Technical information
Malicious functions:
Sends SMS messages:
- 12114516412: maimobUbPTWPwFF6pNAbNKWNN9Djiy0MPbjbFUnHw7FMjlDWdIoB2!zN2ojf6kbl5vGMYBTLtg0P3oJNLqz7GQz!zQX1n
Executes code of the following detected threats:
- Android.DownLoader.304.origin
Network activity:
Connecting to:
- s####.####.com
- g####.####.com
- 2####.####.233:443
- 2####.####.233:14000
- s####.####.com:4001
- mmoc####.####.com:8088
- g####.####.com:18001
- mmoc####.####.com
- w####.####.com
- p####.####.cn
- apm-col####.####.com
- m####.####.com
- c####.####.net
HTTP GET requests:
- w####.####.com/r/l/n.jsp?nid=####&vt=####&ln=####&dataSrcId=####&sqId=####&cm=####
- m####.####.com/p/retrieval_new.jsp?parentId=####&subClassId=####&ord=####&sort=####&dataSrcId=####&sqId=####&cm=####
HTTP POST requests:
- 2####.####.233:443/
- c####.####.net/config/update
- p####.####.cn/index.php/API
- c####.####.net/dc/sync_adr
- mmoc####.####.com:8088/smspay/bill_init
- mmoc####.####.com/smspay/bill_init
- apm-col####.####.com/cpi/crash
- 2####.####.233:14000/
- g####.####.com:18001/clienteventlv
- s####.####.com/ymsdkv1/api05
- s####.####.com:4001/ymsdkv1/api05
- g####.####.com/clienteventlv
Modified file system:
Creates the following files:
- /data/data/####/.lib/libexec.so
- /data/data/####/shared_prefs/CobubRazor_SharedPref.xml
- /data/data/####/shared_prefs/TestinCrash.xml.bak
- /data/data/####/files/ymsdk_01.jar
- /data/data/####/shared_prefs/googlesdk.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/.lib/libexecmain.so
- /data/data/####/databases/dataeye_database_C9034F0A2763EC373E918F17F4DB2C11.db-journal
- /data/data/####/shared_prefs/CobubRazor_SharedPref.xml.bak
- /data/data/####/databases/TestinAgent.db-journal
- /data/data/####/databases/dataeye_database_C9034F0A2763EC373E918F17F4DB2C11.db
- /sdcard/.comssgjby
- /data/data/####/databases/TestinAgent.db
- /data/data/####/cache/cobub.cache
- /data/data/####/databases/jrnewad3.db-journal
- /data/data/####/shared_prefs/.tpns.xml.xml
- /data/data/####/shared_prefs/googlesdk.xml.bak
- /sdcard/Tencent/mta/.mid.txt
- /sdcard/.SystemService/C9034F0A2763EC373E918F17F4DB2C11/uid
- /data/data/####/shared_prefs/device_id.xml
- /data/data/####/filespushplugin.apk
- /data/data/####/shared_prefs/dc.C9034F0A2763EC373E918F17F4DB2C11.preferences.xml
- /data/data/####/files/libymsdk_21035.so
- /data/data/####/databases/mp.db-journal
- /data/data/####/files/comssgjby
- /data/data/####/databases/mp.db
- /data/data/####/shared_prefs/JOYPUSH_PREFS.xml
- /data/data/####/shared_prefs/dc.C9034F0A2763EC373E918F17F4DB2C11.preferences.xml.bak
- /data/data/####/shared_prefs/TestinCrash.xml
Miscellaneous:
Executes next shell scripts:
- logcat -t 100 -v time
- /data/data/####/lib/libtpnsWatchdog.so ####,2100183303; 55944 203.205.128.130 [{"idx":0,"ts":%d,"et":2000,"si":0,"ui":"####","ky":"Axg%lu","mid":"0","ev":{"ov":"18","sr":"800*552","md":"Generic Android-x86","lg":"en","sv":"2.42","
- /data/data/####/lib/libtpnsWatchdog.so ####,2100183303;####,2100183303; 55944 203.205.128.130 [{"idx":0,"ts":%d,"et":2000,"si":0,"ui":"####","ky":"Axg%lu","mid":"2506cf522c17cbac4864b131e51243ef7830d760","ev":{"ov":"18","sr
- /data/data/####/app_bin/daemon -p #### -s com.zcya.tlr.f -t 300
- getprop ro.product.cpu.abi
- /system/bin/sh
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
