Technical information
Malicious functions:
Sends SMS messages:
- 15508294202: eyJmYWN0b3J5IjoibW0iLCJtb2RlbCI6Im1tMTcwNTAyMDEiLCJpbXNpIjoiMjUwMDI2Njk5MTg3 NzQzIiwic3lzIjowLCJpbWVpIjoiMzU2NTA3MDU5MzUxODk1In0=
Network activity:
Connecting to:
- tr####.####.com
- z####.com:9500
- z####.com
- yout####.com
HTTP GET requests:
- yout####.com/getAllContent.ashx?curId=####&channelname=####&imei=####&so...
- yout####.com/getUserInfo.ashx?imei=####
- z####.com:9500/jarfiles/jarupdate.jar
HTTP POST requests:
- z####.com/net
- z####.com/register
- tr####.####.com/update.xxdd
- z####.com/feeinfo
Modified file system:
Creates the following files:
- /sdcard/.mkcong
- /data/data/####/shared_prefs/c_sp.xml
- /sdcard/021551b3b67fdfab8626bca76343d4f2.jar
- /data/data/####/files/dex/uz.jar
- /data/data/####/shared_prefs/setting.xml
- /sdcard/youtebealog/2017-05-02.txt
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/rec_101.dat
- /data/data/####/files/old.jar
- /data/data/####/files/bean_101.dat
- /data/data/####/files/wap_101.dat
- /data/data/####/app_baidu/xpodg
Sets the 'executable' attribute to the following files:
- /data/data/####/app_baidu/xpodg
Miscellaneous:
Executes next shell scripts:
- sh /data/data/####/app_baidu/xpodg -p #### -r am start --user 0 -n ####/pmnm.uiqvu.qvpl.pvdx.tbxt -a pmnm.uiqvu.qvpl.pvdx.tbxt -i 2001
- sh /data/data/####/app_baidu/xpodg -p #### -r am start --user 0 -n ####/pmnm.uiqvu.qvpl.pvdx.tbxt -a pmnm.uiqvu.qvpl.pvdx.tbxt -i 2022
- /data/data/####/app_baidu/xpodg -p #### -r am start --user 0 -n ####/pmnm.uiqvu.qvpl.pvdx.tbxt -a pmnm.uiqvu.qvpl.pvdx.tbxt -i 2001
- chmod 777 /data/data/####/app_baidu/xpodg
- /data/data/####/app_baidu/xpodg -p #### -r am start --user 0 -n ####/pmnm.uiqvu.qvpl.pvdx.tbxt -a pmnm.uiqvu.qvpl.pvdx.tbxt -i 2022
- /system/bin/dexopt --dex 27 44 40 33188 /storage/emulated/0/021551b3b67fdfab8626bca76343d4f2.jar 1252166129 -1594119289 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 54 40 153736 /data/data/####/files/dex/uz.jar 1249798409 386157714 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fra
- /system/bin/dexopt --dex 27 68 40 242816 /data/data/####/files/old.jar 1248288451 348375139 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framew
Contains functionality to send SMS messages automatically.
