Technical information
Malicious functions:
Sends SMS messages:
- 17688729107: 您[<Phone Number>]手机处于安全状态中 请放心使用....
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) m.0####.com:80
- TCP(HTTP/1.1) www.0####.com:80
- TCP(TLS/1.0) 1####.217.17.142:443
DNS requests:
- m.0####.com
- www.0####.com
HTTP GET requests:
- m.0####.com/
- m.0####.com/a/top/
- m.0####.com/e/tags/?tagname=####
- m.0####.com/jiroushuaige/1247.html
- m.0####.com/jiroushuaige/1247_2.html
- m.0####.com/rihanshuaige/3477.html
- m.0####.com/rihanshuaige/3477_2.html
- m.0####.com/style/css/css.css
- m.0####.com/style/images/logo.png
- m.0####.com/style/images/morelist.png
- m.0####.com/wangluoshuaige/1686.html
- m.0####.com/wangluoshuaige/1686_2.html
- m.0####.com/zhongguoshuaige/
- m.0####.com/zhongguoshuaige/22618.html
- www.0####.com/d/file/20161216/1-161216220616.jpg
- www.0####.com/d/file/20161221/1-161221222123.jpg
- www.0####.com/d/file/20161223/1-161223221152.jpg
- www.0####.com/d/file/20161223/1-161223221153.jpg
- www.0####.com/d/file/20161228/1-16122R25Q4.jpg
- www.0####.com/d/file/20161229/1-161229224501.jpg
- www.0####.com/d/file/20170117/1-1F11G62049.jpg
- www.0####.com/d/file/20170117/1-1F11G62051.jpg
- www.0####.com/d/file/20170329/a3de22e192cbceae13e0db157fb0e8f8.jpg
- www.0####.com/d/file/20170331/42554fc226a18c897851165de9fd29af.jpg
- www.0####.com/d/file/20170405/799022b21c23c39a42b3eb15e5137d86.jpg
- www.0####.com/d/file/20170414/1-1F414144137.jpg
- www.0####.com/d/file/20170414/1-1F414144Z1.jpg
- www.0####.com/d/file/20170414/1-1F414145631.jpg
- www.0####.com/d/file/20170414/1-1F414145642.jpg
- www.0####.com/d/file/20170731/1-1FI1145506.jpg?x-oss-process=####
- www.0####.com/d/file/20170802/1-1FP2162A0.jpg?x-oss-process=####
- www.0####.com/d/file/20170803/1-1FP3211424.jpg?x-oss-process=####
- www.0####.com/d/file/20170804/1-1FP4112437.jpg
- www.0####.com/d/file/20170804/1-1FP4112437.jpg?x-oss-process=####
- www.0####.com/d/file/20171001/0P6353604_0.jpg?x-oss-process=####
- www.0####.com/d/file/20171002/0P4035303_0.jpg?x-oss-process=####
- www.0####.com/d/file/20171003/0P4491Y3_0.jpg?x-oss-process=####
- www.0####.com/d/file/20171004/0P61I434_0.jpg
- www.0####.com/d/file/20171004/0P61I434_0.jpg?x-oss-process=####
- www.0####.com/d/file/20171015/c7edaf8ad6a209a49e2d298c5b544898.jpg
- www.0####.com/d/file/20171021/0P0449C5_0.jpg?x-oss-process=####
- www.0####.com/d/file/20171022/0P0404262_0.jpg?x-oss-process=####
- www.0####.com/d/file/20171023/0P040K35_0.jpg?x-oss-process=####
- www.0####.com/d/file/20171024/0P13N424_0.jpg
- www.0####.com/d/file/20171024/0P13N424_0.jpg?x-oss-process=####
- www.0####.com/d/file/20180314/0P54cQ8_0.jpg
- www.0####.com/d/file/20180322/0P0435C7_0.jpg
- www.0####.com/d/file/20180515/1-1P325103133.jpg
- www.0####.com/d/file/20180517/1-1P51F92G1.jpg
- www.0####.com/d/file/20180521/1-1P521091423.jpg
- www.0####.com/d/file/20180526/1-1P5260S430.jpg
- www.0####.com/d/file/20180526/1-1P5260S936.jpg
- www.0####.com/d/file/20180526/1-1P5260U203.jpg
- www.0####.com/d/file/20180530/1-1P530111229.jpg
- www.0####.com/d/file/20180530/1-1P530112205.jpg
- www.0####.com/d/file/20180531/1-1P5310PA4.jpg
- www.0####.com/d/file/20180531/1-1P5310Q438.jpg
- www.0####.com/d/file/20180531/1-1P5310Q603.jpg
- www.0####.com/d/file/20180531/1-1P5310R229.jpg
- www.0####.com/d/file/20180601/1-1P6010J427.png
- www.0####.com/d/file/20180601/1-1P6010J427.png?x-oss-process=####
- www.0####.com/d/file/20180601/1-1P6010K237.png
- www.0####.com/d/file/20180601/1-1P6010P212.png
- www.0####.com/d/file/20180601/1-1P6010P212.png?x-oss-process=####
- www.0####.com/d/file/20180601/1-1P6010PU5.png
- www.0####.com/d/file/20180601/1-1P6010PU5.png?x-oss-process=####
- www.0####.com/d/file/20180601/1-1P6010Q502.png
- www.0####.com/d/file/20180601/1-1P6010Q502.png?x-oss-process=####
- www.0####.com/d/file/20180613/1-1P6130AR6.png
- www.0####.com/d/file/20180615/1-1P615055553.png
- www.0####.com/d/file/20180615/1-1P615062129.png
- www.0####.com/d/file/20180615/1-1P615064628.png
Modified file system:
Creates the following files:
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Contains functionality to send SMS messages automatically.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
