Technical information
Malicious functions:
Gains access to the ITelephony private interface.
Intercepts incoming SMS messages and terminates the process of their transmission to handlers of other applications.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pug220####.pubm####.com:80
- TCP(HTTP/1.1) googl####.g.doublec####.net:80
- TCP(HTTP/1.1) rub####.s####.com:80
- TCP(HTTP/1.1) isee-mo####.org:80
- TCP(HTTP/1.1) app-adf####.jp:80
- TCP(HTTP/1.1) s.btst####.edg####.net:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) v4.eir-p####.net:80
- TCP(HTTP/1.1) j####.o####.net:80
- TCP(HTTP/1.1) www.sg-h####.co.jp:80
- TCP(HTTP/1.1) ssp-####.i-mo####.co.jp:80
- TCP(HTTP/1.1) imo####.s####.com:80
- TCP(HTTP/1.1) www.sagawa####.co.jp:80
- TCP(HTTP/1.1) cm.g.doublec####.net:80
- TCP(HTTP/1.1) w####.sg-h####.co.jp:80
- TCP(HTTP/1.1) tg.s####.com:80
- TCP(HTTP/1.1) a####.google####.com:80
- TCP(HTTP/1.1) y####.y####.co.jp:80
- TCP(HTTP/1.1) i.s####.com.####.net:80
- TCP(HTTP/1.1) www.go####.nl:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(SSL/3.0) p####.adsympt####.com:443
- TCP(TLS/1.0) p####.rubicon####.com:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) p####.adsympt####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) gdn.s####.com:443
- TCP(TLS/1.0) cm.g.doublec####.net:443
- TCP(TLS/1.0) pp.d2-####.net:443
- TCP(TLS/1.0) a####.google####.com:443
- TCP(TLS/1.0) in.treasur####.com:443
DNS requests:
- a####.google####.com
- app-adf####.jp
- bigmi####.com
- cm.g.doublec####.net
- gdn.s####.com
- googl####.g.doublec####.net
- i.s####.com
- im####.pubm####.com
- imo####.s####.com
- in.treasur####.com
- isee-mo####.org
- j####.o####.net
- jp####.p####.io
- p####.dmp.xlis####.jp
- p####.rubicon####.com
- p.adsympt####.com
- pp.d2-####.net
- rub####.s####.com
- s####.g.doublec####.net
- s.y####.jp
- ssp-####.i-mo####.co.jp
- tg.s####.com
- v4.eir-p####.net
- w####.sg-h####.co.jp
- www.go####.com
- www.go####.nl
- www.google-####.com
- www.googlet####.com
- www.sagawa####.co.jp
- www.sg-h####.co.jp
- y####.y####.co.jp
- y.one.impac####.jp
HTTP GET requests:
- a####.google####.com/ajax/libs/jquery/1.8.2/jquery.min.js
- app-adf####.jp/ad/i/sync?_pcd=####&_puid=####
- cm.g.doublec####.net/pixel?google_nid=####&googl####
- cm.g.doublec####.net/pixel?google_nid=####&google_cm=####&google_tc=####
- googl####.g.doublec####.net/pagead/viewthroughconversion/1003105897/?val...
- i.s####.com.####.net/s/so_sg.js?sgid=####
- imo####.s####.com/rtb/sync?proto=####&uid=####&sync_status=####
- isee-mo####.org/
- j####.o####.net/w/1.0/sd?cc=####&id=####&val=####
- j####.o####.net/w/1.0/sd?id=####&val=####
- pug220####.pubm####.com/AdServer/Pug?vcode=b####&piggybackCookie=####
- rub####.s####.com/rtb/sync?proto=####
- s.btst####.edg####.net/tag.js
- ssp-####.i-mo####.co.jp/sync.ashx?dspid=####
- tg.s####.com/aux/idsync?proto=####
- tg.s####.com/aux/sosync
- tg.s####.com/rtb/sync?proto=####
- tg.s####.com/rtb/sync?proto=####&dspid=####
- tg.s####.com/rtb/sync_before?proto=####&sspid=####
- tg.s####.com/sa/js?said=####&t=####&tp=####&pp=####
- v4.eir-p####.net/Custom/public/parts/9143/jai8se7t/parts/conf/corp_top.j...
- v4.eir-p####.net/Custom/public/parts/9143/jai8se7t/parts/corp_top.js?gt=...
