Technical information
Malicious functions:
Sends SMS messages:
- 12114: dyl#####,####,6000076-1-1-rxun_rlys_1-2
- 10658000: CJTX
- 106904006189121: myqxt####
- 106575206321505460: dyl#####,####,6000076-1-1-rxun_rlys_1-2
Executes code of the following detected threats:
- Android.SmsSend.11446
- Android.SmsSpy.527.origin
- Android.Triada.155.origin
- Android.Backdoor.285.origin
- Android.DownLoader.441.origin
- Android.SmsSend.1848.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.285.origin
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- huangda####.com
- pus####.####.cn
- 1####.####.111
- page####.####.info
- p####.####.com
- p####.####.com:7820
- do####.####.info:8010
- d####.####.net
- do####.####.info
- 1####.####.111:8001
- page####.####.info:8088
- a####.####.com
HTTP GET requests:
- d####.####.net/update/plugin-release-v4.9.3.zip
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=####&type=####&system=####&simid=####&v=####&smsc=####&et=####&imsi=####&imei=...
- 1####.####.111:8001/GetMobile/MatchingMobile.aspx?IMSI=####&IMEI=####&TimeStamp=####&ChannelId=####&Sign=####
- pus####.####.cn/czfiles/shangan-2017-51016-old5
- page####.####.info:8088/earth/enable?deviceid=####&version=####&imsi=####
- page####.####.info/earth/video/needshow2?channel=####
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&simid=####&v=####&smsc=####&et=####&imsi=####&imei=####
- p####.####.com/?igtcmd=####&order=####&state=####&paymsg=####&fingerprint=####
- p####.####.com/?igtcmd=####&nativePayCmd=####
- pus####.####.cn/czfiles/youtou-2017
- pus####.####.cn/czfiles/myadv-2017
- p####.####.com/?igtcmd=####&nativePayCmd=####&iccid=####&imsi=####&imei=####&sdk=####&price=####&payorder=####&umeng=####&msg=####
- 1####.####.111/GetMobile/MatchingMobile.aspx?IMSI=####&IMEI=####&TimeStamp=####&ChannelId=####&Sign=####
- huangda####.com/resource!chargeUpdate?resTypes=####&dexId=####&dexVer=####&appid=####&appVer=####&channel=####
- pus####.####.cn/czfiles/mysdk1701221750
- p####.####.com:7820/?igtcmd=####&gameid=####
HTTP POST requests:
- huangda####.com/shop/shop_upload_log
- p####.####.com/
- do####.####.info:8010/
- a####.####.com/app_logs
- do####.####.info/
Modified file system:
Creates the following files:
- /sdcard/com.zckj.files/net.tt.plugin.myadv
- /data/data/####/Plugin/net.tt.jqyy/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.shangan.apk
- /sdcard/com.zckj.files/net.tt.plugin.shangan
- /data/data/####/files/net.tt.plugin.mysdk.apk
- /data/data/####/Plugin/net.tt.plugin.mysdk/dalvik-cache/base-1.dex
- /data/data/####/Plugin/net.tt.plugin.yingmei/Signature/Signature_0.key
- /data/data/####/files/net.tt.plugin.pingzhi.apk
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/.config
- /data/data/####/Plugin/net.tt.plugin.shangan/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.myadv/dalvik-cache/base-1.dex
- /data/data/####/Plugin/net.tt.plugin.shangan/dalvik-cache/base-1.dex
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/zip/a929a25e-4c84-44ba-b90b-9e02de473079.zip
- /data/data/####/Plugin/net.tt.plugin.utadv/dalvik-cache/base-1.dex
- /sdcard/com.zckj.files/net.tt.plugin.utadv
- /sdcard/com.zckj.files/net.tt.jqyy
- /data/data/####/Plugin/net.tt.plugin.yingmei/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.utadv/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.pingzhi/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.myadv/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.myadv/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.jqyy/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.yingmei/dalvik-cache/base-1.dex
- /sdcard/.twservice/qshp_3003_2234/tw
- /data/data/####/Plugin/net.tt.plugin.taiku/apk/base-1.apk
- /data/data/####/files/net.tt.plugin.yingmei.apk
- /data/data/####/Plugin/net.tt.plugin.pingzhi/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.taiku/dalvik-cache/base-1.dex
- /sdcard/.tpservice/net.tt.plugin.taiku/download/jar/qsha_80001_5091.jar
- /data/data/####/Plugin/net.tt.plugin.pingzhi/dalvik-cache/base-1.dex
- /data/data/####/Plugin/net.tt.jqyy/Signature/Signature_0.key
- /sdcard/.twservice/qshp_3003_2234.zip
- /sdcard/com.zckj.files/u.apk
- /data/data/####/Plugin/net.tt.plugin.mysdk/Signature/Signature_0.key
- /data/data/####/files/net.tt.plugin.utadv.apk
- /data/data/####/files/net.tt.plugin.taiku.apk
- /data/data/####/shared_prefs/info.xml
- /data/data/####/files/net.tt.plugin.myadv.apk
- /data/data/####/Plugin/net.tt.plugin.taiku/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.utadv/apk/base-1.apk
- /sdcard/com.zckj.files/0bdbb2c325525e986d55ef50ca66d056
- /data/data/####/Plugin/net.tt.plugin.mysdk/apk/base-1.apk
- /sdcard/com.zckj.files/net.tt.plugin.mysdk
- /data/data/####/Plugin/net.tt.plugin.shangan/apk/base-1.apk
Sets the 'executable' attribute to the following files:
- /data/data/####/Plugin/net.tt.jqyy/apk/base-1.apk
Miscellaneous:
Contains functionality to send SMS messages automatically.
