Technical information
Malicious functions:
Sends SMS messages:
- 106575206321505460: dyl#<IMSI>,<IMEI>,6000089-1-1-6_kh29s0135_-0
Executes code of the following detected threats:
- Android.Triada.247.origin
- Android.Triada.248.origin
Downloads the following detected threats from the Web:
- Android.Triada.247.origin
- Android.Triada.248.origin
Prompts to install third-party applications.
Network activity:
Connecting to:
- 6####.####.140
- a####.####.com
- c####.####.com
- collec####.####.com
- huangda####.com
- meipian####.####.com
- p####.####.cc
- p####.####.com
- pa####.####.com
- w####.####.com
HTTP GET requests:
- c####.####.com/20170715/tongyu-pay-lib-2159-ymt.apk
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- meipian####.####.com/wodeanjilahuaweidsp2.properties
- p####.####.com/sdkMis/getRdoUrl
- w####.####.com/rdo/order/invalid;jsessionid=D473CADF7CB8E38022184A13F1A3...
HTTP POST requests:
- 6####.####.140/ando/x/liv?app_id=####&r=####
- a####.####.com/app_logs
- collec####.####.com/pay-data-collect/uploadClientCrashLog.json
- p####.####.cc/index.php/API
- pa####.####.com/mobile-service/getOpenImsiMobilePhone.json
Modified file system:
Creates the following files:
- /data/data/####/-p7qHNFo-bHTIdDHfXNtehO67ZTmzQbu.new
- /data/data/####/.imprint
- /data/data/####/11mVt6B3SPr-_N8j.zip
- /data/data/####/3lah0_f1_pMPcls86eq_JFSB3QCa1r-L.new
- /data/data/####/3nqaLYdwX2jOyctFbDeUAw==.new
- /data/data/####/3xyhNWMexZ_f0AjYC9lS_EwQIio=
- /data/data/####/3xyhNWMexZ_f0AjYC9lS_EwQIio=.new
- /data/data/####/4F6Yun4Ss9iGCbdntvFlF-k3sAICCf6X8xGT2sBB2yo=.new
- /data/data/####/61ySLOBZFfXtRK2pr6an6d3hp8s=.new
- /data/data/####/6FJXE2qES1gr142C2acUIjAaJDo=.new
- /data/data/####/E953WNDUR5mASUeIlgcasYkmnw1AwvlFGIeTV4lI5fk=.new
- /data/data/####/FDXp5LW8SsWE7AFijESLEGgGxHRoKtfq.new
- /data/data/####/Gp6a9hOVKxEQmororpWSIjTkdFV8onpA.new
- /data/data/####/HB52DKMeMTs6ZC11vJm_OdPs_WRdMlVP
- /data/data/####/HB52DKMeMTs6ZC11vJm_OdPs_WRdMlVP.new
- /data/data/####/HB52DKMeMTs6ZC11vJm_OdPs_WRdMlVP.old (deleted)
- /data/data/####/KAdnHHmro03oKhdh8VFvhxtCZ0U=.new
- /data/data/####/LMPkSm8ngJcvJlq2Mmwnsw==.new
- /data/data/####/LMh1-YsKVLXBBct_xaZoHfZqSOcP5aAizTiRPw==.new
- /data/data/####/LZ7QdstL3yBk-uUItgbWPg==
- /data/data/####/Leak3vfVlyk=.jar
- /data/data/####/Mf9OIrYfaUc_M6idIwqo8bxm2_1T3ouA.new
- /data/data/####/Pom8DJbMabe5Ne9-ZyVimwOz5crGYLNw.new
- /data/data/####/WXdczIEEA6deZ0QoYZWsf7ZHn8lheRnzkqvsUA==
- /data/data/####/WXdczIEEA6deZ0QoYZWsf7ZHn8lheRnzkqvsUA==.new
- /data/data/####/XJ6D_P2lw90h-zX2kJsBYA==.new
- /data/data/####/Zp6JCZShOz90oNsPni7KJg5cG4fwoIc8eBwl7A==.new
- /data/data/####/_foenbh-NkAtEtF0d3rpWZ5eREc=
- /data/data/####/b3bO2k2RoTiZ7U0D
- /data/data/####/base-1.apk
- /data/data/####/base-1.dex
- /data/data/####/com.dyl.pay.ui.apk
