Technical information
Malicious functions:
Sends SMS messages:
- 12114000361024: yy001######82072c2a6a324626a3762a920fc23cdf
Executes code of the following detected threats:
- Android.Triada.271.origin
- Android.Triada.1
Network activity:
Connecting to:
- hl####.com
- s####.com:8082
- 4####.####.208:8789
- 4####.####.208
- k####.####.com
- k####.####.com:10081
HTTP GET requests:
- hl####.com/apk/king.apk
HTTP POST requests:
- 4####.####.208/register
- s####.com:8082/rtr
- 4####.####.208/updatePackage
- k####.####.com/OsService/OsStrategy
- 4####.####.208:8789/updatePackage
- k####.####.com:10081/OsService/OsStrategy
Modified file system:
Creates the following files:
- /data/data/####/files/sdk.db
- /data/data/####/cache/libnacrosses.so
- /data/data/####/files/sdk
- /sdcard/Download/tmp/ss/(0001)ttdfj
- /data/data/####/files/sdk.jar
- /data/data/####/files/hdcoi
- /sdcard/yuypay/uuinfo/phone_uuid.tmp
- /data/data/####/files/res/naccore.jar
- /data/data/####/app_success/imei
- /data/data/####/databases/yvp.db-journal
- /data/data/####/shared_prefs/imei.xml
- /sdcard/yuypay/jar/dynamic_pay_sdk_1.4.8-201608091652.jar
- /data/data/####/files/timesinfo.db
- /data/data/####/shared_prefs/xapcinfo.xml
- /sdcard/yuypay/jar/76b41a2fa1a43112e19eee3e5b161e53.jar
Miscellaneous:
Executes next shell scripts:
- getprop
- /system/bin/dexopt --dex 27 49 40 394224 /storage/emulated/0/yuypay/jar/dynamic_pay_sdk_1.4.8-201608091652.jar 1225951409 -556006373 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.ja
- rm -r /data/data/####/files/res/
- cufsdosck ac554db364f
- /system/bin/dexopt --dex 27 57 40 46604 /data/data/####/files/res/naccore.jar 1223121728 234780002 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fr
- cufsmgr eb47495f7bb
- /system/bin/dexopt --dex 27 50 40 84776 /data/data/####/files/sdk.jar 1223133972 -775242648 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework
- conbb od2gf04pd9
Contains functionality to send SMS messages automatically.