- v4.eir-p####.net/Custom/public/parts/9143/jai8se7t/parts/css/main.css
- v4.eir-p####.net/Custom/public/parts/9143/jai8se7t/parts/custom.js?gt=####
- v4.eir-p####.net/Custom/public/parts/9143/jai8se7t/parts/img/filetype_ic...
- v4.eir-p####.net/Custom/public/parts/9143/jai8se7t/parts/junction.js
- v4.eir-p####.net/Custom/public/parts/9999/js/gengou.js?gt=####
- v4.eir-p####.net/Custom/public/parts/9999/lib/jquery.min.js?gt=####
- v4.eir-p####.net/V4Public/EIR/9143/ja/announcement/announcement_1.js?gt=...
- w####.sg-h####.co.jp/common/css/base.css
- w####.sg-h####.co.jp/common/css/import_print.css
- w####.sg-h####.co.jp/common/css/module.css
- w####.sg-h####.co.jp/common/css/print.css
- w####.sg-h####.co.jp/common/css/rwd.css
- w####.sg-h####.co.jp/common/css/structure.css
- w####.sg-h####.co.jp/common/images/bg_body.gif
- w####.sg-h####.co.jp/common/images/bg_globalnav.gif
- w####.sg-h####.co.jp/common/images/btn_search.gif
- w####.sg-h####.co.jp/common/images/icn_link-newwin.png
- w####.sg-h####.co.jp/common/images/icn_link-pagetop.gif
- w####.sg-h####.co.jp/common/images/icn_link01.png
- w####.sg-h####.co.jp/common/images/icn_topicpath.gif
- w####.sg-h####.co.jp/common/images/ttl_sgh-logo.png
- w####.sg-h####.co.jp/common/images/txt_head-lead.png
- w####.sg-h####.co.jp/common/inc/GoogleTagManager.html?_=####
- w####.sg-h####.co.jp/common/inc/footer.html?_=####
- w####.sg-h####.co.jp/common/js/common.js
- w####.sg-h####.co.jp/common/js/jquery_auto.js
- w####.sg-h####.co.jp/common/js/rwd_menu.js
- w####.sg-h####.co.jp/matc.js
- w####.sg-h####.co.jp/newsrelease/css/style.css
- w####.sg-h####.co.jp/newsrelease/detail/2014/1121_955.html
- w####.sg-h####.co.jp/newsrelease/detail/2018/0410_1322.html
- w####.sg-h####.co.jp/newsrelease/detail/2018/0412_1323.html
- w####.sg-h####.co.jp/newsrelease/list/2014/
- w####.sg-h####.co.jp/uploads/resources/newsrelease/2014/Image/news201411...
- w####.sg-h####.co.jp/uploads/resources/newsrelease/2018/Image/20180412_3...
- w####.sg-h####.co.jp/uploads/resources/newsrelease/2018/Image/20180412_4...
- w####.sg-h####.co.jp/uploads/resources/newsrelease/2018/Image/20180412_5...
- www.go####.com/ads/user-lists/1003105897/?value=####&label=####&guid=###...
- www.go####.nl/ads/user-lists/1003105897/?value=####&label=####&guid=####...
- www.google-####.com/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&...
- www.google-####.com/analytics.js
- www.google-####.com/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####...
- www.google-####.com/ga.js
- www.google-####.com/r/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=###...
- www.sagawa####.co.jp/
- www.sagawa####.co.jp/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####...
