Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.1814.origin
Network activity:
Connecting to:
- gaand####.####.net
- l####.####.com:9820
- s####.####.cn
- m####.com
- z####.####.com
- t####.####.cn
- quanzh####.com
- a####.####.com
HTTP GET requests:
- quanzh####.com/qpay/config.txt
- z####.####.com/saveAppInvalid.do?appKey=####&channelId=####&imei=####&source=####
- m####.com/jl/config.txt
HTTP POST requests:
- s####.####.cn/sdkpay/updatecfg
- l####.####.com:9820/chnlt/ltpay/pytstart.do
- gaand####.####.net/g/d?crc=####
- t####.####.cn/api/q/a/3f6ec4da684547211e371a67946d85757
- a####.####.com/app_logs
- z####.####.com/checkPInfo.do
- s####.####.cn/sdkpay/deviceinforecv
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/mj.apk
- /data/data/####/shared_prefs/shared_file.xml
- /sdcard/.android_sec/libsec.so
- /data/data/####/files/mpush_gateway_preferences_file
- /data/data/####/shared_prefs/td_pefercen_profile.xml.bak
- /data/data/####/files/mpush_version_preferences_file
- /sdcard/com/android/system/uid.sys
- /data/data/####/files/mobclick_agent_cached_####15
- /data/data/####/shared_prefs/uuid.xml
- /data/data/####/shared_prefs/uucun_sms_activation.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/qpay.xml
- /data/data/####/files/.wn_data/.c2.e4.zip
- /data/data/####/shared_prefs/pref_file.xml
- /data/data/####/files/.imprint
- /data/data/####/databases/mpush_game.db-journal
- /sdcard/.android/libsec.so
- /sdcard/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk
- /data/data/####/shared_prefs/libsec.xml
- /sdcard/.tcookieid
- /data/data/####/files/mj.dex
- /data/data/####/shared_prefs/3f6ec4da684547211e371a67946d85757|account_file.xml
- /data/data/####/shared_prefs/appstartone.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/databases/sms_db
- /data/data/####/files/QPAY.apk
- /data/data/####/shared_prefs/loader_wn.xml
- /data/data/####/databases/sms_db-journal
- /data/data/####/shared_prefs/JunLinCacheData.xml.bak
- /data/data/####/files/R4vx1Qlp6xQ=
- /data/data/####/app_matrix/matrix_sdk.apk.tmp
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/appstarttwo.xml
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/shared_prefs/td_pefercen_profile.xml
- /data/data/####/shared_prefs/pref_file.xml.bak
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/shared_prefs/JunLinCacheData.xml
Miscellaneous:
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
