Technical information
Malicious functions:
Sends SMS messages:
- 10698000036592: 216a43c7-c75f-44b6-9dd5-08c6ae8b511b-1493729034142,点击发送直接登录
Network activity:
Connecting to:
- unio####.####.com
- h####.####.com
- i####.####.com
- sd####.####.com
- wap####.####.com
- a####.####.com
- pass####.####.com
HTTP GET requests:
- i####.####.com/cimages/img/18911/18911.jpg
- wap####.####.com/static/appsapi/conf/config.txt?tpl=####&app_version=###...
- i####.####.com/cimages/img/19433/19433.png
HTTP POST requests:
- sd####.####.com/useraction/call
- unio####.####.com/unionsdk/getErrorNotice
- sd####.####.com/game/call
- pass####.####.com/v2/sapi/smsgetlogin
- h####.####.com/app.gif
- a####.####.com/rest/2.0/channel/3526636972359462397
- unio####.####.com/unionsdk/getPictureAdvertising
- unio####.####.com/unionsdk/getPictureScreen
- unio####.####.com/unionsdk/getAdAfterExit
- unio####.####.com/unionsdk/cs
- a####.####.com/rest/2.0/channel/channel
Modified file system:
Creates the following files:
- /sdcard/backups/system/.confd
- /data/data/####/files/libcuid.so
- /sdcard/baidu/pushservice/files/apps
- /data/data/####/shared_prefs/bdp_pref.xml.bak
- /data/data/####/shared_prefs/channelid.xml
- /data/data/####/files/bdp_error
- /sdcard/backups/.SystemConfig/.cuid2
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
- /data/data/####/files/SGadQBABzd5fhthEgn4Nifz5__local_stat_cache.json
- /data/data/####/shared_prefs/pst.xml
- /data/data/####/databases/dk_user.db-journal
- /data/data/####/files/wappass.baidu.com-passport-login.html
- /data/data/####/shared_prefs/bids.xml
- /data/data/####/files/account_deb6af019f_790bd0c1512fd34a4dd609a81d372212
- /data/data/####/shared_prefs/bdp_pref.xml
- /data/data/####/shared_prefs/sapi_system.xml
- /data/data/####/databases/dk_user.db
- /sdcard/.BD_SAPI_CACHE/wappass.baidu.com/passport/login.html
- /data/data/####/files/bdp_channel
- /data/data/####/databases/recordstoredb-journal
- /data/data/####/files/bdp_pay
- /data/data/####/shared_prefs/####.self_push_sync.xml
- /sdcard/backups/system/.confd-journal
- /data/data/####/shared_prefs/com_dk_shared_preferences.xml
- /data/data/####/databases/pushstat_4.6.2.db-journal
- /sdcard/duoku/sdk/cache/19433.png
- /data/data/####/shared_prefs/pst.xml.bak
- /sdcard/backups/system/.config
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- /sdcard/duoku/sdk/cache/logoinfo_h5.txt
- /data/data/####/shared_prefs/sapi_system.xml.bak
- /data/data/####/databases/downloads.db-journal
- /sdcard/duoku/sdk/cache/18911.jpg
- /sdcard/baidu/.cuid
- /data/data/####/shared_prefs/####.push_sync.xml
- /data/data/####/databases/pushstat_4.6.2.db
- /data/data/####/shared_prefs/com_dk_shared_preferences.xml.bak
- /data/data/####/shared_prefs/bindcache.xml
- /data/data/####/databases/app.db-journal
- /sdcard/backups/.SystemConfig/.cuid
- /sdcard/duoku/sdk/cache/adinfo.txt
- /data/data/####/files/bdp_activity_config
Miscellaneous:
Executes next shell scripts:
- ls -l /system/bin/su
Contains functionality to send SMS messages automatically.