Technical information
Malicious functions:
Sends SMS:
- 18974129280: E226FDED3236E6FEF69CE768308221AFB5
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) weib####.g####.sina####.com:80
- TCP(HTTP/1.1) st####.guoj####.tv.####.com:80
- TCP(HTTP/1.1) api.h####.cn:81
- TCP(TLS/1.0) i.l####.net:443
- TCP(TLS/1.0) 2####.58.212.206:443
- TCP(TLS/1.0) weib####.g####.sina####.com:443
DNS requests:
- api.h####.cn
- i.l####.net
- st####.guoj####.tv
- ws1.sin####.cn
- ww1.sin####.cn
- ww3.sin####.cn
- ww4.sin####.cn
- wx1.sin####.cn
- wx2.sin####.cn
- wx3.sin####.cn
- wx4.sin####.cn
HTTP GET requests:
- api.h####.cn:81/mf/json.txt
- api.h####.cn:81/mf/jsonxingguang.txt
- st####.guoj####.tv.####.com/app/upload/2018_10_26/dc33556150cbf869a91c5f...
- st####.guoj####.tv.####.com/app/upload/2018_11_19/23025e7d1b2be1940b2bfe...
- st####.guoj####.tv.####.com/app/upload/2018_11_23/460e652a1ecc9b9a24a34c...
- st####.guoj####.tv.####.com/app/upload/2018_11_29/a289c7b36d62c39e359b2b...
- st####.guoj####.tv.####.com/app/upload/2018_12_16/2ed9dab4cf14dd9050bccd...
- st####.guoj####.tv.####.com/app/upload/2018_12_17/e4e2903667294cc8073a3f...
- st####.guoj####.tv.####.com/app/upload/2018_12_18/8894e328046cbb273b01a2...
- st####.guoj####.tv.####.com/app/upload/2018_12_19/4a0b7640b0d244c46e6f81...
- st####.guoj####.tv.####.com/app/upload/2018_12_25/92d949a3fca0ef57205d4b...
- st####.guoj####.tv.####.com/app/upload/2018_12_27/0c1715cff596274d8c928b...
- st####.guoj####.tv.####.com/app/upload/2018_12_27/a77ca3c17661a2564a28ce...
- st####.guoj####.tv.####.com/app/upload/2018_12_28/18da005dc3873fa798c087...
- st####.guoj####.tv.####.com/app/upload/2018_12_30/4a7c37e59eabc48c234f81...
- st####.guoj####.tv.####.com/app/upload/2018_12_31/8e83e63a9871af80496566...
- st####.guoj####.tv.####.com/app/upload/2019_01_01/ad4e3d05606e6926825aea...
- st####.guoj####.tv.####.com/app/upload/2019_01_01/ef96dce5a075e01594e296...
- st####.guoj####.tv.####.com/app/upload/2019_01_02/6bfd1d9d8a4d7717925c08...
- st####.guoj####.tv.####.com/app/upload/2019_01_03/e2429a9cfe606dd70af37c...
- weib####.g####.sina####.com/large/87c01ec7gy1fqi47x1heoj2020020748.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fqi4cgzdv6j2020020q2v.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1frc0qchto4j20e80e9wgd.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fs2fvatvwwj203c03cmxk.jpg
- weib####.g####.sina####.com/large/87c01ec7gy1fsyulcw2g9j204602waa4.jpg
- weib####.g####.sina####.com/large/87c01ec7ly1fr5d5uty0mj2046046t95.jpg
- weib####.g####.sina####.com/large/87c01ec7ly1fr5dlbjj3xj204501u0sl.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fu14duxmp6j303y03f745.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fucp4kz968j303c03caab.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fucpl34v35j30500503zi.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fupe5f1jjtj304103owee.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fvjduokhnlj3050050dfv.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fvjxt5tz3ij30a007imx6.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fw7u4v52woj304m04cjs9.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fw834mqtmbj30sg0sgjut.