- www.sagawa####.co.jp/common/css/cmn_layout.css
- www.sagawa####.co.jp/common/css/cmn_module.css
- www.sagawa####.co.jp/common/css/cmn_style.css
- www.sagawa####.co.jp/common/css/plugins/magnific-popup.css
- www.sagawa####.co.jp/common/css/reset.css
- www.sagawa####.co.jp/common/img/btn_pagetop01.png
- www.sagawa####.co.jp/common/img/btn_search.png
- www.sagawa####.co.jp/common/img/ico_arrow_r01.png
- www.sagawa####.co.jp/common/img/ico_blank01.png
- www.sagawa####.co.jp/common/img/ico_home01.png
- www.sagawa####.co.jp/common/img/ico_topicpath01.gif
- www.sagawa####.co.jp/common/img/logo_sagawa.png
- www.sagawa####.co.jp/common/img/logo_sgh.png
- www.sagawa####.co.jp/common/inc/footer.html?_=####
- www.sagawa####.co.jp/common/inc/header.html?_=####
- www.sagawa####.co.jp/common/js/common.js
- www.sagawa####.co.jp/common/js/lib/bxslider/jquery.bxslider.css
- www.sagawa####.co.jp/common/js/lib/bxslider/jquery.bxslider.min.js
- www.sagawa####.co.jp/common/js/lib/jquery.ah-placeholder.js
- www.sagawa####.co.jp/common/js/lib/jquery.imagesloaded.js
- www.sagawa####.co.jp/common/js/lib/jquery.js
- www.sagawa####.co.jp/common/js/lib/plugins.js
- www.sagawa####.co.jp/common/js/universalanalytics.js
- www.sagawa####.co.jp/css/style.css
- www.sagawa####.co.jp/goal/
- www.sagawa####.co.jp/img/bnr_pickup_01.png
- www.sagawa####.co.jp/img/bnr_pickup_02.png
- www.sagawa####.co.jp/img/mv/ja/box_cm.png
- www.sagawa####.co.jp/img/mv/ja/box_goal.png
- www.sagawa####.co.jp/img/mv/ja/mv_bg.jpg
- www.sagawa####.co.jp/img/mv/ja/mv_txt2017a.png
- www.sagawa####.co.jp/img/mv/ja/mv_txt2017b.png
- www.sagawa####.co.jp/img/mv/mv_bg2017b_tablet.png
- www.sagawa####.co.jp/img/panel/panel_icon_branch.png
- www.sagawa####.co.jp/img/panel/panel_icon_business.png
- www.sagawa####.co.jp/img/panel/panel_icon_close.png
- www.sagawa####.co.jp/img/panel/panel_icon_close2.png
- www.sagawa####.co.jp/img/panel/panel_icon_fare.png
- www.sagawa####.co.jp/img/panel/panel_icon_link.png
- www.sagawa####.co.jp/img/panel/panel_icon_redeliver.png
- www.sagawa####.co.jp/img/panel/panel_icon_search.png
- www.sagawa####.co.jp/img/panel/panel_icon_search2.png
- www.sagawa####.co.jp/img/panel/panel_icon_track.png
- www.sagawa####.co.jp/img/panel/panel_icon_wts.png
- www.sagawa####.co.jp/img/pr_002.jpg
- www.sagawa####.co.jp/img/pr_003.jpg
- www.sagawa####.co.jp/img/pr_004.jpg
- www.sagawa####.co.jp/img/pr_006.jpg
- www.sagawa####.co.jp/img/pr_008.jpg
- www.sagawa####.co.jp/js/AppSelection.js
- www.sagawa####.co.jp/js/news.js
- www.sagawa####.co.jp/js/placeHolderSetting.js
- www.sagawa####.co.jp/js/top.js
- www.sagawa####.co.jp/js/topBranchSearch.js
- www.sagawa####.co.jp/js/track.js
- www.sagawa####.co.jp/matc.js
- www.sagawa####.co.jp/notice/detail/41/
- www.sagawa####.co.jp/notice/detail/41/eq_01.gif
- www.sagawa####.co.jp/sagawa_xml/information/top.xml?_=####
- www.sagawa####.co.jp/sagawa_xml/newsrelease/top.xml?_=####
- www.sagawa####.co.jp/sagawa_xml/notice/top.xml?_=####
- www.sagawa####.co.jp/sagawa_xml/whatsnew/top.xml?_=####
- www.sagawa####.co.jp/system/css/cmn_system.css
- www.sg-h####.co.jp/
- www.sg-h####.co.jp/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&u...
