Technical information
Malicious functions:
Sends SMS messages:
- 106901332942: rg|712|AhB3j.S11wiZPLfC4voMlAPLf5l4OMLO8Og5z74T386B1e4EMXV6wXRwb.NGrtlrFV0dlKXO4ru0zqQB6FRNKw4e,8W3X6BjfRBRKplU3R8!
Prompts to install third-party applications.
Network activity:
Connecting to:
- 1####.####.108
- 1####.####.224
- 1####.####.224:5088
- 1####.####.68
- 1####.####.68:29092
- a####.####.cn
- a####.####.com
- c####.####.com
- c####.####.com:9003
- mo####.####.com
- st####.####.com
- t####.####.cn
- t####.####.net
HTTP GET requests:
- 1####.####.108/motor_mars/mars.php?uid=####
- a####.####.cn/app/api/clkListen.jhtm?sn=####&channelName=####&packageNam...
- mo####.####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=##...
- st####.####.com/res1/upload/file/201611/fe5f551a-029b-48bc-81ea-86e9a9f6...
HTTP POST requests:
- 1####.####.224/api.php/coupon/index
- 1####.####.224:5088/api.php/coupon/index
- 1####.####.68/ifServer/gtmb
- 1####.####.68:29092/ifServer/gtmb
- a####.####.com/app_logs
- c####.####.com/csk/st_c/cn_i_sec.json
- c####.####.com:9003/csk/st_c/cn_sk_login.json
- t####.####.cn/api/q/a/315432f0c34a6005ff1c18a57a27f742e
- t####.####.net/g/d?crc=####
Modified file system:
Creates the following files:
- /data/data/####/-1156149757-745595949
- /data/data/####/-1254159655662129388
- /data/data/####/-490665427695701585
- /data/data/####/-585836623-1012155646
- /data/data/####/.imprint
- /data/data/####/15113217291369366631
- /data/data/####/485438327537057920
- /data/data/####/727725171-873422081
- /data/data/####/911851012-1695914135
- /data/data/####/916930889-142436614
- /data/data/####/PreferanceUtil.xml
- /data/data/####/PreferanceUtil.xml.bak
- /data/data/####/__x_adsdk_agent_header__.xml
- /data/data/####/__xadsdk__remote__final__55ecf785-013b-42e2-a4ec-29bbfcbb9059.jar
- /data/data/####/__xadsdk__remote__final__55ecf785-013b-42e2-a4ec-29bbfcbb9059.jar (deleted)
- /data/data/####/__xadsdk__remote__final__6afcf272-8229-4db2-85f0-4bc1de8ff30f.jar
- /data/data/####/__xadsdk_downloaded__version__.xml
- /data/data/####/adshower.db-journal
- /data/data/####/appPackageNames
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/cn.jpush.android.user.profile.xml
- /data/data/####/cn.jpush.android.user.profile.xml.bak
- /data/data/####/cn.jpush.preferences.v2.xml
- /data/data/####/cn.jpush.preferences.v2.xml.bak
- /data/data/####/com.android.sysapp_clip.xml
- /data/data/####/com.baidu.mobads.loader.xml
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/jpush_device_info.xml
- /data/data/####/jpush_local_notification.db
- /data/data/####/jpush_local_notification.db-journal
- /data/data/####/jpush_stat_cache_history.json
- /data/data/####/jpush_statistics.db
- /data/data/####/jpush_statistics.db-journal
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal (deleted)
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal (deleted)
- /data/data/####/xUtils_http_cookie.db
- /data/data/####/xUtils_http_cookie.db-journal
- /system/app/Sysapp.apk
- /system/lib/lib64jpush220.so
- /system/lib/lib64locSDK6a.so
- /system/lib/libjpush220.so
- /system/lib/liblocSDK6a.so
- <Package Folder>/app_dex/app_test.dex (deleted)
- <Package Folder>/app_td-cache/TD_database_app_push
- <Package Folder>/cache/####/-1108696384-1474084615
- <Package Folder>/cache/####/-1645201492-1655802136
- <Package Folder>/cache/####/-7252669021706626256
- <Package Folder>/cache/####/911851012-1695914135
- <Package Folder>/databases/adshower.db
- <Package Folder>/databases/adshower.db-journal
- <Package Folder>/databases/mpush_app.db
- <Package Folder>/databases/mpush_app.db-journal
- <Package Folder>/files/####/aa
- <Package Folder>/files/####/c.jar
- <Package Folder>/files/TDtcagent.db
- <Package Folder>/files/TDtcagent.db-journal
- <Package Folder>/files/app_test.apk
- <Package Folder>/files/mpush_gateway_preferences_file
- <Package Folder>/files/mpush_version_preferences_file
- <Package Folder>/files/td.lock
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/PreferanceUtil.xml
- <Package Folder>/shared_prefs/PreferanceUtil.xml.bak
- <Package Folder>/shared_prefs/TDCloudSettingsConfigC5C3FBAF68B7455DB026AF3485DE0A9E.xml
- <Package Folder>/shared_prefs/TDCloudSettingsConfigC5C3FBAF68B7455DB026AF3485DE0A9E.xml.bak
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/TDpref_longtime.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml.bak
- <Package Folder>/shared_prefs/TDpref_shorttime.xml
- <Package Folder>/shared_prefs/TDpref_shorttime.xml.bak
- <Package Folder>/shared_prefs/cds.xml
- <Package Folder>/shared_prefs/tdid.xml
- <SD-Card>/.tcookieid
- <SD-Card>/Sysapp/Sysapp.apk
- <SD-Card>/SystemChannel/systemLyChannel
- <SD-Card>/data/.push_deviceid
- <SD-Card>/lib64jpush220.so
- <SD-Card>/lib64locSDK6a.so
- <SD-Card>/libjpush220.so
- <SD-Card>/liblocSDK6a.so
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- <su-internal:request>
- <su-internal:result>
- app_process /system/bin com.android.commands.pm.Pm install -r /system/app/Sysapp.apk
- chmod 644 /system/app/Sysapp.apk
- chmod 644 /system/lib/lib64jpush220.so
- chmod 644 /system/lib/lib64locSDK6a.so
- chmod 644 /system/lib/libjpush220.so
- chmod 644 /system/lib/liblocSDK6a.so
- chown root:root /system/app/Sysapp.apk
- dumpsys activity activities
- dzsu
- grep mResumedActivity
- mount -o remount /system
- sh
- su
Uses elevated priveleges.