.com/it/u=1128884778,1550179970&fm=76
- p####.####.com/system/avtnew/3270/32709559/thumb/2016092715343147.JPEG?i...
- p####.####.com/system/avtnew/2847/28479576/thumb/20170221034920.JPEG?ima...
- p####.####.com/system/avtnew/2378/23780323/thumb/20170307225726.JPEG?ima...
- p####.####.com/system/avtnew/2074/20748935/thumb/20141205141843.jpg?imag...
- p####.####.com/system/avtnew/2726/27269882/thumb/20150404061034.jpg?imag...
- c####.####.com/cpro/ui/pr.js
- p####.####.com/system/avtnew/3199/31995506/thumb/2016072815033461.JPEG?i...
- p####.####.com/system/avtnew/2759/27598976/thumb/20170427110222.JPEG?ima...
- p####.####.com/system/avtnew/3237/32373259/thumb/20170325090938.JPEG?ima...
- p####.####.com/system/avtnew/3354/33544697/thumb/20170316101555.JPEG?ima...
- p####.####.com/system/avtnew/1331/13313249/thumb/20170419221221.JPEG?ima...
- p####.####.com/system/avtnew/1418/14185679/thumb/2016110811332296.JPEG?i...
- p####.####.com/system/avtnew/3347/33476214/thumb/2017022820191493.JPEG?i...
- p####.####.com/system/avtnew/2889/28892064/thumb/20160515063856.jpg?imag...
- p####.####.com/system/avtnew/3266/32668967/thumb/2016092015485631.JPEG?i...
- p####.####.com/system/avtnew/3088/30880816/thumb/20170423125013.JPEG?ima...
- p####.####.com/system/avtnew/3278/32787751/thumb/2016101110145490.JPEG?i...
- p####.####.com/system/pictures/9679/96792372/small/96792372.jpg?imageVi#...
- t####.####.com/it/u=768552591,105153846&fm=76
- p####.####.com/system/avtnew/3356/33565703/thumb/2017032120404083.JPEG?i...
- p####.####.com/system/avtnew/3337/33371366/thumb/2017020301510490.JPEG?i...
- p####.####.com/system/avtnew/425/4257342/thumb/20160211221836.jpg?imageV...
- p####.####.com/system/avtnew/1692/16924681/thumb/20160606170224.jpg?imag...
- p####.####.com/system/avtnew/798/7987451/thumb/20140324125213.jpg?imageV...
- p####.####.com/system/avtnew/3316/33164329/thumb/2016122312133185.JPEG?i...
- p####.####.com/system/avtnew/1052/10520251/thumb/20150112071043.jpg?imag...
- p####.####.com/system/avtnew/2708/27081690/thumb/20170228224758.JPEG?ima...
- st####.####.com/images/touch/logo-new-0410.png?v=####
- p####.####.com/system/avtnew/3336/33363284/thumb/201702010834510.JPEG?im...
- p####.####.com/system/avtnew/3101/31011712/thumb/20170406201020.JPEG?ima...
- p####.####.com/system/avtnew/1195/11952437/thumb/20170128173936.JPEG
- st####.####.com/js/src/touch/lingxi.js?v=####
- p####.####.com/system/avtnew/3282/32825266/thumb/2016101721251497.JPEG?i...
- p####.####.com/system/avtnew/1053/10535643/thumb/20130914154515.jpg?imag...
- st####.####.com/images/newarticle/share@1.5x.png
- p####.####.com/system/avtnew/1358/13589626/thumb/20170119142739.JPEG?ima...
- qiushib####.com/article/118943428
- p####.####.com/mcrm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- p####.####.com/system/avtnew/3225/32258101/thumb/20160723234156.jpg?imag...
- p####.####.com/system/avtnew/2590/25906232/thumb/20150517195412.jpg
- z####.####.com/ztd/w%3D350%3Bq%3D70/sign=08162951db09b3deebbfe26dfc841db...