- /data/data/####/com.souying.pay.plugmain_p_config.xml
- /data/data/####/com.souying.pay.plugmain_sy_pay_record-journal
- /data/data/####/com.souying.pay.xml
- /data/data/####/cpMsg.xml
- /data/data/####/crash-1500588897969.log
- /data/data/####/data.dat.tmp
- /data/data/####/device_id.xml.xml
- /data/data/####/dispatch_log.xml
- /data/data/####/exchangeIdentity.json
- /data/data/####/gCs74RtqiavWdXHx
- /data/data/####/getFlag.xml
- /data/data/####/h0ZkKPYK3OQZCPQkr2gfY7-1cBBtBR2Q_2nP6AF09j2TmnbLF
- /data/data/####/h0ZkKPYK3OQZCPQkr2gfY7-1cBBtBR2Q_2nP6AF09j2TmnbLF-journal
- /data/data/####/h0ZkKPYK3OQZCPQkr2gfY7-1cBBtBR2Q_IKVh-107vxmLxiAbn5o5Kg==-journal
- /data/data/####/h0ZkKPYK3OQZCPQkr2gfY7-1cBBtBR2Q_r3PdjCnHh0Ab0cG02ipDq19vy1Y=
- /data/data/####/h0ZkKPYK3OQZCPQkr2gfY7-1cBBtBR2Q_r3PdjCnHh0Ab0cG02ipDq19vy1Y=-journal
- /data/data/####/h0ZkKPYK3OQZCPQkr2gfY7-1cBBtBR2Q_xBKo45HO_ELdJflesk9N1g==-journal
- /data/data/####/iD_Agbk5-fXip7wXYdvClA==
- /data/data/####/mobclick_agent_cached_com.four.pet.color.hm1
- /data/data/####/mp.db
- /data/data/####/mp.db-journal
- /data/data/####/noend.ini
- /data/data/####/plugin-20170105-2.1.8.6.1.bin
- /data/data/####/plugins.installed.xml
- /data/data/####/plugins.serviceMapping.xml
- /data/data/####/port.xml
- /data/data/####/port.xml.bak
- /data/data/####/pretw.xml
- /data/data/####/rdata_comsadfwjbfq.new
- /data/data/####/recordInfo-journal
- /data/data/####/runner_info.prop
- /data/data/####/smp.apk
- /data/data/####/smp.apk.apk
- /data/data/####/sms.apk
- /data/data/####/sms.apk.apk
- /data/data/####/snyaa_f.zip
- /data/data/####/sy_pay_config.xml
- /data/data/####/sy_pay_config.xml.bak
- /data/data/####/tongyu-pay-lib.apk
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/xfNNxTxTaVO95u5jH8fIY9pMkR9Ipa03g16fSBVtizU=.new
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/__send_data_1500588829069
- <Package Folder>/files/libcuid.so
- <Package Folder>/shared_prefs/JOKEDSP.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.tpservice/####/qsha_80001_5094.jar
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3003_2247.zip
- <SD-Card>/JOKEDSP/tongyuwodeanjila.apk
- <SD-Card>/JOKEDSP/wodeanjila_new.apk
- <SD-Card>/backups/####/.confd
- <SD-Card>/backups/####/.confd-journal
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/backups/####/.timestamp
Miscellaneous:
Executes next shell scripts:
- /data/data/com.four.pet.color.hm/code-6345847/gCs74RtqiavWdXHx -p com.four.pet.color.hm -c com.sadf.wjbfq.ufzhaq.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- <error:2>
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
- cat /sys/class/net/wlan0/address
- sh /data/data/com.four.pet.color.hm/code-6345847/gCs74RtqiavWdXHx -p com.four.pet.color.hm -c com.sadf.wjbfq.ufzhaq.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung