Technical information
Malicious functions:
Sends SMS messages:
- 12114: HZSY#####
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- mo####.####.com
- dynami####.####.com
- c####.####.com
- mmy####.####.com
- mobi####.####.com
- vide####.####.cn
- priceru####.####.com
HTTP GET requests:
- priceru####.####.com/price-rule-cmp/rule/matchRule?version=####&deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=#...
- vide####.####.cn/20170318/06c74910-1128-4575-9672-3ab8ea9bf53f-oba00312jp-9.jpg
- vide####.####.cn/20170318/e4888508-a8c7-47ae-8d9b-beabdfd47fa7-banner.jpg
- vide####.####.cn/20170317/aeee849e-596a-4bf9-9fb7-74e49d8bbbe4-ipz00809jp-3.jpg
- vide####.####.cn/20170321/f902a3c8-301f-4937-8b15-582331398642-%E5%88%97%E8%A1%A8.jpg
- vide####.####.cn/20170317/bf739e2a-c8dc-42ca-b101-b019fd57f9fe-%E4%B8%80%E8%BC%AA%E8%BB%8A%E3%80%81%E5%A9%A6%E8%AD%A6%E3%81%95%E3%82%93.jpg
- mmy####.####.com/mmys-cps/styleTopChlVideo.service?pageNo=####&pageSize=####&showStyle=####&rv=####&deviceId=####&uuid=####&imei=####&imsi=####&manufa...
- vide####.####.cn/20170317/71e2b21e-c2ee-4afc-ac44-b84552f14d0d-%E5%83%95%E3%81%A0%E3%81%91%E3%81%AE%E5%A5%B3%E6%95%99%E5%B8%AB.jpg
- vide####.####.cn/20170320/10f69b7c-ef4f-4015-b029-ed05df897b7d-(ADN-086)%E5%88%97%E8%A1%A81.jpg
- vide####.####.cn/20170317/aa6c2a95-ee12-4034-aa98-5378c30213ce-109cm%E3%81%AEAV%E7%9B%A3%E7%9D%A3%E3%81%AB%E3%81%97%E3%81%8F%E3%82%93%E3%81%A7%E3%81%9...
- vide####.####.cn/20170317/9f638fff-74b3-41f7-8230-b9b4ef514e6c-%E5%B1%88%E8%BE%B1%E3%81%AE%E5%A4%B1%E7%A6%81.jpg
- mmy####.####.com/mmys-cps/runConfig.service?deviceId=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&appId=####&dc...
- mmy####.####.com/mmys-cps/rdContent.service?deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&app...
- c####.####.com/ip2city.asp
- vide####.####.cn/20170321/8002f9c9-97f7-45f6-b218-4bf70cc8c23f-h_838apol00033.jpg
- vide####.####.cn/20170317/1dc44d36-634e-4e7f-8523-d035a6db86fa-%E6%AF%8D%E3%81%AE%E5%8F%8B%E4%BA%BA.jpg
- vide####.####.cn/20170317/62911c63-a7b8-4c15-bbae-908df8f834a6-%E7%8C%A5%E8%A4%BB%E3%81%AA%E6%80%A7%E6%AC%B21.jpg
- mmy####.####.com/mmys-cps/bannerInfo.service?showStyle=####&deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&...
HTTP POST requests:
- mobi####.####.com/mgw.htm
- mmy####.####.com/mmys-cps/userVisit.service?deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=####&app...
- dynami####.####.com/sdk-update/sdkUpdateCdnUpload.json
- mmy####.####.com/mmys-cps/userActivation.service?deviceId=####&uuid=####&imei=####&imsi=####&manufacturer=####&model=####&versionCode=####&ditchNo=###...
- mo####.####.com/mobile-service/getImsiMobilePhone.json
- dynami####.####.com/dynamicpay//getSyFormalChannels.json?