- t####.####.com/it/u=584891519,3963673759&fm=76
- st####.####.com/images/newarticle/nearby_gender_female@1.5x.png
- st####.####.com/images/qiushi/qiushi_iphone.png?v=####
- p####.####.com/system/avtnew/366/3660005/thumb/20160611211948.jpg?imageV...
- p####.####.com/system/avtnew/3316/33161595/thumb/20161225144834.JPEG?ima...
- qiushib####.com/joke/30480/
- p####.####.com/system/avtnew/1254/12546631/thumb/20170222221259.JPEG?ima...
- p####.####.com/system/avtnew/2415/24150588/thumb/20160303222023.jpg
- st####.####.com/js/dist/touch/app.min.js?v=####
- t####.####.com/it/u=1921708306,2262411094&fm=76
- p####.####.com/system/avtnew/1820/18201253/thumb/20170310122536.JPEG?ima...
- t####.####.com/it/u=3275721138,4104319741&fm=76
- p####.####.com/system/avtnew/3153/31532741/thumb/20170120035234.JPEG?ima...
- be####.####.com/bp3a1ecf91fecef63ddb1c7582affa32f71bf3d41128ea38e01e382f...
- t####.####.com/it/u=2989469359,3839367458&fm=76
- p####.####.com/system/avtnew/2040/20406325/thumb/20160722203458.jpg?imag...
- p####.####.com/system/pictures/9679/96792742/small/96792742.jpg?imageVi#...
- p####.####.com/system/avtnew/2713/27138604/thumb/2016082023385261.JPEG?i...
- p####.####.com/system/avtnew/3138/31385969/thumb/2017030616450677.JPEG?i...
- p####.####.com/system/avtnew/3015/30159881/thumb/20151114205700.jpg?imag...
- t####.####.com/it/u=392036210,3112544238&fm=76
- p####.####.com/system/avtnew/2353/23530517/thumb/20150701225750.jpg
- p####.####.com/system/avtnew/2887/28879698/thumb/20151106201028.jpg?imag...
- p####.####.com/system/avtnew/1188/11880888/thumb/2016090200013654.JPEG?i...
- p####.####.com/system/avtnew/1161/11611065/thumb/20140715224941.jpg?imag...
- c####.####.com/sync.htm?cproid=####
- z####.####.com/ztd/w%3D350%3Bq%3D70/sign=09eaa58ee350352ab161230d63788ac...
- p####.####.com/system/avtnew/142/1422533/thumb/20141209142211.jpg?imageV...
- p####.####.com/system/pictures/11894/118944195/medium/app118944195.jpg
- 1####.####.111/APP/GetFeePoint.aspx
- p####.####.com/mcgm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- be####.####.com/id3a1ecf98f6c9f530db1c7582affa32f71bf3d41128ea38e01e382f...
- p####.####.com/system/avtnew/2796/27962164/thumb/20150427045433.jpg?imag...
- p####.####.com/system/avtnew/1864/18644381/thumb/20141224201624.jpg
- p####.####.com/system/avtnew/700/7003153/thumb/20140817162820.jpg?imageV...
- p####.####.com/mcgm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- p####.####.com/system/avtnew/3079/30793080/thumb/20170421123115.JPEG?ima...
- p####.####.com/system/avtnew/2400/24003867/thumb/20141224180524.jpg
- p####.####.com/system/avtnew/2476/24763624/thumb/20150121134238.jpg
- p####.####.com/system/avtnew/3212/32125885/thumb/20161229075454.JPEG?ima...
- p####.####.com/system/avtnew/2749/27494604/thumb/2016101912023687.JPEG?i...
- p####.####.com/system/avtnew/2829/28295560/thumb/20160726133851.jpg?imag...
- p####.####.com/system/avtnew/1673/16731955/thumb/20150318103339.jpg?imag...
- t####.####.com/it/u=294079237,3275260590&fm=76
- t####.####.com/it/u=3942107109,3833337431&fm=76
- qiushib####.com/users/12458785/
- p####.####.com/system/avtnew/899/8995897/thumb/20150530175036.jpg?imageV...
