Technical information
Malicious functions:
Sends SMS messages:
- 106904006189121: myqxt####
- 12114000372329: i2mPNk1AOWWu6IO69LttHIXkg==
- 12114000372329: 0#7f22oh
- 12114: yzw#####A
Executes code of the following detected threats:
- Android.SmsSend.17878
- Android.SmsSend.17837
- Android.Triada.248.origin
- Android.Backdoor.285.origin
- Android.DownLoader.441.origin
- Android.SmsSend.777.origin
- Android.Triada.226.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.285.origin
Network activity:
Connecting to:
- pus####.####.cn
- ut####.cn
- 1####.####.27:8087
- i####.####.com
- 2####.####.31
- s####.####.cn
- 1####.####.111:8001
- 1####.####.111
- s####.####.com
- 6####.####.140
- p####.####.com:7820
- pass####.####.cn
- d####.####.com
- a####.####.com:8088
- d####.####.com:8080
- do####.####.info:8010
- p####.####.com
- do####.####.info
- ut####.cn:8080
- a####.####.com
HTTP GET requests:
- pus####.####.cn/upfile/v1/2017-02-10c8c472e9-ab9d-4e3b-9ef3-dc54a2e26853...
- pus####.####.cn/upfile/v1/2017-02-10f0a86a4e-f300-48aa-ae2e-90994f193eff...
- 1####.####.27:8087/Larva-inf/charge?body=####&sign=####
- pus####.####.cn/upfile/v1/2017-02-091570b9d3-5442-4c51-89b2-ad4ceadf7165...
- pus####.####.cn/upfile/v1/2017-02-097779ce00-4452-4ea6-906b-7568253d6049...
- s####.####.com/versioncheck.aspx?
- p####.####.com/?igtcmd=####&nativePayCmd=####
- s####.####.cn/getconfig.aspx?
- pus####.####.cn/upfile/v1/2017-02-103bc32c26-5e94-48a9-9fa1-79e986a73358...
- s####.####.cn/versioncheck.aspx?
- i####.####.com/ando-res/ads/4/5/d73ab4a4-4c75-43a7-a3c9-5bdabd9437c8/c21...
- pass####.####.cn/client/authRequest
- a####.####.com:8088/earth/enable?deviceid=####&version=####&imsi=####
- d####.####.com/upload/plugin/net.tt.plugin.damai_p20170412100432
- pus####.####.cn/upfile/v1/2017-02-09fcc1cb82-f18c-4bf9-ac6b-2b167ddf82fe...
- i####.####.com/ando-res/m/4HjBJu51SRZ6w2qcEzn09SbmXnxQ8vbP2y*I88C1gtWjo-...
- 1####.####.111:8001/APP/AppTask.aspx
- s####.####.com/GetFeeData.aspx?iswifi=####
- pus####.####.cn/upfile/v1/2017-02-09143ccc4c-66da-4d20-bc3c-0e539c9b359d...
- pus####.####.cn/upfile/v1/2017-02-0929c7de1a-d3a3-42c2-b237-046d5df8a7e7...
- 2####.####.31/dl01.toucht.net/update/plugin-release-v4.9.3.zip?wsiphost=...
- 1####.####.111/APP/GetFeePoint.aspx
- d####.####.com/upload/video/cmd0_jqyy2.json
- s####.####.com/getconfig.aspx?
- p####.####.com/?igtcmd%####
- p####.####.com/openplg?appid=####&channelid=####
- s####.####.cn/GetFeeData.aspx?iswifi=####
- d####.####.com/upload/plugin/net.tt.pluginruixun.ruixun_p20170414144856
- pus####.####.cn/upfile/v1/2017-02-1080430a48-f898-40d0-855e-b506e2f9ee8e...
- d####.####.com/upload/plugin/net.tt.plugin.yuanyu_p20170411110136
- pus####.####.cn/upfile/v1/2017-02-093e7ae36c-a608-4af6-a81c-1380ec3936f9...
- d####.####.com/update/plugin-release-v4.9.3.zip
- d####.####.com/upload/video/cmd2_cid548_iv1.json
- d####.####.com/upload/video/cmd2_cid547_iv1.json
- d####.####.com/upload/plugin/net.tt.plugin.shangan_p20170401110757
- p####.####.com/?igtcmd=####&nativePayCmd=####&iccid=####&price=####&imsi...
- d####.####.com/upload/video/cmd1_jqyy2.json
- p####.####.com/openicon?appid=####&channelid=####
- p####.####.com/?igtcmd=####&order=####&state=####&paymsg=####&fingerprin...
- p####.####.com/?igtcmd=####&nativePayCmd=####&imsi=####&sdk=####&payorde...
- d####.####.com:8080/upload/plugin/net.tt.plugin.mysdk_p20170421165854
- pus####.####.cn/upfile/v1/2017-02-094a88162d-bb7d-4928-a9bb-e6811ebf8035...
- d####.####.com/upload/images/??????.####
- d####.####.com/upload/plugin/net.tt.plugin.myadv_p20170309134229
- p####.####.com/?igtcmd=####&iccid=####&imsi=####&imei=####&order=####&um...