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/device_feature_prefs_name.xml
- /data/data/####/cache/picasso-cache/c8f6800f50b1513f4b2385de2b451af0.1.tmp
- /data/data/####/cache/picasso-cache/935b2ac7769b387ff3c5d33cbf49f15b.1.tmp
- /data/data/####/cache/picasso-cache/b14bdb08771cf1e42c13a6a3f8acdb16.1.tmp
- /sdcard/.SystemConfig/device_feature_file_name
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/cache/picasso-cache/935b2ac7769b387ff3c5d33cbf49f15b.0.tmp
- /data/data/####/cache/picasso-cache/60572f3b5bdf54e0e630ff2d9e4767d3.0.tmp
- /data/data/####/cache/picasso-cache/a6213fd5faccb13b505167ad47ba38c4.0.tmp
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/ds_configer.xml
- /data/data/####/shared_prefs/trigger_recorder.xml.bak
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/picasso-cache/b14bdb08771cf1e42c13a6a3f8acdb16.0.tmp
- /data/data/####/cache/picasso-cache/8a1026ebf3381f81a9f91365fd8dd217.0.tmp
- /data/data/####/shared_prefs/time.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/cache/picasso-cache/6134d992660c09eb1c9586ad7a410737.1.tmp
- /data/data/####/shared_prefs/uuid.xml
- /data/data/####/cache/picasso-cache/04031b061d59dd6b595c32d90205f136.0.tmp
- /data/data/####/databases/msp.db
- /data/data/####/cache/picasso-cache/7ee7397be279789853854fefa9c455c7.0.tmp
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/cache/picasso-cache/8a1026ebf3381f81a9f91365fd8dd217.1.tmp
- /data/data/####/shared_prefs/virtualImeiAndImsi.xml
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/shared_prefs/alipay_vkey_random.xml
- /data/data/####/cache/picasso-cache/a74f360db680904f1ed3c96d5a210c63.1.tmp
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/databases/msp.db-journal
- /data/data/####/cache/picasso-cache/a6213fd5faccb13b505167ad47ba38c4.1.tmp
- /data/data/####/cache/picasso-cache/a74f360db680904f1ed3c96d5a210c63.0.tmp
- /data/data/####/cache/picasso-cache/c8f6800f50b1513f4b2385de2b451af0.0.tmp
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/picasso-cache/e7dc7ab0358d8b31da10abed8f763452.0.tmp
- /data/data/####/databases/statistics_db-journal
- /sdcard/SYPAYFILENAME/CACHE/SMSCACHE/ISDELSMS
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/databases/sy_video_data_cache-journal
- /data/data/####/shared_prefs/p_config.xml
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/shared_prefs/global_count.xml
- /data/data/####/shared_prefs/trigger_recorder.xml
- /data/data/####/databases/upgrade_app-journal
- /data/data/####/files/gaClientId
- /data/data/####/cache/picasso-cache/2933912231905691ba9ff5a9fd0a8bec.0.tmp
- /data/data/####/databases/recommend_app-journal
- /data/data/####/cache/picasso-cache/journal.tmp
- /data/data/####/cache/picasso-cache/e7dc7ab0358d8b31da10abed8f763452.1.tmp
- /data/data/####/shared_prefs/vkeyid_settings.xml
- /data/data/####/databases/google_analytics_v2.db-journal
- /data/data/####/databases/statistics_db
- /data/data/####/files/log/ap/20170126.log
- /data/data/####/cache/picasso-cache/04031b061d59dd6b595c32d90205f136.1.tmp
- /data/data/####/cache/picasso-cache/6134d992660c09eb1c9586ad7a410737.0.tmp
- /data/data/####/cache/picasso-cache/60572f3b5bdf54e0e630ff2d9e4767d3.1.tmp
- /data/data/####/cache/picasso-cache/2933912231905691ba9ff5a9fd0a8bec.1.tmp
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/cache/picasso-cache/7ee7397be279789853854fefa9c455c7.1.tmp
Miscellaneous:
Executes next shell scripts:
- ls -l /system/xbin/su
Contains functionality to send SMS messages automatically.