- p####.####.com/system/avtnew/2472/24720192/thumb/20150112173552.jpg
- p####.####.com/system/avtnew/3014/30144660/thumb/201608011655392.JPEG?im...
- st####.####.com/images/newarticle/nearby_gender_male@1.5x.png
- s####.####.com/s.htm?cproid=####&t=####
- p####.####.com/system/avtnew/2564/25646674/thumb/20150315114203.jpg?imag...
- t####.####.com/it/u=1664685229,2200781578&fm=76
- qiushib####.com/
- p####.####.com/system/avtnew/1209/12090503/thumb/20140526223327.jpg?imag...
- st####.####.com/images/touch/paper.png?v=####
- p####.####.com/system/avtnew/3257/32570565/thumb/2016090415582686.JPEG?i...
- p####.####.com/s?pss=####&ti=####&ps=####&drs=####&cfv=####&cpl=####&chi...
- p####.####.com/iclm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- p####.####.com/system/avtnew/3137/31370749/thumb/2017032521331576.JPEG?i...
- st####.####.com/images/newarticle/cmt@1.5x.png
- p####.####.com/system/avtnew/2652/26520176/thumb/20150312113650.jpg?imag...
- t####.####.com/it/u=258559434,643313339&fm=76
- st####.####.com/images/thumb/anony.png?v=####
- p####.####.com/system/pictures/9679/96792886/small/96792886.jpg?imageVi#...
- 1####.####.111/APP/AppTask.aspx
- p####.####.com/system/avtnew/3333/33334927/thumb/201701241635319.JPEG?im...
- qb-m####.####.com/watermark/566fdb880c6596cc63936977d74452c4.gif!/gifto/...
- p####.####.com/system/pictures/9616/96167628/small/96167628.jpg?imageVi#...
- p####.####.com/system/avtnew/1787/17874105/thumb/20141217151622.jpg?imag...
- p####.####.com/system/avtnew/280/2805856/thumb/2016081700265453.JPEG?ima...
- p####.####.com/system/pictures/9616/96163328/small/96163328.jpg?imageVi#...
- p####.####.com/system/avtnew/1221/12218602/thumb/2017041619004632.JPEG?i...
- st####.####.com/images/thumb/missing.png?imageVi####
- t####.####.com/it/u=3712825453,692518663&fm=76
- t####.####.com/it/u=4016052829,3892740458&fm=76
- p####.####.com/system/avtnew/3244/32440171/thumb/2016092123514722.JPEG?i...
- p####.####.com/system/avtnew/725/7253814/thumb/20150429223420.jpg
- be####.####.com/zt3a1ecf98f7caf631db1c7582affa32f71bf3d41128ea38e01e382f...
- c####.####.com/cpro/ui/cm.js
- p####.####.com/system/avtnew/1682/16821669/thumb/20170408164427.JPEG?ima...
- st####.####.com/images/touch/line-arrow.png?v=####
- p####.####.com/system/avtnew/2912/29122656/thumb/20150927005515.jpg?imag...
- p####.####.com/system/avtnew/1033/10339296/thumb/2016102105483545.JPEG?i...
- p####.####.com/system/avtnew/3048/30488907/thumb/20160112192332.jpg?imag...
- p####.####.com/system/avtnew/1776/17764731/thumb/2016092012372362.JPEG?i...
- p####.####.com/system/pictures/9656/96562370/small/96562370.jpg?imageVi#...
- p####.####.com/system/avtnew/910/9107412/thumb/20140411145603.jpg?imageV...
- t####.####.com/it/u=317216685,3238474478&fm=76
- p####.####.com/system/avtnew/3089/30895254/thumb/20170418214533.JPEG?ima...
- t####.####.com/it/u=1111030906,1463698119&fm=76
- p####.####.com/system/pictures/9616/96167602/small/96167602.jpg?imageVi#...
- p####.####.com/system/avtnew/3197/31977795/thumb/2016120818015270.JPEG?i...
