Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.1848.origin
Network activity:
Connecting to:
- 1####.####.18
- 1####.####.64
- p####.####.com:13579
- p####.####.com
- and####.####.com
- m####.com
- a####.####.com
HTTP GET requests:
- 1####.####.18/qpay/config.txt
- 1####.####.64/mp/result?queryid=####
HTTP POST requests:
- p####.####.com/SMSpay/api/updateVersion.do
- p####.####.com/api/statis/3ea2abf829442e5968fa8d96dfc3b1513/game-D012C8C...
- m####.com/sdk-selector/sdk/select
- p####.####.com/api/q/a/3ea2abf829442e5968fa8d96dfc3b1513
- p####.####.com:13579/SMSpay/api/updateVersion.do
- a####.####.com/app_logs
- and####.####.com/rqd/async?aid=####
Modified file system:
Creates the following files:
- /data/data/####/baea/tmb.jar
- /data/data/####/databases/cc.db-journal
- /data/data/####/cache/info/dmdata.jar
- /data/data/####/shared_prefs/ma_data.xml
- /data/data/####/databases/ua.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/mj.apk
- /data/data/####/databases/milipay_sms_one.db-journal
- /data/data/####/databases/talkingdata_app.db-journal
- /data/data/####/shared_prefs/edition.xml
- /data/data/####/shared_prefs/b_share.xml
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml
- /data/data/####/shared_prefs/shared_file.xml
- /data/data/####/shared_prefs/new_vvsion.xml
- /data/data/####/shared_prefs/td_pefercen_profile.xml.bak
- /data/data/####/app_crashrecord/1004
- /data/data/####/shared_prefs/nnt_data.xml
- /data/data/####/databases/ua.db-journal
- /data/data/####/files/talkingdata_app_version_preferences_file
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/databases/bugly_db_
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/shared_prefs/wyzf_config.xml
- /data/data/####/files/.imprint
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/databases/bil_db-journal
- /data/data/####/databases/milipay_sms_one.db
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/databases/bugly_db_-journal
- /data/data/####/files/exid.dat
- /data/data/####/shared_prefs/Alvin2.xml
- /sdcard/.tcookieid
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/shared_prefs/3ea2abf829442e5968fa8d96dfc3b1513|account_file.xml
- /data/data/####/files/mj.dex
- /data/data/####/databases/MA_epay_db
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
- /data/data/####/files/talkingdata_app_process_preferences_file
- /data/data/####/shared_prefs/pref_file.xml
- /data/data/####/files/umeng_it.cache
- /data/data/####/databases/bil_db
- /data/data/####/shared_prefs/b_setting.xml
- /data/data/####/files/security_info
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/databases/MA_epay_db-journal
- /data/data/####/shared_prefs/td_pefercen_profile.xml
- /data/data/####/databases/cc.db
- /data/data/####/shared_prefs/ma_call.xml
- /data/data/####/shared_prefs/pref_file.xml.bak
- /data/data/####/files/local_crash_lock
- /data/data/####/files/native_record_lock
- /data/data/####/shared_prefs/crashrecord.xml
- /data/data/####/databases/talkingdata_app.db
- /data/data/####/baea/entrance.jar
Miscellaneous:
Executes next shell scripts:
- getprop
- /system/bin/dexopt --dex 27 83 40 67180 /data/data/####/cache/info/dmdata.jar 1246253838 -112797744 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/
- /system/bin/dexopt --dex 27 79 40 60932 /data/data/####/baea/entrance.jar 1247445111 -2040847232 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 75 40 123764 /data/data/####/files/mj.apk 1225747527 1829278891 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewor
- /system/bin/dexopt --dex 27 79 40 123764 /data/data/####/files/mj.apk 1225747527 1829278891 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewor
- /system/bin/dexopt --dex 27 72 40 123764 /data/data/####/files/mj.apk 1225747527 1829278891 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewor
- /system/bin/dexopt --dex 27 74 40 123764 /data/data/####/files/mj.apk 1225747527 1829278891 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewor
- /system/bin/dexopt --dex 27 76 40 123764 /data/data/####/files/mj.apk 1225747527 1829278891 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewor
- /system/bin/sh -c getprop
- /system/bin/sh -c type su
- /system/bin/dexopt --dex 27 83 40 167700 /data/data/####/baea/tmb.jar 1247445146 -1810655209 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
- /system/bin/dexopt --dex 27 73 40 123764 /data/data/####/files/mj.apk 1225747527 1829278891 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewor
- getprop apps.customerservice.device
- /system/bin/dexopt --dex 27 71 40 123764 /data/data/####/files/mj.apk 1225747527 1829278891 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewor
Contains functionality to send SMS messages automatically.
