Technical information
Malicious functions:
Sends SMS messages:
- 15121150845: #2016#40049&99139&####&####&####
Network activity:
Connecting to:
- 1####.####.181:83
- 1####.####.111
- and####.####.com
- 1####.####.181
- 1####.####.111:8001
- and####.####.com:8077
HTTP GET requests:
- 1####.####.111/APP/AppTask.aspx
- 1####.####.181/NewInterface/calc2.aspx?code=####
- 1####.####.111:8001/GetMobile/MatchingMobile.aspx?IMSI=####&IMEI=####&Ti...
- 1####.####.181:83/NewInterface/calc20.aspx?code=####
- 1####.####.181/NewInterface/calc1.aspx?code=####
- 1####.####.111/GetMobile/MatchingMobile.aspx?IMSI=####&IMEI=####&TimeSta...
- 1####.####.181/NewInterface/calc8.aspx?code=####
- 1####.####.181/InterFace/MdoProvince.aspx?item=####&packagecode=####&ims...
- 1####.####.181/NewInterface/calc9.aspx?code=####
- 1####.####.111/APP/VersionCheck.aspx
HTTP POST requests:
- and####.####.com/record-plat/record/upload.do
- and####.####.com:8077/record-plat/seq/query.do
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/pz_sharedpre_cmreaderlogininfo.xml
- /data/data/####/app_workbench70706/apk.zip
- /data/data/####/app_workbench65100/apk.zip
- /data/data/####/files/4d236d9a2d102c5fe6ad1c50da4bec50.apk
- /data/data/####/shared_prefs/SMS_INFO.xml
- /data/data/####/app_payload_lib/libkjOnlinePay.so
- /data/data/####/shared_prefs/sdktype.xml
- /data/data/####/shared_prefs/IsSecondEx.xml
- /data/data/####/app_workbench48216/apk.zip
- /data/data/####/databases/Data_sync.db-journal
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.data
- /data/data/####/shared_prefs/out.xml
- /data/data/####/app_payload_lib/libcrypt_sign.so
- /data/data/####/files/libabc
- /data/data/####/shared_prefs/plugin_record_app_info.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data
- /data/data/####/app_payload_lib/libcocos2dcpp.so
- /data/data/####/shared_prefs/ysec.xml
- /data/data/####/app_workbench92956/apk.zip
- /data/data/####/shared_prefs/pref_recomm.xml
- /data/data/####/shared_prefs/mdo.xml
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 45 40 129872 /data/data/####/app_workbench65100/apk.zip 1251699337 591524218 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
- /system/bin/dexopt --dex 27 46 40 94816 /data/data/####/app_workbench92956/apk.zip 1251699333 -264446213 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
- /system/bin/dexopt --dex 27 47 40 540224 /data/data/####/app_workbench70706/apk.zip 1251699349 1715135955 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
- /system/bin/dexopt --dex 27 46 40 94816 /data/data/####/app_workbench65100/apk.zip 1251699337 -264446213 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
- /system/bin/dexopt --dex 27 40 40 1447560 /data/data/####/files/4d236d9a2d102c5fe6ad1c50da4bec50.apk 2179072 667111241 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.
- /system/bin/dexopt --dex 27 45 40 129872 /data/data/####/app_workbench92956/apk.zip 1251699333 591524218 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
- /system/bin/dexopt --dex 27 51 40 540224 /data/data/####/app_workbench65100/apk.zip 1251699338 1715135955 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
- /system/bin/dexopt --dex 27 46 40 94816 /data/data/####/app_workbench70706/apk.zip 1251699349 -264446213 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
- /system/bin/dexopt --dex 27 45 40 129872 /data/data/####/app_workbench70706/apk.zip 1251699349 591524218 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
Contains functionality to send SMS messages automatically.