- qiushib####.com/article/118924877
- p####.####.com/system/avtnew/3292/32921052/thumb/20170401214128.JPEG?ima...
- p####.####.com/system/avtnew/2233/22333597/thumb/20141103142926.jpg
- st####.####.com/images/cmt-god.png
- p####.####.com/system/avtnew/2955/29553448/thumb/20170214032629.JPEG?ima...
- p####.####.com/system/avtnew/3125/31257968/thumb/20160222092812.jpg?imag...
- t####.####.com/it/u=1095662166,1209166904&fm=76
- p####.####.com/system/avtnew/2360/23607209/thumb/20151213153611.jpg?imag...
- z####.####.com/ztd/w%3D350%3Bq%3D70/sign=7b7d294cdc88d43ff0a997f74d25a32...
- st####.####.com/images/newarticle/laugh@1.5x.png
- p####.####.com/system/avtnew/3197/31979430/thumb/20170217065544.JPEG?ima...
- p####.####.com/system/avtnew/604/6041708/thumb/20140422221640.jpg?imageV...
- p####.####.com/jcim?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- p####.####.com/system/avtnew/1628/16280741/thumb/20140613063428.jpg?imag...
- p####.####.com/system/avtnew/3123/31235405/thumb/20160218212801.jpg?imag...
- p####.####.com/system/avtnew/556/5565302/thumb/20130108172837.jpg?imageV...
- p####.####.com/system/pictures/11892/118924877/medium/app118924877.jpg
- p####.####.com/xctm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- p####.####.com/system/avtnew/958/9583123/thumb/20151010165155.jpg?imageV...
- p####.####.com/system/avtnew/2924/29248956/thumb/2017042701572346.JPEG?i...
- t####.####.com/it/u=545598180,1742957581&fm=76
- p####.####.com/system/avtnew/808/8083280/thumb/20160425220126.jpg?imageV...
- p####.####.com/system/avtnew/3284/32843988/thumb/2016102100194899.GIF?im...
- p####.####.com/system/avtnew/2922/29229260/thumb/20170201160903.JPEG?ima...
- st####.####.com/images/touch/page-pre.png?v=####
- p####.####.com/system/avtnew/1614/16146827/thumb/20150612145942.jpg
- p####.####.com/system/avtnew/3305/33052001/thumb/2016120211544258.JPEG?i...
- t####.####.com/it/u=2043939935,3020615213&fm=76
- p####.####.com/system/avtnew/1658/16589697/thumb/20150502230631.jpg?imag...
- p####.####.com/system/avtnew/2706/27061818/thumb/20150328235655.jpg
- qiushib####.com/history/
- st####.####.com/images/touch/page-next.png?v=####
- p####.####.com/gcrm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- p####.####.com/system/pictures/9664/96647168/small/96647168.jpg?imageVi#...
- p####.####.com/scem?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- p####.####.com/system/avtnew/2169/21690325/thumb/20160507144722.jpg?imag...
- p####.####.com/mcrm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- p####.####.com/system/avtnew/1433/14334094/thumb/20140924161810.jpg?imag...
- p####.####.com/system/avtnew/3057/30579438/thumb/20170101023244.JPEG?ima...
- p####.####.com/system/avtnew/978/9787578/thumb/20140922224839.jpg?imageV...
- p####.####.com/system/avtnew/3345/33459040/thumb/2017022411524716.GIF?im...
- p####.####.com/system/avtnew/1147/11478239/thumb/20160419221907.jpg?imag...
- t####.####.com/it/u=3641423054,3467860450&fm=76
- be####.####.com/hs3a1ecf91fec9f33bdb1c7582affa32f71bf3d41128ea38e01e382f...
- p####.####.com/system/avtnew/471/4713569/thumb/20160210143121.jpg?imageV...
- be####.####.com/a?orr=####&sh=####&or=####&cqr=####&beu=####&bok=####&bg...