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwmqgltbsqj30e80e8wg0.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwmqmf39xqj30sg0sgwij.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwmqo8bw08j30sg0sgn0s.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwmqq9l066j304p04jt8u.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwmqsluhscj304q04qt8o.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwmqvf02ijj30sg0sgwib.jpg
- weib####.g####.sina####.com/mw690/0060lm7Tly1fwvecxt5ywj307s08040d.jpg
File system changes:
Creates the following files:
- /data/data/####/ck732093061.xml
- /data/data/####/com.e4a.runtime.android.mainActivity.xml
- /data/media/####/.nomedia
- /data/media/####/1cl88ix89sr0jntgbfsil2h41.tmp
- /data/media/####/1sep4i9glsgldgrt4gcx1votb.tmp
- /data/media/####/1snu10sam4kf49i3931mo6bxd.tmp
- /data/media/####/25h4n50earfwvjqi5avco56ma.tmp
- /data/media/####/2fupb4gc1mtkfs6fdszpyq5k4.tmp
- /data/media/####/2hn9nns809bdamtymf3915ykq.tmp
- /data/media/####/2k0jy0hqyb4rnq2a6bcxz5cy1.tmp
- /data/media/####/2nxwhirudugp3ke15h583to3w.tmp
- /data/media/####/2r2d0pfq4et7ufj9ibcvvh4zi.tmp
- /data/media/####/2s0t5xh9kons5yl5a34v0vfz4.tmp
- /data/media/####/2uo8kx8w1cssbzyim3tunxp95.tmp
- /data/media/####/2uysm33wtldgsse26gnroq6t6.tmp
- /data/media/####/33wdcvqobu1fdw87gvb77oasg.tmp
- /data/media/####/3bw84n3ym7uom8r3wcmlt9ijh.tmp
- /data/media/####/3gcmhblizf16o4lhdmqymd5uw.tmp
- /data/media/####/4dijg7n14532g4izd4sh8af6k.tmp
- /data/media/####/4ee2qph37z5n2pq44lqo53u3d.tmp
- /data/media/####/4expzjnjzipydg57k17itb3y6.tmp
- /data/media/####/4i9v276wo7v5w2u5ijzu8re0g.tmp
- /data/media/####/4kv9wkr7so9m88qzfknuradrj.tmp
- /data/media/####/4la2fipr5ra2uliyhtx83pm3i.tmp
- /data/media/####/4m9acz5hfe1nbcwgrpsycgghv.tmp
- /data/media/####/4n0ilzgyjkp53pc872sjz9sb2.tmp
- /data/media/####/4st3zk7w767ov85q4dbapwj0m.tmp
- /data/media/####/4tw3quo50gdo2ngf6ka1yl077.tmp
- /data/media/####/4u0t98cec6u7ii6yasjw8bwp4.tmp
- /data/media/####/4uoo55m015mfjzbde534trk6w.tmp
- /data/media/####/4uwlorbyhd8imv84uejm6mbik.tmp
- /data/media/####/50a5gk16uobtw7v1iyllciof6.tmp
- /data/media/####/5a41tzce70m21v7k0f0axmcv3.tmp
- /data/media/####/5fbzrmafpn7dfesq0cs303rx.tmp
- /data/media/####/5gg8ywflsau0isbkw35wv8g3e.tmp
- /data/media/####/5gqful2ihocjdoojx03n3k4n2.tmp
- /data/media/####/60r57t7gcwaossc7zkcwbl1tu.tmp
- /data/media/####/6cvlbi7g2y65cpvzn1vru9i8s.tmp
- /data/media/####/6cyccn4xhulanv2pcpdkx8sxr.tmp
- /data/media/####/6ykmcblo57d98p00rgnoyohr8.tmp
- /data/media/####/765pkhoxbdlbxahhquy3yqpxo.tmp
- /data/media/####/7f96e73m3oy7ns3tpw0btrir1.tmp
- /data/media/####/7iz2xu26xrkjqp5rzd893tupr.tmp
- /data/media/####/7j64vc3ptsnrk8tmn2suh768p.tmp
- /data/media/####/h8wks0far58cz12ay2944k0n.tmp
- /data/media/####/i10x7jgkb0sb0l73smgbdp3t.tmp
- /data/media/####/i155mzhqwpdtqdrzm0yzabi4.tmp
- /data/media/####/kuf567khmwaqtxt3b00k16x.tmp
- /data/media/####/zadsb29ibzoik2gniiiqds2d.tmp
- /data/media/####/zpgtrfsz7z5c43wdlmltjrh5.tmp
Miscellaneous:
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Parses information from SMS.
Gets information about sent/received SMS.