Technical information
Malicious functions:
Sends SMS messages:
- 12114: ####A
- 18258878964: ####A
Network activity:
Connecting to:
- s####.####.cn
- 52yi####.com
- a####.####.cn
- iban####.cn
- x####.####.com
HTTP GET requests:
- iban####.cn/uploadfiles/20170118/f5cacf976189474e8cfdaea5c1c0945b167.jpg
- x####.####.com/v/cate02.html
- iban####.cn/uploadfiles/20161214/f7c85ed74a0a46358602e65dfbc5cd20321.jpg
- iban####.cn/js/ajax.js
- iban####.cn/images/default.png
- iban####.cn/css/base.css
- a####.####.cn/uploadfiles/20170301/f180c644d2c44d7594747dc122abbfa8507.jpg
- iban####.cn/uploadfiles/20161214/8ad2662560fa4f31802128146cf7d7a5130.gif
- 52yi####.com/img/0.jpg
- iban####.cn/images/code.png
- iban####.cn/uploadfiles/20161214/a0fe3e920e8b4734a46f0c05047bf2d9284.jpg
- x####.####.com/js/baidu.js
- x####.####.com/getconfig.aspx?
- iban####.cn/uploadfiles/20170118/6df8d607c0f6401486dcb1d8a275f487285.jpg
- a####.####.cn/uploadfiles/20170303/74657b82da0240498a7f27b6997438b4309.jpg
- iban####.cn/uploadfiles/20161214/3fc99876c36147d2b58f9f92ad8d28ef205.jpg
- a####.####.cn/uploadfiles/20161214/350a6ea39c474c2b8d86a7b2b0e8a1a3847.jpg
- 52yi####.com/img/7.jpg
- iban####.cn/images/logo.png
- iban####.cn/images/memu.png
- iban####.cn/images/wode_kouzhan.png
- iban####.cn/css/css.css
- a####.####.cn/uploadfiles/20161214/564f854290e14c3e840178c9de016589487.jpg
- iban####.cn/uploadfiles/20170118/2f87a94a733c4abe9743bdf3aaabe978752.jpg
- 52yi####.com/img/8.jpg
- x####.####.com/v/cate04.html
- 52yi####.com/img/1.jpg
- iban####.cn/uploadfiles/20161214/561456c1dacf4f08b785a54cc8cbef06824.jpg
- iban####.cn/uploadfiles/20161214/46769ccc312f402bab1609a8187bbe01724.jpg
- 52yi####.com/img/9.jpg
- 52yi####.com/img/6.jpg
- iban####.cn/uploadfiles/20161214/c693b12072924e868f2d3385bd40be7c960.jpg
- s####.####.cn/GetFeeData.aspx?iswifi=####
- 52yi####.com/img/2.jpg
- iban####.cn/uploadfiles/20161214/a7d4f9c8d17c4a9bbe904c4498069177708.jpg
- a####.####.cn/uploadfiles/20161214/de268f7d97804527afa425aa9b65486a307.jpg
- x####.####.com/GetFeeDataType.aspx?iswifi=####&typeid=####
- s####.####.cn/versioncheck.aspx?
- a####.####.cn/uploadfiles/20170214/779d130af3d741c7b6e9bd4e0c8e8e7b437.jpg
- iban####.cn/js/slide.js
- iban####.cn/uploadfiles/20161214/e784790b783541a8bb0c4fd990bc7bbd808.jpg
- 52yi####.com/img/3.jpg
- iban####.cn/images/sprite-header.png
- x####.####.com/versioncheck.aspx?
- 52yi####.com/img/5.jpg
- iban####.cn/js/loadImg.js
- 52yi####.com/img/4.jpg
- s####.####.cn/getconfig.aspx?
- iban####.cn/?pno=####
- x####.####.com/v/cate03.html
- x####.####.com/v/css/nav.css
- a####.####.cn/uploadfiles/20170223/177652b7e6704c3f8aeeda422d611c80174.jpg
- x####.####.com/v/css/style.css
Modified file system:
Creates the following files:
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/Android/data/####/cache/uil-images/journal
- /data/data/####/shared_prefs/uw.xml
- /data/data/####/shared_prefs/ui.xml
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/databases/webview.db-journal
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/shared_prefs/ui.xml.bak
- /data/data/####/cache/webviewCacheChromium/index
- /sdcard/Android/data/####/cache/uil-images/journal.tmp
- /data/data/####/shared_prefs/uw.xml.bak
Miscellaneous:
Contains functionality to send SMS messages automatically.