- qiushib####.com/joke/30591/
- p####.####.com/system/avtnew/3118/31187946/thumb/20170425121753.JPEG?ima...
- p####.####.com/system/avtnew/1299/12992639/thumb/2017041721300926.JPEG?i...
- t####.####.com/it/u=519709781,2108405958&fm=76
- p####.####.com/system/avtnew/2596/25968062/thumb/20150225215008.jpg?imag...
- p####.####.com/system/avtnew/3063/30639691/thumb/20170424080140.JPEG?ima...
- p####.####.com/system/avtnew/1958/19584967/thumb/20150224235406.jpg?imag...
- p####.####.com/system/avtnew/2408/24089034/thumb/20170409151847.JPEG?ima...
- t####.####.com/it/u=2383638222,3419487030&fm=76
- p####.####.com/system/avtnew/3172/31723527/thumb/20160504065451.jpg?imag...
- p####.####.com/system/avtnew/2567/25673072/thumb/20170106123629.JPEG?ima...
- qiushib####.com/gif/4-22377.html
- p####.####.com/system/avtnew/2524/25240252/thumb/20160512212653.jpg
- p####.####.com/system/avtnew/2727/27273326/thumb/2016100910152638.JPEG?i...
- p####.####.com/system/avtnew/2093/20934771/thumb/20160617191727.jpg?imag...
- p####.####.com/system/pictures/9616/96163420/small/96163420.jpg?imageVi#...
- p####.####.com/scem?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- p####.####.com/system/avtnew/1734/17340329/thumb/20170315114931.JPEG?ima...
- t####.####.com/it/u=543406715,3866770367&fm=76
- p####.####.com/system/avtnew/2817/28170004/thumb/20170427213510.JPEG?ima...
- p####.####.com/system/avtnew/1128/11285601/thumb/20160326200009.jpg
- p####.####.com/system/avtnew/2932/29323692/thumb/20151005235011.jpg?imag...
- p####.####.com/system/avtnew/995/9951907/thumb/20141211012534.jpg?imageV...
- p####.####.com/system/avtnew/3136/31361724/thumb/20160308140403.jpg?imag...
- p####.####.com/system/avtnew/1083/10837536/thumb/20170214065601.JPEG?ima...
- p####.####.com/system/avtnew/3308/33088268/thumb/2016121005434260.JPEG?i...
- p####.####.com/system/avtnew/215/2155971/thumb/20140405011944.jpg?imageV...
- p####.####.com/system/avtnew/2269/22696331/thumb/20170303230148.JPEG?ima...
- p####.####.com/system/avtnew/484/4844459/thumb/20121205164159.jpg?imageV...
- p####.####.com/system/avtnew/1898/18981589/thumb/20151011085724.jpg
- p####.####.com/system/avtnew/3352/33526064/thumb/2017031113035939.JPEG?i...
- t####.####.com/it/u=486884581,1962169543&fm=76
- p####.####.com/system/avtnew/2873/28739334/thumb/20160105080345.jpg
- qiushib####.com/article/add
- p####.####.com/system/avtnew/1560/15607756/thumb/20140517233947.jpg?imag...
- p####.####.com/system/avtnew/2704/27040194/thumb/20150816231025.jpg?imag...
- p####.####.com/system/pictures/9655/96553452/small/96553452.jpg?imageVi#...
- p####.####.com/system/avtnew/2808/28082222/thumb/2016112015475478.JPEG?i...
- t####.####.com/it/u=399733027,1328082973&fm=76
- p####.####.com/system/avtnew/3331/33311014/thumb/nopic.jpg?imageVi####
- st####.####.com/css/dist/touch/app.min.css?v=####
- p####.####.com/sync_pos.htm?cproid=####
- p####.####.com/system/avtnew/3255/32551431/thumb/2016090116370380.JPEG?i...
- p####.####.com/sync_pos.htm?cproid=####&t=####
- z####.####.com/ztd/w%3D350%3Bq%3D70/sign=1c9a18c576d98d1076d40a341104c93...