- www.sg-h####.co.jp/common/css/base.css
- www.sg-h####.co.jp/common/css/import_print.css
- www.sg-h####.co.jp/common/css/module.css
- www.sg-h####.co.jp/common/css/print.css
- www.sg-h####.co.jp/common/css/rwd.css
- www.sg-h####.co.jp/common/css/structure.css
- www.sg-h####.co.jp/common/images/bg_body.gif
- www.sg-h####.co.jp/common/images/bg_globalnav.gif
- www.sg-h####.co.jp/common/images/btn_search.gif
- www.sg-h####.co.jp/common/images/icn_link-newwin.gif
- www.sg-h####.co.jp/common/images/icn_link-pagetop.gif
- www.sg-h####.co.jp/common/images/icn_link-rss.gif
- www.sg-h####.co.jp/common/images/icn_link.gif
- www.sg-h####.co.jp/common/images/icn_link01.png
- www.sg-h####.co.jp/common/images/icn_topicpath.gif
- www.sg-h####.co.jp/common/images/ttl_sgh-logo.png
- www.sg-h####.co.jp/common/images/txt_head-lead.png
- www.sg-h####.co.jp/common/inc/GoogleTagManager.html?_=####
- www.sg-h####.co.jp/common/inc/footer.html?_=####
- www.sg-h####.co.jp/common/js/common.js
- www.sg-h####.co.jp/common/js/jquery.heightLine.js
- www.sg-h####.co.jp/common/js/jquery_auto.js
- www.sg-h####.co.jp/common/js/rwd_menu.js
- www.sg-h####.co.jp/common/js/topics.js
- www.sg-h####.co.jp/csr/
- www.sg-h####.co.jp/csr/common/images/csrNavi.png
- www.sg-h####.co.jp/csr/common/images/naviArrw.gif
- www.sg-h####.co.jp/csr/common/js/common.min.js
- www.sg-h####.co.jp/csr/common/js/jquery.min.js
- www.sg-h####.co.jp/csr/css/csr2016.min.css
- www.sg-h####.co.jp/csr/css/csr2017.css
- www.sg-h####.co.jp/csr/css/csr_print.css
- www.sg-h####.co.jp/csr/css/responsiveslides.css
- www.sg-h####.co.jp/csr/css/special.css
- www.sg-h####.co.jp/csr/css/style.min.css
- www.sg-h####.co.jp/csr/css/supplement.min.css
- www.sg-h####.co.jp/csr/images/icn_link_listhead.gif
- www.sg-h####.co.jp/csr/images/icon_environment.gif
- www.sg-h####.co.jp/csr/images/icon_management.gif
- www.sg-h####.co.jp/csr/images/icon_planResultLink.gif
- www.sg-h####.co.jp/csr/images/icon_planResultLink_on.gif
- www.sg-h####.co.jp/csr/images/icon_society.gif
- www.sg-h####.co.jp/csr/images/pr.jpg
- www.sg-h####.co.jp/csr/images/sgh_top_13.jpg
- www.sg-h####.co.jp/csr/images/sgh_top_13_sp.png
- www.sg-h####.co.jp/csr/images/sgh_top_16.png
- www.sg-h####.co.jp/csr/images/sgh_top_17.png
- www.sg-h####.co.jp/csr/images/sgh_top_18.png
- www.sg-h####.co.jp/csr/images/sgh_top_19.png
- www.sg-h####.co.jp/csr/images/sgh_top_20.png
- www.sg-h####.co.jp/csr/images/sgh_top_21.png
- www.sg-h####.co.jp/csr/images/sgh_top_22.jpg
- www.sg-h####.co.jp/csr/message/
- www.sg-h####.co.jp/csr/message/images/pct_message01.jpg
- www.sg-h####.co.jp/csr/message/images/pct_message02.jpg
- www.sg-h####.co.jp/csr/message/images/pct_message03.jpg
- www.sg-h####.co.jp/css/print.css
- www.sg-h####.co.jp/css/top.css
- www.sg-h####.co.jp/css/top_rwd.css
- www.sg-h####.co.jp/finance/js/eir/eir.js
- www.sg-h####.co.jp/images/bg_business-info01.png
- www.sg-h####.co.jp/images/bg_business-nav-top.png
- www.sg-h####.co.jp/images/bg_footer-cont01.png
- www.sg-h####.co.jp/images/bnr_athletics.jpg
- www.sg-h####.co.jp/images/bnr_eco.jpg
- www.sg-h####.co.jp/images/bnr_facebook.png
- www.sg-h####.co.jp/images/bnr_isee.jpg
- www.sg-h####.co.jp/images/bnr_museum.jpg
- www.sg-h####.co.jp/images/bnr_park.jpg
- www.sg-h####.co.jp/images/bnr_softball.jpg
- www.sg-h####.co.jp/images/btn_visual-back.png
- www.sg-h####.co.jp/images/btn_visual-next.png
- www.sg-h####.co.jp/images/icn_close.png