HTTP POST requests:
- ut####.cn:8080/excalibur/avalon/sdk/pay.aspx
- p####.####.com/
- ut####.cn/excalibur/avalon/sdk/queryResult.aspx
- 6####.####.140/ando/x/liv?app_id=####&r=####
- 6####.####.140/ando/x/lis?app_id=####&r=####
- p####.####.com:7820/
- do####.####.info:8010/
- ut####.cn/excalibur/avalon/sdk/init.aspx
- a####.####.com/app_logs
- 6####.####.140/ando/x/req?app_id=####&r=####
- do####.####.info/
Modified file system:
Creates the following files:
- /data/data/####/files/net.tt.plugin.yufeng.apk
- /data/data/####/Plugin/net.tt.plugin.damai/apk/base-1.apk
- /data/data/####/files/second.dat
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/.config
- /data/data/####/Plugin/net.tt.plugin.damai/Signature/Signature_0.key
- /data/data/####/files/11DA1F7648D03AC3AE358BF5EDB18850
- /data/data/####/Plugin/net.tt.plugin.mysdk/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.pluginruixun.ruixun
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/zip/790079ef-c0e6-4767-8c2c-ed9fc893db53.zip
- /data/data/####/files/33B1E5FCAE27866FBF51C26D1C5C41C4
- /data/data/####/files/BAB49E8DC5946CE2EF89D2B9D7E589DD
- /data/data/####/Plugin/net.tt.plugin.shangan/apk/base-1.apk
- /data/data/####/files/net.tt.plugin.damai
- /data/data/####/files/splash.dat
- /data/data/####/Plugin/net.tt.plugin.zhongzhi/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.shangan/dalvik-cache/base-1.dex
- /data/data/####/files/714D9B0578DD0A28AE47D3FE4D72DA4E
- /data/data/####/Plugin/net.tt.plugin.myadv/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.mysdk.apk
- /data/data/####/files/net.tt.pluginruixun.ruixun.apk
- /data/data/####/files/mobclick_agent_cached_####
- /data/data/####/Plugin/net.tt.plugin.zhongzhi/dalvik-cache/base-1.dex
- /data/data/####/files/F9F403EBE5178FC5E656099C6791F81F
- /data/data/####/files/net.tt.plugin.yuanyu.apk
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /sdcard/.env/.uunique.new
- /data/data/####/Plugin/net.tt.plugin.shangan/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.myadv/apk/base-1.apk
- /data/data/####/files/ad_svip_head.dat
- /data/data/####/Plugin/net.tt.plugin.yufeng/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.yuanyu
- /data/data/####/Plugin/net.tt.plugin.myadv/Signature/Signature_0.key
- /data/data/####/files/C4BD1BDE63008246BEEEF35AA361183E
- /data/data/####/Plugin/net.tt.plugin.yuanyu/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.yufeng/apk/base-1.apk
- /data/data/####/shared_prefs/ShareFiles.xml
- /data/data/####/files/net.tt.plugin.shangan.apk
- /data/data/####/Plugin/net.tt.plugin.taiku/apk/base-1.apk
- /data/data/####/files/net.tt.plugin.shangan
- /data/data/####/databases/trinea_android_common.db-journal
- /data/data/####/Plugin/net.tt.plugin.taiku/dalvik-cache/base-1.dex
- /sdcard/.armsd/alLbon3AuQynvtpS/LjTgA0CXsj1TE390/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- /sdcard/.armsd/alLbon3AuQynvtpS/r_pkDgN4OhnkSa0D
- /data/data/####/shared_prefs/game_state_file.xml
- /sdcard/com.zckj.files/u.apk
- /data/data/####/Plugin/net.tt.plugin.mysdk/Signature/Signature_0.key
- /sdcard/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- /data/data/####/files/net.tt.plugin.mysdk
- /data/data/####/files/ad_head.dat
- /data/data/####/files/net.tt.plugin.taiku.apk
- /data/data/####/files/64E41E5BF68EDDAC888D064A9EB8E7E8
- /data/data/####/shared_prefs/third_info.xml
- /data/data/####/Plugin/net.tt.plugin.damai/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.myadv.apk
- /data/data/####/files/ad_head_duandai.dat
- /data/data/####/files/043f334c7f494be53a0fd5e6e0af9bca.apk
- /data/data/####/Plugin/net.tt.plugin.yuanyu/dalvik-cache/base-1.dex
- /sdcard/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- /data/data/####/Plugin/net.tt.plugin.taiku/Signature/Signature_0.key
- /data/data/####/files/net.tt.plugin.myadv
- /sdcard/.armsd/alLbon3AuQynvtpS/MP8MtaBuguN9jnuSwtN1kQ==
- /data/data/####/Plugin/net.tt.plugin.yuanyu/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.pluginruixun.ruixun/apk/base-1.apk
- /data/data/####/Plugin/net.tt.pluginruixun.ruixun/dalvik-cache/base-1.dex
- /data/data/####/files/51E9E964A8F3A0C2AD33EF964890998E
- /data/data/####/files/net.tt.plugin.zhongzhi.apk
- /data/data/####/Plugin/net.tt.plugin.yufeng/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.mysdk/apk/base-1.apk
- /data/data/####/files/net.tt.plugin.damai.apk
- /data/data/####/shared_prefs/userinfo_file.xml
- /data/data/####/Plugin/net.tt.plugin.zhongzhi/Signature/Signature_0.key
- /data/data/####/files/669326685F6935725DBE1D729AC7E9E1
- /data/data/####/Plugin/net.tt.pluginruixun.ruixun/Signature/Signature_0.key
Miscellaneous:
Executes next shell scripts:
- getprop apps.customerservice.device
- /data/data/####/Plugin/net.tt.plugin.yuanyu/data/net.tt.plugin.yuanyu/code-2057478/I7J9793RJmOXvG7K -p net.tt.plugin.yuanyu -c com.zpbd.hzla.vvuvvg.a.a.c.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkj
- chmod -R 755 /data/data/####/Plugin
Contains functionality to send SMS messages automatically.
