Technical information
Malicious functions:
Sends SMS messages:
- 106575206321505460: dyl#<IMSI>,<IMEI>,6000031-1-1110-1202_1047-0
Network activity:
Connecting to:
- 1####.####.10:7070
- 1####.####.34:19000
- a####.####.com
- c####.####.com
- d####.####.com
- f####.####.com
- huangda####.com
- p####.####.cn
- p####.####.com
- p####.####.com:13579
- u####.####.net
- ut####.cn:8080
- v####.####.com
- y####.####.net
HTTP GET requests:
- c####.####.com/ip2city.asp
- d####.####.com/201705/20161018_tongchengxunai.png
- f####.####.com/ykh/dwdw/1222_1001
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- p####.####.com/cityjson?ie=####
- u####.####.net/1/1100/index.html?_r=####
- y####.####.net/a/1222/1001/1222-1001-v10011109-20170725171959.apk
HTTP POST requests:
- 1####.####.10:7070/callservice/dmdata.jar
- 1####.####.34:19000/v2/chis
- a####.####.com/sc/get.json
- p####.####.cn/index.php/API
- p####.####.com:13579/SMSpay/api/updateVersion.do
- ut####.cn:8080/excalibur/avalon/sdk/init.aspx
- v####.####.com/sts/s.json
Modified file system:
Creates the following files:
- <Package Folder>/app_dex/utopay.jar
- <Package Folder>/app_dex/utopay_close.png
- <Package Folder>/app_dex/utopay_icon.gif
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/dmdata.jar
- <Package Folder>/cache/####/index
- <Package Folder>/databases/TestinAgent.db
- <Package Folder>/databases/TestinAgent.db-journal
- <Package Folder>/databases/milipay_sms_one.db-journal
- <Package Folder>/databases/mp.db
- <Package Folder>/databases/mp.db-journal
- <Package Folder>/databases/recordInfo-journal
- <Package Folder>/databases/recordInfo-journal (deleted)
- <Package Folder>/databases/sms_db
- <Package Folder>/databases/sms_db-journal
- <Package Folder>/databases/utopay.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/cache.info
- <Package Folder>/files/goonpost.info
- <Package Folder>/files/jarinfo.info
- <Package Folder>/files/mj.apk
- <Package Folder>/files/noend.ini
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak (deleted)
- <Package Folder>/shared_prefs/TestinCrash.xml
- <Package Folder>/shared_prefs/cpMsg.xml
- <Package Folder>/shared_prefs/device_id.xml.xml
- <Package Folder>/shared_prefs/dispatch_log.xml
- <Package Folder>/shared_prefs/getFlag.xml
- <Package Folder>/shared_prefs/plugins.serviceMapping.xml
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/twc.xml
- <Package Folder>/shared_prefs/twc.xml.bak
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3001_2247.zip
- <SD-Card>/zdw/1795CD1D2631F7A58CABDDBCA5E77B40.tmp
- <SD-Card>/zdw/90C94C478279B95975D9F6DAAFC3564B.tmp
- <SD-Card>/zdw/C484040AC65A8EA4A2B1CEA42AA90715.tmp
- <SD-Card>/zeb/poiwa
- <SD-Card>/zeb/scs
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- busybox ifconfig
- cat /sys/block/mmcblk0/device/cid
- getprop apps.customerservice.device
Contains functionality to send SMS messages automatically.