Technical information
Malicious functions:
Sends SMS messages:
- 12114: HZSY#####
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- mo####.####.com
- dynami####.####.com
- v####.####.cn
- 1####.####.com
- mmy####.####.com
- i####.####.cn
- vide####.####.cn
- priceru####.####.com
HTTP GET requests:
- vide####.####.cn/20170317/aeee849e-596a-4bf9-9fb7-74e49d8bbbe4-ipz00809jp-3.jpg
- 1####.####.com/ic.asp
- mmy####.####.com/mmys-cps/styleTopChlVideo.service?pageNo=####&pageSize=####&showStyle=####&rv=####&deviceId=####&uuid=####&imei=####&imsi=####&manufa...
- vide####.####.cn/tou2159.jpg
- vide####.####.cn/20170320/10f69b7c-ef4f-4015-b029-ed05df897b7d-(ADN-086)%E5%88%97%E8%A1%A81.jpg
- v####.####.cn/20170317/8f38445b-2db0-4257-b70e-653099304a78-303ea310-ed7f-49b4-be91-279595d41465-0201ipz881_0_1_clip.mp4
- mmy####.####.com/mmys-cps/rdContent.service?deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&app...
- i####.####.cn/iplookup/iplookup.php?format=####
- vide####.####.cn/TOUXIANGS31.png
- vide####.####.cn/20170318/e4888508-a8c7-47ae-8d9b-beabdfd47fa7-banner.jpg
- vide####.####.cn/20170317/bf739e2a-c8dc-42ca-b101-b019fd57f9fe-%E4%B8%80%E8%BC%AA%E8%BB%8A%E3%80%81%E5%A9%A6%E8%AD%A6%E3%81%95%E3%82%93.jpg
- vide####.####.cn/tou2131.jpg
- vide####.####.cn/20170224/930bdbb8-dc78-472f-bdb1-8297bddc3181-40.jpg
- vide####.####.cn/20170224/634d493a-b480-46c5-9a42-d08781710a58-41.jpg
- vide####.####.cn/20170317/9f638fff-74b3-41f7-8230-b9b4ef514e6c-%E5%B1%88%E8%BE%B1%E3%81%AE%E5%A4%B1%E7%A6%81.jpg
- mmy####.####.com/mmys-cps/vdtRmdVideoList.service?showStyle=####&id=####&itemCount=####&rv=####&deviceId=####&uuid=####&imei=####&imsi=####&manufactur...
- vide####.####.cn/TOUXIANGS93.png
- vide####.####.cn/20170317/1dc44d36-634e-4e7f-8523-d035a6db86fa-%E6%AF%8D%E3%81%AE%E5%8F%8B%E4%BA%BA.jpg
- vide####.####.cn/TOUXIANGS52.png
- vide####.####.cn/20170317/62911c63-a7b8-4c15-bbae-908df8f834a6-%E7%8C%A5%E8%A4%BB%E3%81%AA%E6%80%A7%E6%AC%B21.jpg
- vide####.####.cn/tou1017.gif
- mmy####.####.com/mmys-cps/videoDtl.service?id=####&rv=####&deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&d...
- vide####.####.cn/20170303/844f2a27-5c70-445a-bdc7-a970854b7080-0201ipz881_0_1%E8%AF%A6%E6%83%85.jpg
- mmy####.####.com/mmys-cps/barrage3.service?videoId=####&deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditc...
- vide####.####.cn/tou2147.jpg
- vide####.####.cn/20170318/60535d10-c921-40ad-a75e-1709acb9a8eb-QQ%E5%9B%BE%E7%89%8720170318114418.jpg
- vide####.####.cn/TOUXIANGS189.png
- mmy####.####.com/mmys-cps/runConfig.service?deviceId=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&appId=####&dc...
- vide####.####.cn/tou2068.jpg
- vide####.####.cn/TOUXIANGS90.png
- mmy####.####.com/mmys-cps/bannerInfo.service?showStyle=####&deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&...
- priceru####.####.com/price-rule-cmp/rule/matchRule?version=####&deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=#...