- z####.####.com/ztd/w%3D350%3Bq%3D70/sign=2942cd4af1f2b211e42e834bfabb140...
- t####.####.com/it/u=536333921,3478481011&fm=76
- p####.####.com/system/avtnew/431/4312695/thumb/20170427112123.JPEG?image...
- p####.####.com/system/avtnew/2318/23183631/thumb/20150903090527.jpg?imag...
- p####.####.com/system/avtnew/1490/14909710/thumb/20150107162803.jpg?imag...
- p####.####.com/system/avtnew/1102/11024077/thumb/201608161538122.JPEG?im...
- p####.####.com/system/avtnew/2183/21835857/thumb/20141018204011.jpg?imag...
- p####.####.com/system/avtnew/34/341166/thumb/20150119225349.jpg?imageVi#...
- p####.####.com/system/avtnew/3196/31962655/thumb/20160614144223.jpg?imag...
- t####.####.com/it/u=3720278008,441939868&fm=76
- p####.####.com/jcim?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- c####.####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- qiushib####.com/new4/session?1493298####
- p####.####.com/system/avtnew/3218/32183618/thumb/20160714204310.jpg?imag...
- p####.####.com/system/avtnew/3328/33289529/thumb/201701122110408.JPEG?im...
- p####.####.com/system/avtnew/434/4340044/thumb/20141214224338.jpg?imageV...
- a####.####.com/scheme/plan/eql_6.png
- qb-m####.####.com/snapshot/31b32fe4bae79bd2d12322e4b910f72b.jpg
- p####.####.com/system/avtnew/2582/25820212/thumb/20160323133942.jpg?imag...
- p####.####.com/system/avtnew/1295/12950867/thumb/20170427125649.JPEG?ima...
- p####.####.com/system/avtnew/2561/25618112/thumb/20150224142646.jpg
- p####.####.com/system/avtnew/1976/19764077/thumb/20141116191815.jpg?imag...
- p####.####.com/system/avtnew/23/231800/thumb/20170409220544.JPEG?imageVi...
- st####.####.com/images/newarticle/btn-play-small.png
- p####.####.com/system/avtnew/1173/11739494/thumb/20170328115321.JPEG?ima...
- p####.####.com/system/avtnew/2366/23668965/thumb/20141211005315.jpg?imag...
- p####.####.com/system/avtnew/1714/17146491/thumb/20140622184931.jpg?imag...
- p####.####.com/system/avtnew/3301/33017971/thumb/2016112416005289.JPEG?i...
- p####.####.com/gcrm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&...
- p####.####.com/system/avtnew/170/1701990/thumb/20120722210555.jpg?imageV...
- p####.####.com/system/avtnew/2848/28483844/thumb/20151018150833.jpg?imag...
- p####.####.com/system/avtnew/3046/30462401/thumb/2016092318225710.JPEG?i...
- p####.####.com/system/avtnew/2113/21135887/thumb/20140928121641.jpg?imag...
- p####.####.com/system/avtnew/3124/31243284/thumb/20160219231808.jpg?imag...
- w####.####.com/adx.php?c=####
- p####.####.com/system/avtnew/3127/31273278/thumb/20160224163244.jpg?imag...
- t####.####.com/it/u=4154554569,4190567659&fm=76
- p####.####.com/system/avtnew/2680/26800306/thumb/20150726114837.jpg?imag...
- p####.####.com/lcvm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- p####.####.com/system/avtnew/2850/28501616/thumb/20151016071930.jpg?imag...
- p####.####.com/system/avtnew/1659/16591347/thumb/20170129170908.JPEG
- p####.####.com/system/avtnew/3142/31425208/thumb/20170415194621.JPEG?ima...
- p####.####.com/system/avtnew/2323/23237237/thumb/20141129002305.jpg?imag...
- p####.####.com/system/avtnew/2896/28963410/thumb/20151121161720.jpg?imag...
- st####.####.com/images/touch/colline.png?v=####
- p####.####.com/system/avtnew/3074/30744901/thumb/20170422172850.JPEG?ima...
