Technical information
Malicious functions:
Sends SMS messages:
- 106575206321505460: dyl#<IMSI>,<IMEI>,6000065-1-1313-6_kh37s0001_-0
- 15121150845: #2016#900000&100001&<IMSI>&<IMEI>&<ICCID>
Network activity:
Connecting to:
- 1####.####.181
- 1####.####.181:84
- 1####.####.34:19000
- 1####.####.57
- 1####.####.57:10001
- and####.####.com
- and####.####.com:8077
- b####.####.com
- huangda####.com
- p####.####.com
HTTP GET requests:
- 1####.####.181/NewInterface/calc8.aspx?code=####
- 1####.####.181:84/NewInterface/calc11.aspx?code=####
- 1####.####.57/v1/order/get?phone=####&imei=####&sdk_version=####&callbac...
- 1####.####.57:10001/v1/order/get?phone=####&imei=####&sdk_version=####&c...
- b####.####.com/group1/M00/00/02/ChM3JFdnYwCAUGrYAAC7FnX_5pY119.JPG
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- p####.####.com/cityjson?ie=####
HTTP POST requests:
- 1####.####.34:19000/v2/chis
- and####.####.com/query-plat/conf/common/query.do
- and####.####.com/video-plat/order/report.do
- and####.####.com:8077/query-plat/conf/common/query.do
Modified file system:
Creates the following files:
- <Package Folder>/app_PayImgs/35C0AA4E35870D8FB61718068BDBCF35
- <Package Folder>/app_PayImgs/5A0C98FA35D82BC7E418646B07304289
- <Package Folder>/app_PayImgs/60BB9E200DE476621218D5FF77D8E560
- <Package Folder>/app_workbench81952/apk.zip
- <Package Folder>/cache/####/0928f492a1a57b3b02d8c077037f1999dc3fd12c3b17d628f204485d4e8d4e06.0.tmp
- <Package Folder>/cache/####/0932b6bbbb28a41214bd29c56b6cc7c00c19546413c5001a2f129bf380318838.0.tmp
- <Package Folder>/cache/####/0d385e8c1c0933c30bd9ef6544f80b07063e1c9f7c7eac987303aebe5bae4784.0.tmp
- <Package Folder>/cache/####/10d507bb9a3cdd5e4282c55a13195c40806d70eec64541eff7a7bcadc3815ca2.0.tmp
- <Package Folder>/cache/####/13cc4a8df93b625fa61f60f1a0daab15b93df25c9cf0716605dc9c0b24041594.0.tmp
- <Package Folder>/cache/####/1c9b45365472c2190e86b8d7d1982742755d80fff7ef47f46911d5c9260e4882.0.tmp
- <Package Folder>/cache/####/2a51203b01855ba5cb0621bf57f9838e5b4e9d5bc7be0e53c4cc14d1fc587da1.0.tmp
- <Package Folder>/cache/####/34993e4ff100c82daba51920e999a2dacdc14bcb11e80280ec867a0a358a85db.0.tmp
- <Package Folder>/cache/####/39da295768f20ddebca7ea4133b42bb55604f6b65889d168eaa7c941f9b29371.0.tmp
- <Package Folder>/cache/####/3e2d93e8d778e615381015d0c5b816ae7a0107814fc2188c26e652743c5fd055.0.tmp
- <Package Folder>/cache/####/410a000027f5f6f82176e802d93f98918f56468511ecab72001379743ec01e8f.0.tmp
- <Package Folder>/cache/####/50d15f820c68feddb9d5b7a507e7fca48d41cc03965dfb7c2f738525a090a5c3.0.tmp
- <Package Folder>/cache/####/63729a04135574403e7fb6edea0329a97cb77ee432aa3590e3da8f3e77be1ddc.0.tmp
- <Package Folder>/cache/####/77073299dee68dacf67188e0b149970eb49a1482467dcf33ae5770de4d27ef70.0.tmp
- <Package Folder>/cache/####/7f5cd01416d2dc32c9473c9d1d6188881cb8dd08ec313dc7c876056d4cec7992.0.tmp
- <Package Folder>/cache/####/8a7b0f3d879d44992514a7eba5ef73e77d2224fd5045d060a5df38996ae935ae.0.tmp
- <Package Folder>/cache/####/aa15ee7a412a3c75b47f18d826716bd1c1a7a5591f01815d5ae8dfabf2cc9090.0.tmp
- <Package Folder>/cache/####/b4c61e2cca9bfbff0a5d3e7473092573e2543dea920bee6a11cbd077f8427182.0.tmp
- <Package Folder>/cache/####/da1603f2debf4119edec82b3113247484d5da08c4127df61f60edb985cdc2bf1.0.tmp
- <Package Folder>/cache/####/eb98f0625bb232b5fe5a8aa104c550c9d3ead2d754bef4bc62b4694679f0b1c1.0.tmp
- <Package Folder>/cache/####/fe11fc47f687ea38e6450d1415ad768a6da3844f8ca17202a5a8e15df2ec5842.0.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/libabc
- <Package Folder>/shared_prefs/Integrate.result.xml
- <Package Folder>/shared_prefs/IsSecondEx.xml
- <Package Folder>/shared_prefs/IsSecondEx.xml.bak
- <Package Folder>/shared_prefs/data.xml
- <Package Folder>/shared_prefs/out.xml
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/twc.xml
- <Package Folder>/shared_prefs/twc.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/Android/####/5324B5E214C507F3DA856C49F1257F53
- <SD-Card>/Android/####/com.skymobi.pay.plugin.main.data
- <SD-Card>/Android/####/com.skymobi.pay.zmvideo.plugin.jar
- <SD-Card>/Android/####/data.xml
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- <error:2>
- cat /sys/block/mmcblk0/device/cid
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.zmvideo/plugins/com.skymobi.pay.zmvideo.plugin.jar