- www.sg-h####.co.jp/images/icn_link-none.gif
- www.sg-h####.co.jp/images/pct_about-csr.png
- www.sg-h####.co.jp/images/pct_about-finance.png
- www.sg-h####.co.jp/images/pct_about-recruit.png
- www.sg-h####.co.jp/images/pct_about-sgh.png
- www.sg-h####.co.jp/images/pct_business-delivery.png
- www.sg-h####.co.jp/images/pct_business-etc.png
- www.sg-h####.co.jp/images/pct_business-international.png
- www.sg-h####.co.jp/images/pct_business-logistics.png
- www.sg-h####.co.jp/images/pct_business-motors.png
- www.sg-h####.co.jp/images/pct_business-staff.png
- www.sg-h####.co.jp/images/pct_company-advance.jpg
- www.sg-h####.co.jp/images/pct_company-asset.jpg
- www.sg-h####.co.jp/images/pct_company-expert.jpg
- www.sg-h####.co.jp/images/pct_company-fielder.jpg
- www.sg-h####.co.jp/images/pct_company-financial.jpg
- www.sg-h####.co.jp/images/pct_company-global.jpg
- www.sg-h####.co.jp/images/pct_company-globalj.jpg
- www.sg-h####.co.jp/images/pct_company-humony.jpg
- www.sg-h####.co.jp/images/pct_company-motors.jpg
- www.sg-h####.co.jp/images/pct_company-moving.jpg
- www.sg-h####.co.jp/images/pct_company-nouvelle.jpg
- www.sg-h####.co.jp/images/pct_company-realty.jpg
- www.sg-h####.co.jp/images/pct_company-sagawa-fore.jpg
- www.sg-h####.co.jp/images/pct_company-sagawa.jpg
- www.sg-h####.co.jp/images/pct_company-sgl.jpg
- www.sg-h####.co.jp/images/pct_company-sglp.jpg
- www.sg-h####.co.jp/images/pct_company-supply.jpg
- www.sg-h####.co.jp/images/pct_company-system.jpg
- www.sg-h####.co.jp/images/pct_top-visual01.jpg
- www.sg-h####.co.jp/images/pct_top-visual02.jpg
- www.sg-h####.co.jp/images/ttl_visula01-01.png
- www.sg-h####.co.jp/images/ttl_visula02-01.png
- www.sg-h####.co.jp/images/txt_visula01-01.png
- www.sg-h####.co.jp/js/bizinfo.js
- www.sg-h####.co.jp/js/footernav-sp.js
- www.sg-h####.co.jp/js/skdslider.js
- www.sg-h####.co.jp/matc.js
- www.sg-h####.co.jp/topics/images/list/pct_topics-news180329-2.jpg
- www.sg-h####.co.jp/topics/images/list/pct_topics-news180402-1.jpg
- www.sg-h####.co.jp/topics/images/list/pct_topics-news180403-1.jpg
- www.sg-h####.co.jp/topics/images/list/pct_topics-news180410-1.jpg
- www.sg-h####.co.jp/topics/images/list/pct_topics-news180412-1.jpg
- www.sg-h####.co.jp/topics/images/list/pct_topics-news180417-1.jpg
- www.sg-h####.co.jp/topics/images/list/pct_topics-news180426-1.jpg
- www.sg-h####.co.jp/topics/images/list/pct_topics-news180511-1.jpg
- www.sg-h####.co.jp/topics/xml/data_top.xml
- y####.y####.co.jp/tag?site=####&H=####
Modified file system:
Creates the following files:
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/f_000032
- /data/data/####/f_000033
- /data/data/####/f_000034
- /data/data/####/f_000035
- /data/data/####/f_000036
- /data/data/####/f_000037
- /data/data/####/f_000038
- /data/data/####/f_000039
- /data/data/####/f_00003a
- /data/data/####/f_00003b
- /data/data/####/f_00003c
- /data/data/####/f_00003d
- /data/data/####/f_00003e
- /data/data/####/f_00003f
- /data/data/####/f_000040
- /data/data/####/f_000041
- /data/data/####/f_000042
- /data/data/####/index
- /data/data/####/mybank.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Uses the following algorithms to decrypt data:
- DES
Gains access to telephone information (number, imei, etc.).
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.
Parses information from SMS messages.
Gains access to information about sent/received SMS messages.