Technical information
Malicious functions:
Sends SMS messages:
- 1069028900588: 1#<IMSI>#njjy
Network activity:
Connecting to:
- 1####.####.com
- 2####.####.140
- 2####.####.140:8080
- a####.####.com
- auto####.com
- auto####.com:9000
- bwse####.####.com
- bwse####.####.com:8220
- d####.####.com
- g####.####.net
- g####.####.net:8080
- ojtgd####.####.com
- s####.####.com
- s####.####.com:8351
- sd####.####.com
- small####.####.cn
- t####.cn
- tcpse####.####.com
- tcpse####.####.com:28000
- w####.####.com:7758
HTTP GET requests:
- 1####.####.com/ic.asp
- a####.####.com/loc/?cl=####&wl=####&output=####
- auto####.com/spfee/images/confignanjing.txt
- auto####.com:9000/spfee/images/confignanjing.txt
- bwse####.####.com/qianya/sdk/confignanjing.txt
- bwse####.####.com:8220/qianya/sdk/confignanjing.txt
- d####.####.com/egsb/otherPay/querySMSLimitMoney
- s####.####.com/download//moduleVersion/marketing100_20170630174728458.jar
- t####.cn/ajax/imsi.ashx?imsi=####
- tcpse####.####.com/server_info
- tcpse####.####.com:28000/server_info
HTTP POST requests:
- 2####.####.140/migusdk/tl/enclog
- 2####.####.140:8080/migusdk/tl/enclog
- a####.####.com/app_logs
- g####.####.net/migusdk/tl/tcttl
- g####.####.net:8080/migusdk/verification/checkSdkUpdate
- ojtgd####.####.com/classes.jar
- s####.####.com:8351/user/getInfoFromSDK
- sd####.####.com/behaviorLogging/eventLogging/accept?
- small####.####.cn/twentyfourhours/webroot/?act=####
- w####.####.com:7758/normandie/QueryConfigPolicy
Modified file system:
Creates the following files:
- <Package Folder>/2093.dex
- <Package Folder>/2216.dex
- <Package Folder>/cache/####/classes.dex
- <Package Folder>/cache/2093.dex (deleted)
- <Package Folder>/cacheclasses.jar
- <Package Folder>/cacheguard1
- <Package Folder>/cacheguard2
- <Package Folder>/cachelibJniManager.so
- <Package Folder>/files/####/1eca20b9035bf22fd3cb7e2a0ad8ce1d.zip
- <Package Folder>/files/####/classes.jar
- <Package Folder>/files/####/config.json
- <Package Folder>/files/####/e5c580ea7acf956c1b5792d9d872e8c5.zip
- <Package Folder>/files/####/guard1
- <Package Folder>/files/####/guard2
- <Package Folder>/files/####/libJniManager.so
- <Package Folder>/files/####/libmiguED.so
- <Package Folder>/files/####/plugin.xml
- <Package Folder>/files/.imprint
- <Package Folder>/files/ED.ini
- <Package Folder>/files/MiguPay.Sdk30.Lib_12003031_85676173d2f977a1be990c1de9017b56_BN202.cod
- <Package Folder>/files/MiguPay.Sdk30.Lib_12003031_85676173d2f977a1be990c1de9017b56_BN202.dat
- <Package Folder>/files/libmgRun_04.22.09_01.so
- <Package Folder>/files/mgAS.dat
- <Package Folder>/files/mgSS.dat
- <Package Folder>/files/mgid.dat
- <Package Folder>/files/mobclick_agent_cached_<Package>5
- <Package Folder>/files/playerData
- <Package Folder>/files/sdk_prefs
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/cache.xml
- <Package Folder>/shared_prefs/global.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/Download/####/ShareData.txt
- <SD-Card>/Download/####/deviceId
- <SD-Card>/Download/####/miguLog_1496232153474
- <SD-Card>/Download/####/miguLog_1496232153475
- <SD-Card>/Download/####/miguLog_1496232153480
- <SD-Card>/Download/####/miguLog_1496232173763
- <SD-Card>/Download/####/miguLog_1496232173765
- <SD-Card>/Download/####/miguLog_1496232173772
- <SD-Card>/Download/####/sdk_prefs.txt
- <SD-Card>/cmgame/####/marketing_101.jar
- <SD-Card>/cmgame/####/pushDB.txt
- <SD-Card>/cmgame/####/pushTime.txt
- <SD-Card>/cmgame/####/pushTotal.txt
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- cat /proc/cpuinfo
- cat /sys/class/net/wlan0/address
