Technical information
Malicious functions:
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- s####.####.com
- u####.####.com
- e####.####.com:9090
- i####.####.com
- pl####.####.com
- c####.####.net
- busi####.####.com
- e####.####.com
- toptool####.com
- a####.####.com
HTTP GET requests:
- i####.####.com/public/uploads/store_2/5/a/5/5a54f56c8b8d61aaddf085e9d344985a.png
- i####.####.com/i/rt/mzVersionProtector?c=####&imsi=####&appkey=####&channel_id=####
- e####.####.com/sdkcp/sale_static_newcp.jsp?kehuid=####&chanpid=####&xiangid=####&chuanhao=####&jiqi=####&ruanid=####&Cptime=####
- i####.####.com/public/uploads/store_2/d/0/0/d002afaa3a4b266c2722c3e07fdea61a.jpeg
- i####.####.com/public/uploads/store_2/7/3/5/7350de599bc5df9ea06a5f4af315a6d0.png
- toptool####.com/cgi-bin-py/mobovee_cb.cgi?sv=####&pr=####&hp=####&hv=####&g=####&l=####&c=####
- i####.####.com/i/sdk?code=####
- u####.####.com/index.php/OfferList/getOfferListNew?start=####&limit=####&picsize=####&minsdk=####&uuid=####&aaid=####&adid=####&product=####&sub_produ...
- u####.####.com/setting/mbr?p=####&hp=####&l=####&c=####&prod=####&svn=####
- i####.####.com/downfiles/sdk/MaiziPayPlug.47.apk
- i####.####.com/public/uploads/store_4/7/0/1/7016a1992e5ca0484354155574b36d1e.png
- i####.####.com/public/uploads/store_3/2/d/9/2d94fd5001ca5a656a06950bcaaee3fd.jpeg
- e####.####.com/wapbill/Allfeecnf.jsp?kehuid=####&chanpid=####&mcc=####&plmn=####&xiangid=####&vid=####&ruanid=####&chuanhao=####
- i####.####.com/public/uploads/store_3/b/8/8/b88ef5afcd86a898d18b9c45333b00eb.png
- i####.####.com/public/uploads/store_2/f/8/d/f8dd1bcebe213e6447c6f5db48cd3f7a.png
- e####.####.com/sdkcp/user_visit_appcp.jsp?kehuid=####&chanpid=####&xiangid=####&chuanhao=####&jiqi=####&ruanid=####&Cptime=####
- e####.####.com:9090/wapbill/Allfeecnf.jsp?kehuid=####&chanpid=####&mcc=####&plmn=####&xiangid=####&vid=####&ruanid=####&chuanhao=####
- i####.####.com/i/paycache?imsi1=####&imsi2=####&appkey=####&channel_id=####
- u####.####.com/setting/grobal_strategy?p=com.a####
HTTP POST requests:
- c####.####.net/config/update
- i####.####.com/i/login
- s####.####.com/pkl16.html
- c####.####.net/dc/sync_adr
- pl####.####.com/ad.php
- a####.####.com/ad-service/ad/mark
- s####.####.com/cgi-bin-py/ad_sdk.cgi?ty=####&enc=####&bt=####
- busi####.####.com/business/impression
Modified file system:
Creates the following files:
- /data/data/####/files/.jiagu.lock
- /data/data/####/files/mzp.cache.tmp
- /data/data/####/shared_prefs/apsad.xml
- /sdcard/sys909/sys92299
- /data/data/####/shared_prefs/myActivityName.xml
- /data/data/####/shared_prefs/apsad.xml.bak
- /sdcard/.androidsystem/.files/files.db
- /data/data/####/files/.jglogs/.log3
- /sdcard/baidu/AndroidStore/http_cache/journal
- /sdcard/.androidsystem/7989df351630ea43cb0dec5c40e1b522.jpg
- /sdcard/.androidsystem/.files/gads.db
- /sdcard/.androidsystem/3ab79d953233f6ae2b56df28f87ad9b3.jpg
- /data/data/####/files/wechate.apk
- /data/data/####/files/aps.db
- /sdcard/baidu/.cuid
- /data/data/####/shared_prefs/SharePreferences.xml
- /data/data/####/shared_prefs/intcontrol.xml
- /data/data/####/shared_prefs/AdsBusiness-data.xml
- /data/data/####/shared_prefs/jg_app_update_settings_random.xml
- /sdcard/.androidsystem/7e7218ca25603b5a7f125bbdc0e7c926.jpg
- /data/data/####/files/mzp.cache
- /sdcard/sys909/sys94299
- /data/data/####/files/flag_file1
- /data/data/####/shared_prefs/dc.9C6A3E57CCF5CDA75D8BF5150E5D9610.preferences.xml.bak
- /data/data/####/files/.jglogs/.jg.ri
- /data/data/####/files/libjiagu.so
- /data/data/####/databases/pg.db
- /data/data/####/files/MaiziPayPlug.apk
- /data/data/####/databases/dataeye_database_9C6A3E57CCF5CDA75D8BF5150E5D9610.db
- /data/data/####/app_libs/libMaizi.so
- /data/data/####/files/.jglogs/.jg.ac
- /data/data/####/app_bin/daemon
- /sdcard/baidu/AndroidStore/http_cache/journal.tmp
- /data/data/####/shared_prefs/CUID.xml
- /data/data/####/databases/pg.db-journal
- /data/data/####/files/MaiziPayPlug.apk.tmp
- /sdcard/.SystemService/9C6A3E57CCF5CDA75D8BF5150E5D9610/uid
- /data/data/####/databases/dataeye_database_9C6A3E57CCF5CDA75D8BF5150E5D9610.db-journal
- /sdcard/.androidsystem/daafb4f13066aaacdc7748bc2eab0119.jpg
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/databases/MZData.db
- /sdcard/.androidsystem/7603dc32ae742ecc9e41682d64f79af9.jpg
- /sdcard/.androidsystem/efab8b6540ba0e3a40f59efe1263eb4b.jpg
- /data/data/####/app_dex/MaiziPayPlug.dex
- /sdcard/.androidsystem/23cf97bcd30b0e368db3581dacb40c8a.jpg
- /data/data/####/databases/Data.db-journal
- /data/data/####/databases/adblib.db-journal
- /data/data/####/shared_prefs/dc.9C6A3E57CCF5CDA75D8BF5150E5D9610.preferences.xml
- /data/data/####/shared_prefs/aps.xml
- /data/data/####/databases/MZData.db-journal
- /data/data/####/databases/Data.db
Sets the 'executable' attribute to the following files:
- /data/data/####/app_bin/daemon
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh
- su
Uses elevated priveleges.
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