- vide####.####.cn/20170321/f902a3c8-301f-4937-8b15-582331398642-%E5%88%97%E8%A1%A8.jpg
- vide####.####.cn/20170317/71e2b21e-c2ee-4afc-ac44-b84552f14d0d-%E5%83%95%E3%81%A0%E3%81%91%E3%81%AE%E5%A5%B3%E6%95%99%E5%B8%AB.jpg
- vide####.####.cn/20170317/aa6c2a95-ee12-4034-aa98-5378c30213ce-109cm%E3%81%AEAV%E7%9B%A3%E7%9D%A3%E3%81%AB%E3%81%97%E3%81%8F%E3%82%93%E3%81%A7%E3%81%9...
- mmy####.####.com/mmys-cps/videoComment2.service?videoId=####&deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####...
- vide####.####.cn/20170318/06c74910-1128-4575-9672-3ab8ea9bf53f-oba00312jp-9.jpg
HTTP POST requests:
- mmy####.####.com/mmys-cps/lookVideoStat.service?videoId=####&isRmd=####&deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versi...
- mmy####.####.com/mmys-cps/userVisit.service?deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&app...
- mmy####.####.com/mmys-cps/userActivation.service?deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=###...
- mo####.####.com/mobile-service/getImsiMobilePhone.json
- dynami####.####.com/dynamicpay//getSyFormalChannels.json?
- mmy####.####.com/sdk-update/sdkUpdateCdnUpload.json
Modified file system:
Creates the following files:
- /data/data/####/cache/picasso-cache/935b2ac7769b387ff3c5d33cbf49f15b.1.tmp
- /data/data/####/cache/picasso-cache/50b8a31945033cc4d1a50aa1fe5aaba3.1.tmp
- /data/data/####/cache/picasso-cache/a74f360db680904f1ed3c96d5a210c63.1.tmp
- /data/data/####/cache/picasso-cache/8461fac9e368644986a994537d7524ca.1.tmp
- /data/data/####/cache/picasso-cache/920b26dd8a3529c89ccc50e9bdc687e3.0.tmp
- /data/data/####/cache/picasso-cache/935b2ac7769b387ff3c5d33cbf49f15b.0.tmp
- /data/data/####/databases/google_analytics_v2.db-journal
- /data/data/####/cache/picasso-cache/2bf1406f94836cd19ffdee4c1b30c3e8.1.tmp
- /data/data/####/cache/picasso-cache/a6213fd5faccb13b505167ad47ba38c4.0.tmp
- /data/data/####/shared_prefs/ds_configer.xml
- /data/data/####/cache/picasso-cache/c8f6800f50b1513f4b2385de2b451af0.1
- /data/data/####/cache/picasso-cache/222216c7acd4685869bc5549dd55a44b.1.tmp
- /data/data/####/cache/picasso-cache/b14bdb08771cf1e42c13a6a3f8acdb16.0.tmp
- /data/data/####/cache/picasso-cache/8a1026ebf3381f81a9f91365fd8dd217.0.tmp
- /data/data/####/shared_prefs/time.xml
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/cache/picasso-cache/6134d992660c09eb1c9586ad7a410737.1.tmp
- /data/data/####/cache/picasso-cache/2b95996f0aa036192a3f478621145198.0.tmp
- /data/data/####/cache/picasso-cache/1cae0f1fef5c89dafde58852694b8055.1.tmp
- /data/data/####/shared_prefs/uuid.xml
- /data/data/####/cache/picasso-cache/04031b061d59dd6b595c32d90205f136.0.tmp
- /data/data/####/cache/picasso-cache/2bf1406f94836cd19ffdee4c1b30c3e8.0.tmp
- /data/data/####/cache/picasso-cache/920b26dd8a3529c89ccc50e9bdc687e3.1.tmp
- /data/data/####/cache/picasso-cache/7ee7397be279789853854fefa9c455c7.0.tmp
