Technical information
Malicious functions:
Sends SMS messages:
- 0015626662104: 程序已安装<IMEI>
Intercepts incoming SMS messages and terminates the process of their transmission to handlers of other applications.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c####.baidust####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) pic.x####.com:80
- TCP(HTTP/1.1) ada.b####.com:80
- TCP(HTTP/1.1) 1####.239.217.134:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) wn.pos.b####.com:80
- TCP(HTTP/1.1) wap.n.sh####.com:80
- TCP(HTTP/1.1) wap.x####.com:80
- TCP(HTTP/1.1) si####.jom####.com:80
- TCP(HTTP/1.1) q.q####.cn:80
- TCP(HTTP/1.1) pd.x####.com:80
- TCP(HTTP/1.1) pos.b####.com:80
- TCP(TLS/1.0) c####.baidust####.com:443
- TCP(TLS/1.0) h####.b####.com.####.com:443
- TCP(TLS/1.0) ss2.bdst####.com:443
- TCP(TLS/1.0) wap.n.sh####.com:443
- TCP(TLS/1.0) ss3.b####.com:443
- TCP(TLS/1.0) m.iqian####.com:443
- TCP(TLS/1.0) dup.baidust####.com:443
DNS requests:
- a####.u####.com
- ada.b####.com
- c####.b####.com
- c####.baidust####.com
- c####.baidust####.com
- cm.pos.b####.com
- dg.x####.com
- dup.baidust####.com
- f10.b####.com
- f11.b####.com
- f12.b####.com
- h####.b####.com
- hm.b####.com
- m.b####.com
- m.iqian####.com
- pd.x####.com
- pic.x####.com
- pos.b####.com
- q.q####.cn
- s.c####.b####.com
- ss2.bdst####.com
- ss3.b####.com
- t10.b####.com
- t11.b####.com
- t12.b####.com
- wap.x####.com
- wn.pos.b####.com
HTTP GET requests:
- ada.b####.com/ecom?cp=####&word=####&k_words=####&ds=####&wsw=####&wsh=#...
- c####.baidust####.com/cpro/ui/cm.js
- c####.baidust####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- c####.baidust####.com/cpro/ui/noexpire/img/chapin/look2.png
- c####.baidust####.com/cpro/ui/noexpire/img/chapin/shrink2.png
- c####.baidust####.com/sync.htm?cproid=####
- hm.b####.com/h.js?4e6e577####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- pd.x####.com/xh_wap.js
- pic.x####.com/cons/20130703/6a34093fb951f7f4.jpg!160
- pic.x####.com/cons/20150512/074f42dd88c356c0.jpg!160
- pic.x####.com/cons/20150512/528ce559f4c6779c.jpg!160
- pic.x####.com/cons/20150808/1f3f25f222e0e1ac.jpg!109
- pic.x####.com/cons/20150808/6b37a0419c7645b4.jpg!109
- pic.x####.com/cons/20150808/7455706cc0012c8c.jpg!109
- pic.x####.com/cons/20150808/7467ee44e02485f7.jpg!109
- pic.x####.com/cons/20160915/8e2e166e439e2ce2.gif
- pic.x####.com/cons/20160915/8e2e166e439e2ce2.gif!160
- pic.x####.com/cons/20160924/7e7d4697a17c5f94.gif!160
- pic.x####.com/cons/20160925/6ac29a8e65ba2697.jpg!160
- pic.x####.com/cons/20160925/94ff4ca2a03d52f1.jpg!160
- pic.x####.com/cons/20161018/777e29e3cf46f3ee.jpg!160
- pic.x####.com/cons/20161018/7a800bbbc5d40c34.gif!160
- pic.x####.com/cons/20161018/7a917ae6d62e63bc.jpg!160
- pic.x####.com/users/20140521/1dc61631dde540d0.jpg
- pic.x####.com/users/20150520/9621cd766020301c.jpg
- pic.x####.com/users/20150528/460b210e4392b386.jpg
- pic.x####.com/users/20160603/d3c4ec62106b088b.jpg
- pic.x####.com/users/20160629/81efcf764c1f23c4.jpg
- pic.x####.com/users/default.png
- pos.b####.com/scym?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/scym?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&h...
