Technical information
Malicious functions:
Sends SMS messages:
- 106584211: 5fd3bec6c0a86a404191954501218478M302000A免费登录短信，请勿修改
Network activity:
Connecting to:
- s####.####.com
- 7j####.####.com
- c-h####.####.com
- obf0c####.####.com
- w####.####.com
- 1####.####.195
- d####.####.com:8083
- boo####.####.cn
- m####.####.com
- obzgl####.####.com
- a####.####.com
HTTP GET requests:
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000077626/11000077626.jpg
- boo####.####.cn/pubres/picture/show_img/yinengnn.jpg
- boo####.####.cn/pubres/picture/LoadingPage/-209853654156563477.jpg
- boo####.####.cn//pubres/picture/show_img/xinshufree.jpg
- obf0c####.####.com/visenvt9_9_20160808104730.zip
- boo####.####.cn/pubres/picture/show_img/wanbenfree.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000074446/11000074446.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000000377/11000000377.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000072603/11000072603.jpg
- 7j####.####.com/tdata_DBk687
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000006280/11000006280.jpg
- 7j####.####.com/tdata_tcA311
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000008173/11000008173.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000049442/11000049442.jpg
- boo####.####.cn//pubres/picture/show_img/wanbenfree.jpg
- s####.####.com/config/hz-hzv3.conf
- 7j####.####.com/tdata_lqw967
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000031727/11000031727.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000079573/11000079573.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000028085/11000028085.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000079588/11000079588.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000002838/11000002838.jpg
- w####.####.com/r/?vt=####&cm=####&aaa_flag=####
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000069434/11000069434.jpg
- w####.####.com/r/p/myspacedata.jsp?vt=####&aaa_flag=####
- w####.####.com/sso/p/logindata.jsp?e_l=9&purl=/r/p/myspacedata.jsp?aaa_f...
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000003116/11000003116.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000028142/11000028142.jpg
- boo####.####.cn/pubres/picture/show_img/xinshufree.jpg
- boo####.####.cn/cppartner/1x1/11x0/110x0/11000001468/11000001468.jpg
- boo####.####.cn//pubres/picture/show_img/yinengnn.jpg
HTTP POST requests:
- a####.####.com/app_logs
- obzgl####.####.com/icon7-%E6%81%A2%E5%A4%8D%E7%9A%84(4).png
- 1####.####.195/asg/portal.do?aaa_flag=####
- s####.####.com/api.php?format=####&t=####
- d####.####.com:8083/
- 1####.####.195/asg/portal.do
- m####.####.com/gateway.do
- c-h####.####.com/api.php?format=####&t=####
Modified file system:
Creates the following files:
- /data/data/####/files/push.pid
- /data/data/####/files/init.pid
- /sdcard/.ishugui/Cache/4lj7wje99e97cpd0nis07so6o
- /data/data/####/files/run.pid
- /sdcard/libs/com.getui.sdk.deviceId.db
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/.ishugui/empty.system
- /data/data/####/databases/pushsdk.db-journal
- /data/data/####/files/gdaemon_20161017
- /data/data/####/files/.imprint
- /sdcard/.ishugui/Cache/6tyrfx09yvxe89nomzh4qvqr1
- /sdcard/.system/device/factory.dzt
- /data/data/####/files/tdata_lqw967.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/databases/pushext.db-journal
- /data/data/####/shared_prefs/ishugui.shareInfo.xml.bak
- /sdcard/.ishugui/.cache/shortIcon579d5fb0babe53594fd9c7699e874fc9
- /data/data/####/databases/increment.db-journal
- /sdcard/.ishugui/Cache/69wo8vcgarwlcglgafesa5jwy
- /sdcard/.ishugui/Cache/1m8b2oznq4gej0qh7rb4mkff
- /sdcard/.ishugui/Cache/7h5w8zhuwpgp1jvobylo6gzqe
- /data/data/####/files/tdata_tcA311.tmp
- /sdcard/system/tmp/local/tdata_tcA311
- /sdcard/.system/confv9/visen.conf.mark
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /sdcard/.ishugui/Cache/1r990ezk8ipw9tnxvpbjd2iom
- /data/data/####/databases/ishugui.db-journal
- /sdcard/.ishugui/K101827cache_web/cache_199/html.css
- /sdcard/.ishugui/K101827cache_web/cache_199/html.js
- /data/data/####/databases/tmpd8.db-journal
- /sdcard/.ishugui/Cache/5zxmck24z1e5xc0t2glhaobfg
- /data/data/####/shared_prefs/iapppay_config.xml
- /sdcard/.ishugui/cover/K101827.cover.tmp
- /sdcard/.ishugui/Cache/2y62l1ihdg2gi1itjwaf7om15
- /sdcard/.ishugui/Cache/zz7pqgj0w4olea9bf319ig5i
- /sdcard/.ishugui/Cache/39ykagtyuunh7h4yekxtc78ju
- /data/data/####/databases/pushg.db-journal
- /data/data/####/shared_prefs/conf_sp_name.xml
- /sdcard/.ishugui/books/369516745/ex_info.kf
- /sdcard/.ishugui/Cache/31mnplxfsljedms40nj7073ja
- /sdcard/system/tmp/local/tdata_lqw967
- /sdcard/.ishugui/Cache/4xh9shomixhzzg10oso3byx7l
- /data/data/####/files/umeng_it.cache
- /sdcard/libs/####.db
- /sdcard/.ishugui/cover/K101827.cover
- /sdcard/.ishugui/payerr.txt
- /data/data/####/databases/pushgdm.db-journal
- /sdcard/.ishugui/K101827cache_web/cache_199/html.txt
- /sdcard/.ishugui/books/369516745/369516747.kf
- /data/data/####/files/tdata_DBk687.tmp
- /sdcard/.ishugui/Cache/1k2fpa5y595w2rpb2wwvxueyj
- /sdcard/.system/confv9/visen.conf.temp
- /sdcard/.ishugui/books/369516745/bookinfo.bat
- /sdcard/libs/app.db
- /data/data/####/files/tdata_tcA311.jar
- /sdcard/.ishugui/Cache/1ipydlsd7ga2pl6937pexsj3
- /sdcard/.ishugui/Cache/608par6idsz6ke40nbswt5no6
- /sdcard/system/tmp/local/tdata_DBk687
- /data/data/####/files/tdata_DBk687.jar
- /sdcard/.ishugui/Cache/5m9ebh0mx2uxx7yxrg0sc95tw
- /sdcard/.ishugui/Cache/6dxymx188mgy7f152s9pdz4rn
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /sdcard/.ishugui/Cache/wdcs0kmxtpkioff6mea8zox1
- /sdcard/iapppay/statistics/####/statistics.log
- /sdcard/.ishugui/.log/dzbook-ak369516745_log.txt
- /data/data/####/files/tdata_lqw967.jar
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /sdcard/.system/confv9/visen.conf
- /data/data/####/files/mobclick_agent_cached_####1010404
- /sdcard/.ishugui/Cache/5gn0giu4eiomi6tj755ierl9j
- /sdcard/.ishugui/Cache/6yqqn0dd0d6lc9gcqrkr53bnd
- /data/data/####/shared_prefs/ishugui.shareInfo.xml
- /data/data/####/shared_prefs/Cookies250026699187743.xml
Miscellaneous:
Executes next shell scripts:
- /data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 24742 300 0
- chmod 700 /data/data/####/files/gdaemon_20161017
Contains functionality to send SMS messages automatically.
