Technical information
Malicious functions:
Sends SMS messages:
- 17386034522: user:d375082240
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) m.5####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) m.l####.com:80
- TCP(HTTP/1.1) api.6####.com:80
- TCP(HTTP/1.1) h5.6####.com:80
- TCP(HTTP/1.1) api.c####.q####.com:80
- TCP(HTTP/1.1) pic.6####.com:80
DNS requests:
- api.6####.com
- api.c####.q####.com
- g####.c####.q####.com
- h5.6####.com
- l####.tbs.qq.com
- m.5####.com
- m.l####.com
- mt####.go####.com
- pic.6####.com
HTTP GET requests:
- h5.6####.com/Public/H5/js/h5-sdk.js
- m.l####.com/Public/jssdk/js/paysdk.js?v=####
- pic.6####.com/Upload/Company/2017-06-30/5955aba2b71e7.jpg
- pic.6####.com/Upload/Picture/2016-11-28/583ba7010d5e5.jpg
- pic.6####.com/Upload/Picture/2016-11-28/583ba7010d780.jpg
- pic.6####.com/Upload/Picture/2017-05-23/59239ac7a5320.png
- pic.6####.com/Upload/Picture/2017-05-23/59239ac7a5518.png
- pic.6####.com/Upload/Picture/2017-05-23/59239ac7a5660.png
HTTP POST requests:
- api.c####.q####.com/api/getServerList.php
- api.c####.q####.com/api/getVersion.php
- api.c####.q####.com/api/login.php
- l####.tbs.qq.com/ajax?c=####&k=####
Modified file system:
Creates the following files:
- <Package Folder>/app_tbs/####/core_info
- <Package Folder>/app_tbs/####/debug.conf
- <Package Folder>/app_tbs/####/tbscoreinstall.txt
- <Package Folder>/app_tbs/####/tbslock.txt
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/userlogin.db
- <Package Folder>/databases/userlogin.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/mobclick_agent_cached_<Package>1
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/tbs_download_config.xml
- <Package Folder>/shared_prefs/tbs_download_config.xml.bak
- <Package Folder>/shared_prefs/tbs_download_stat.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/6071Game/####/082b80260f4f7bdc8666f8a40f996620.0.tmp
- <SD-Card>/6071Game/####/082b80260f4f7bdc8666f8a40f996620.1.tmp
- <SD-Card>/6071Game/####/1f828984534d50952d4ce80a5a686689.0.tmp
- <SD-Card>/6071Game/####/1f828984534d50952d4ce80a5a686689.1.tmp
- <SD-Card>/6071Game/####/3f9bcff9f8562792fc913567eadd2c47.0.tmp
- <SD-Card>/6071Game/####/3f9bcff9f8562792fc913567eadd2c47.1.tmp
- <SD-Card>/6071Game/####/7097006c803fd812750873a7e2fe0beb.0.tmp
- <SD-Card>/6071Game/####/7097006c803fd812750873a7e2fe0beb.1.tmp
- <SD-Card>/6071Game/####/d09aaa7e6e99f8a9b15e673e80d20272.0.tmp
- <SD-Card>/6071Game/####/d09aaa7e6e99f8a9b15e673e80d20272.1.tmp
- <SD-Card>/6071Game/####/d5d95361204faeb8f5f11f4a66ba1b9b.0.tmp
- <SD-Card>/6071Game/####/d5d95361204faeb8f5f11f4a66ba1b9b.1.tmp
- <SD-Card>/6071Game/####/e9e242fa78f05709d33249d00d3aed8f.0.tmp
- <SD-Card>/6071Game/####/e9e242fa78f05709d33249d00d3aed8f.1.tmp
- <SD-Card>/6071Game/####/journal.tmp
- <SD-Card>/6071Game/1dc8b06a0b1b6cbdf3713727f1a0c968
- <SD-Card>/6071Game/3275562a8bf1dc25b615b5166e58ebc3
- <SD-Card>/6071Game/4a5cbbe6b983d2dbe18d81177aeef452
- <SD-Card>/6071Game/59eaceb6ccc24d8db1e1b4efc1831615
- <SD-Card>/6071Game/764ca454d5e96c1a4a8e44cef4e726c5
- <SD-Card>/6071Game/cb32bc13672ad642a5e0a5a3905b2a8d
- <SD-Card>/6071Game/d31110e0f68b77b8a688dc90e55c1ff1
- <SD-Card>/6071Game/e75bef097fa760b582cab2322491bb1d
- <SD-Card>/6071GameBox2SDK/516A6A458AE739E21C6158788183659F
- <SD-Card>/Android/####/tbslog.txt
Miscellaneous:
Executes next shell scripts:
- getprop ro.product.cpu.abi
Loads the following dynamic libraries:
- fyae
Uses the following algorithms to encrypt data:
- RSA-ECB-NoPadding
- RSA-ECB-PKCS1Padding
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
