Technical information
Malicious functions:
Sends SMS messages:
- 106912114: HZSY#<IMSI>
Executes code of the following detected threats:
- Android.Triada.247.origin
- Android.Triada.248.origin
Downloads the following detected threats from the Web:
- Android.Triada.247.origin
- Android.Triada.248.origin
Network activity:
Connecting to:
- 6####.####.140
- col####.####.com
- cser####.####.cn
- huangda####.com
- i####.####.com
- i####.####.net
- i####.####.net:10001
- l####.####.com
- p####.####.com
HTTP GET requests:
- 6####.####.140/ando/i/mon?k=####&d=####
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.com/ando-res/ads/black/640x270.png
- i####.####.net/v1/sdk/init?net_name=####&imei=####&package_name=####&sdk...
- i####.####.net:10001/v1/update/check?user_id=####&app_id=####&channel_id...
- p####.####.com/cityjson?ie=####
HTTP POST requests:
- col####.####.com/mobile-service/getOpenImsiMobilePhone.json
- cser####.####.cn/channel/paymentHandle.action?v=####&requestId=####
- l####.####.com/sdk.php
Modified file system:
Creates the following files:
- <Package Folder>/cache/####/crash-1501141121309.log
- <Package Folder>/cache/####/crash-1501141178901.log
- <Package Folder>/code-5939925/MlsfTWcI4f4lMD4-
- <Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_41c0o5oEPKe9dhx-D85J_34EFt0=
- <Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_41c0o5oEPKe9dhx-D85J_34EFt0=-journal
- <Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_6-2v5qOQaGoPLRewj7eqaw==
- <Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_6-2v5qOQaGoPLRewj7eqaw==-journal
- <Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_OxMQg40yF41muSiNynyHkQ==
- <Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_OxMQg40yF41muSiNynyHkQ==-journal
- <Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_PnlaX8MQyhU=-journal
- <Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_nhAFBV5Wm9cMlvOR
- <Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_nhAFBV5Wm9cMlvOR-journal
- <Package Folder>/databases/recordInfo-journal
- <Package Folder>/databases/sy_pay_record-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/-2vjl3G--a8U5ykORclELK6MDp9haIJ7.new
- <Package Folder>/files/####/-UgmpPqLxO9r8zFY.zip
- <Package Folder>/files/####/0EsDqD5-9rnX8xRPpkkVTAEmHO8=.new
- <Package Folder>/files/####/0R5H1mqXLiUvN9NZq_cxeWnRorw=.temp
- <Package Folder>/files/####/0gzZtiFR6PDgwa88UVVQd_z0ZAhx5FUi.new
- <Package Folder>/files/####/0pqyD_y_Tb5mV42h52rjLmzx6_B1H8kl.new
- <Package Folder>/files/####/1501141121171_2113
- <Package Folder>/files/####/1501141121209_2113
- <Package Folder>/files/####/1501141121479_2113
- <Package Folder>/files/####/1501141121636_2113
- <Package Folder>/files/####/1501141178543_2254
- <Package Folder>/files/####/1501141178621_2254
- <Package Folder>/files/####/1501141178736_2254
- <Package Folder>/files/####/30eee236-d7d2-49a2-bad1-d87f41b562d8.pic.temp
- <Package Folder>/files/####/5-543EOYaSfhWw0vHeAxszQvoMEevesI_Eeilw==.new
- <Package Folder>/files/####/682b3fbd-1005-4625-88d6-f5485c66438a.pic.temp
- <Package Folder>/files/####/69a8417d-d95a-4e09-bd2a-59f950f2ea60.pic.temp
- <Package Folder>/files/####/70345280-37f5-4925-9417-e29eec085c78.pic.temp
- <Package Folder>/files/####/9q-kTQN9zH5JBfDmgRuumTatHi8=.temp
- <Package Folder>/files/####/DVFY6buDBBu62zA9_Mij9w==
- <Package Folder>/files/####/EJo515QJrxAuQgaBb870PtkhMofan8zpfhiTlf357wc=.new
- <Package Folder>/files/####/Nfg6j9hL1Y4OJnaezOLu-Q==
- <Package Folder>/files/####/Nfg6j9hL1Y4OJnaezOLu-Q==.new
- <Package Folder>/files/####/R-NhGgp6aFXtXmU7zSk6vXcWV2xD1bhc.new
- <Package Folder>/files/####/Xo6-3qwGzkm9fogQkhgmRc5FLMI=