- p####.####.com/scnm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&...
- p####.####.com/system/pictures/11894/118943226/medium/app118943226.jpg
- p####.####.com/system/avtnew/1135/11357861/thumb/20141217083527.jpg?imag...
- qb-m####.####.com/snapshot/3f72e2a12ddedda52eaa13cc13b17c6d.jpg
- t####.####.com/it/u=2789643165,3389775702&fm=76
- z####.####.com/ztd/w%3D350%3Bq%3D70/sign=1f91f4bfc3ea15ce41eee60c863b4bc...
- p####.####.com/system/avtnew/707/7078520/thumb/20141222142348.jpg?imageV...
- p####.####.com/system/avtnew/2161/21617515/thumb/20150728131412.jpg?imag...
- p####.####.com/system/avtnew/1004/10047647/thumb/20140717095206.jpg?imag...
- t####.####.com/it/u=341089043,2959065337&fm=76
- qb-m####.####.com/watermark/6647be51dac45be5ae8bdcba358dc986.gif!/gifto/...
HTTP POST requests:
- s####.####.com/fbplan.action
- ut####.cn:8080/excalibur/avalon/sdk/pay.aspx
- s####.####.com/cfgplan.action
- ut####.cn/excalibur/avalon/sdk/init.aspx
- a####.####.com/app_logs
- ut####.cn/excalibur/avalon/sdk/pay.aspx
- s####.####.com:36800/cfgplan.action
Modified file system:
Creates the following files:
- /data/data/####/databases/cc.db-journal
- /data/data/####/app_dex/utopay.jar
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/databases/utopay.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000019
- /data/data/####/files/.mylib/temp.zip
- /data/data/####/files/mj.apk
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/f_000016
- /data/data/####/databases/cc.db
- /data/data/####/cache/webviewCacheChromium/f_000018
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /sdcard/Android/system/etc/.CHID
- /data/data/####/files/.mylib/pushshell_0.apk
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/Android/system/etc/.UUID
- /data/data/####/databases/ua.db
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/.r.jar
- /data/data/####/files/.mylib/qweus
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/files/.imprint
- /data/data/####/shared_prefs/pluginLib.xml
- /data/data/####/cache/.cache/1493298749089
- /data/data/####/cache/.cache/1493298743371
- /data/data/####/databases/ua.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/shared_prefs/mlib.xml
- /data/data/####/files/.e.download
- /data/data/####/databases/utopay.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/webviewCacheChromium/f_00001d
- /data/data/####/files/exid.dat
- /data/data/####/cache/webviewCacheChromium/f_00001b
- /data/data/####/cache/webviewCacheChromium/f_00001c
- /data/data/####/cache/webviewCacheChromium/f_00001a
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/databases/sms_db
- /data/data/####/databases/sms_db-journal
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/.cache/1493298748253
- /data/data/####/cache/webviewCacheChromium/f_000002
- /sdcard/Android/system/etc/.imei
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/files/.rpluin.download
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/.ajsbv.download
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/files/.mylib/Tool12
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/cache/.cache/1493298744220
- /data/data/####/files/.mylib/ts
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/.cache/1493298742346
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_000015
- /sdcard/Android/system/etc/.imsi
- /data/data/####/files/.mylib/cr.sh
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/cache/webviewCacheChromium/f_000017
Sets the 'executable' attribute to the following files:
- /data/data/####/files/.mylib/cr.sh
- /data/data/####/files/.mylib/pushshell_0.apk
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 79 40 123764 /data/data/####/files/mj.apk 1225747527 1829278891 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework
- /system/bin/dexopt --dex 27 104 40 94348 /data/data/####/shared_prefs/.r.jar 1251646161 85549710 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
- sh
- getprop apps.customerservice.device
- /system/bin/dexopt --dex 27 57 40 58612 /data/data/####/app_dex/utopay.jar 1227655653 1808834331 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
Contains functionality to send SMS messages automatically.