- pos.b####.com/scym?di=####&dri=####&dis=####&dai=####&ps=####&coa=id=###...
- pos.b####.com/sync_pos.htm?cproid=####
- pos.b####.com/sync_pos.htm?cproid=####&t=####
- pos.b####.com/wcum?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- pos.b####.com/wcum?di=####&dri=####&dis=####&dai=####&ps=####&coa=####&h...
- pos.b####.com/wcum?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
- pos.b####.com/xcwm?conwid=####&conhei=####&rdid=####&dc=####&di=####&dri...
- q.q####.cn/qqapp/100527452/FC302D0755B396146CD86F451AEA7E06/100
- si####.jom####.com/it/u=1423332445,3399161176&fm=76
- si####.jom####.com/it/u=1655536375,2135294607&fm=76
- si####.jom####.com/it/u=2016107463,2375677431&fm=76
- si####.jom####.com/it/u=2069937542,2947019225&fm=76
- si####.jom####.com/it/u=2094211488,2387261138&fm=76
- si####.jom####.com/it/u=2354372181,144753755&fm=76
- si####.jom####.com/it/u=256798511,2357697783&fm=76
- si####.jom####.com/it/u=2754278886,3178204329&fm=76
- si####.jom####.com/it/u=310959658,3151991654&fm=76
- si####.jom####.com/it/u=3240398336,3389615642&fm=76
- si####.jom####.com/it/u=3249290878,1403091144&fm=76
- si####.jom####.com/it/u=3327368741,3711826646&fm=76
- si####.jom####.com/it/u=3334814142,2362060578&fm=76
- si####.jom####.com/it/u=339992906,3121063281&fm=76
- si####.jom####.com/it/u=3488776503,3737569236&fm=76
- si####.jom####.com/it/u=3712825453,692518663&fm=76
- si####.jom####.com/it/u=3888996273,695191564&fm=76
- si####.jom####.com/it/u=394076159,3964070844&fm=76
- si####.jom####.com/it/u=3985325463,4171142978&fm=76
- si####.jom####.com/it/u=4039932086,4200631450&fm=76
- si####.jom####.com/it/u=4089445770,4254301393&fm=76
- si####.jom####.com/it/u=4223806701,1233271479&fm=76
- si####.jom####.com/it/u=54441276,3704876009&fm=76
- si####.jom####.com/it/u=863241412,1095050088&fm=76
- si####.jom####.com/it/u=959100585,1197998252&fm=76
- si####.jom####.com/it/u=980188043,2499827922&fm=76
- wap.n.sh####.com/se/static/font/cicon_554a9fc.ttf
- wap.n.sh####.com/se/static/js/fusion/b-scroll/b-scroll_4463064.js
- wap.n.sh####.com/se/static/js/fusion/b-scroll/bdscroll_10fab41.js
- wap.n.sh####.com/se/static/js/fusion/deps/fusion.best_5bb531c.js
- wap.n.sh####.com/static/search/image_default.png
- wap.x####.com/
- wap.x####.com/473655.html
- wap.x####.com/static/css/img/b-icon.png
- wap.x####.com/static/css/img/xxhh-icon.png
- wap.x####.com/static/css/img/xxhh-logo.png
- wap.x####.com/static/css/wap.css?v####
- wap.x####.com/static/js/common.js?1####
- wap.x####.com/static/js/jquery-1.7.2.min.js
- wn.pos.b####.com/adx.php?c=####
HTTP POST requests:
- a####.u####.com/app_logs
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/Dctivityconfig.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/index
- /data/data/####/mydata
- /data/data/####/mydata-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
Parses information from SMS messages.
Gains access to information about sent/received SMS messages.