- <Package Folder>/files/####/Xo6-3qwGzkm9fogQkhgmRc5FLMI=.new
- <Package Folder>/files/####/Y1Ju0vEZgP4H58-Q7yJWKY_h9hdFPVpm_M9tjg==.new
- <Package Folder>/files/####/Z_HePOFFkwTcFaEttcgoY-CUD260KBKz50EGBMA-WJo=.new
- <Package Folder>/files/####/_BRJX23DsQ310V6_RTLoPg==
- <Package Folder>/files/####/ad71958f-69b2-4007-8f22-befdf953c495.pic.temp
- <Package Folder>/files/####/bZmzLjTVpcPfYCX0eaYW69O3UCA=
- <Package Folder>/files/####/bZmzLjTVpcPfYCX0eaYW69O3UCA=.new
- <Package Folder>/files/####/cuGq9417EUnIiZlS
- <Package Folder>/files/####/d037a0b6-7793-4e68-b212-964e15087ca6.pic
- <Package Folder>/files/####/ef0e3535-bc35-4c80-a617-01a2f38d5179.pic.temp
- <Package Folder>/files/####/f5466d45-a12a-498d-aa47-10904349f035.pic
- <Package Folder>/files/####/fgZevgA9cuxXtSS0nNTq4Ik_76mvLeDLn7QzpxJgF6Q=.new
- <Package Folder>/files/####/gb7PiirCI4PiQ1WzEu1QJpAHIVI10D1C
- <Package Folder>/files/####/gb7PiirCI4PiQ1WzEu1QJpAHIVI10D1C.new
- <Package Folder>/files/####/hAul4_MuyaC7EMW8LkIj-lW-FMg=
- <Package Folder>/files/####/hbipuw_f.zip
- <Package Folder>/files/####/kzR7R3JpD2Eb-oWonPKAL66oe9M=.new
- <Package Folder>/files/####/lk2qXbA1FF27iyePqhzHEGeAXwk=
- <Package Folder>/files/####/o6rPr8BdFAsCNgqRXQU4Lw==.new
- <Package Folder>/files/####/pMLR3oW4Hf_BYnzFcY_wHEnUBE6IBGARr2-Jxw==.new
- <Package Folder>/files/####/psGN2tKDrbrfSBY7.new
- <Package Folder>/files/####/qGrFhVb_eMVKjx6YOWEk0K5LkqKSaegy.new
- <Package Folder>/files/####/rTS-TPwYaHCVyfLMxj7ViNq2QBK48x6_.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/sDqpwVl5M7z5WeiXTzkuWw==.new
- <Package Folder>/files/####/xKmPdzBBrdcdvtkY1tqCs2EbQlUaEWtPAryfRI10h2E=.new
- <Package Folder>/files/####/zf5ch58V0JbxbVnQTX-gHgoC8JuXiUc9.new
- <Package Folder>/files/pay.jar
- <Package Folder>/files/pay.md
- <Package Folder>/files/rdata_comyvznyxpn.new
- <Package Folder>/files/yy.dt
- <Package Folder>/shared_prefs/3c5820da2bf30a14f0fd4d99457381ce6|account_file.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/TDpref_game.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml
- <Package Folder>/shared_prefs/TDpref_longtime3.xml
- <Package Folder>/shared_prefs/TDpref_longtime3.xml.bak
- <Package Folder>/shared_prefs/TDpref_shorttime.xml
- <Package Folder>/shared_prefs/data.xml
- <Package Folder>/shared_prefs/data.xml.bak
- <Package Folder>/shared_prefs/p_config.xml
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/pretw.xml.bak
- <Package Folder>/shared_prefs/sdk.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/twc.xml
- <SD-Card>/.armsd/####/091913a5-7389-4d7a-baeb-7223200c3cf3.res
- <SD-Card>/.armsd/####/3a304e81-bed3-4c01-8550-983229508445.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/667bbdff-58d4-4380-b8e4-3d9a9e5084d2.res
- <SD-Card>/.armsd/####/96ac52fc-25c7-4ba3-ae20-30c8333edf00.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/cb573ad8-46e9-48b6-a7dd-158c53d762af.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/.exit
- <SD-Card>/.tcookieid
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/tkddbp_3001_2275.zip
- <SD-Card>/CrashLog/WyyyCrashLog_20170727073938_2254.log
Miscellaneous:
Executes next shell scripts:
- /data/data/com.i.i/code-1743129/MlsfTWcI4f4lMD4- -p com.i.i -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- /data/data/com.i.i/code-5939925/MlsfTWcI4f4lMD4- -p com.i.i -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
- getprop
- sh <Package Folder>/code-1743129/MlsfTWcI4f4lMD4- -p <Package> -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- sh <Package Folder>/code-5939925/MlsfTWcI4f4lMD4- -p <Package> -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