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/picasso-cache/8a1026ebf3381f81a9f91365fd8dd217.1.tmp
- /data/data/####/cache/picasso-cache/1cae0f1fef5c89dafde58852694b8055.0.tmp
- /data/data/####/cache/picasso-cache/b14bdb08771cf1e42c13a6a3f8acdb16.1.tmp
- /data/data/####/cache/picasso-cache/03fcd9a7d287c7e79539e98b28334a33.1.tmp
- /data/data/####/cache/picasso-cache/ded84a0ddad227f20a5eb6fe8f96498d.1
- /data/data/####/cache/picasso-cache/8461fac9e368644986a994537d7524ca.0.tmp
- /data/data/####/cache/picasso-cache/a6213fd5faccb13b505167ad47ba38c4.1.tmp
- /data/data/####/cache/picasso-cache/a74f360db680904f1ed3c96d5a210c63.0.tmp
- /data/data/####/cache/picasso-cache/c8f6800f50b1513f4b2385de2b451af0.0.tmp
- /data/data/####/cache/picasso-cache/803bad533cfa58028775430aaacc2c74.0.tmp
- /data/data/####/databases/upgrade_app-journal
- /data/data/####/cache/picasso-cache/b18eab9d7eedc2f6dda26ca461d0a15b.0.tmp
- /data/data/####/shared_prefs/free_click_count.xml
- /data/data/####/databases/statistics_db-journal
- /sdcard/SYPAYFILENAME/CACHE/SMSCACHE/ISDELSMS
- /data/data/####/cache/picasso-cache/50b8a31945033cc4d1a50aa1fe5aaba3.0.tmp
- /data/data/####/databases/sy_video_data_cache-journal
- /data/data/####/shared_prefs/p_config.xml
- /data/data/####/cache/picasso-cache/03fcd9a7d287c7e79539e98b28334a33.0.tmp
- /data/data/####/cache/picasso-cache/222216c7acd4685869bc5549dd55a44b.0.tmp
- /data/data/####/cache/picasso-cache/b18eab9d7eedc2f6dda26ca461d0a15b.1.tmp
- /data/data/####/cache/picasso-cache/413822bee7c4c70f8af20ff4d85a2d34.1.tmp
- /data/data/####/files/gaClientId
- /data/data/####/cache/picasso-cache/2933912231905691ba9ff5a9fd0a8bec.0.tmp
- /data/data/####/databases/recommend_app-journal
- /data/data/####/cache/picasso-cache/ded84a0ddad227f20a5eb6fe8f96498d.0.tmp
- /data/data/####/cache/picasso-cache/journal.tmp
- /data/data/####/cache/picasso-cache/697533e7ea5d48fa7ebfeea8a5c88eb7.0.tmp
- /data/data/####/cache/picasso-cache/648b7a2566ac9300131ddd4fd6818fed.0.tmp
- /data/data/####/cache/picasso-cache/697533e7ea5d48fa7ebfeea8a5c88eb7.1.tmp
- /data/data/####/cache/picasso-cache/413822bee7c4c70f8af20ff4d85a2d34.0.tmp
- /data/data/####/cache/picasso-cache/2b95996f0aa036192a3f478621145198.1
- /data/data/####/databases/statistics_db
- /data/data/####/cache/picasso-cache/04031b061d59dd6b595c32d90205f136.1.tmp
- /data/data/####/cache/picasso-cache/803bad533cfa58028775430aaacc2c74.1.tmp
- /data/data/####/cache/picasso-cache/6134d992660c09eb1c9586ad7a410737.0.tmp
- /data/data/####/cache/picasso-cache/60572f3b5bdf54e0e630ff2d9e4767d3.1.tmp
- /data/data/####/cache/picasso-cache/2933912231905691ba9ff5a9fd0a8bec.1.tmp
- /data/data/####/cache/picasso-cache/648b7a2566ac9300131ddd4fd6818fed.1.tmp
- /data/data/####/cache/picasso-cache/7ee7397be279789853854fefa9c455c7.1.tmp
- /data/data/####/cache/picasso-cache/60572f3b5bdf54e0e630ff2d9e4767d3.0.tmp
Miscellaneous:
Contains functionality to send SMS messages automatically.
