Technical information
Malicious functions:
Sends SMS messages:
- 1069099903306: ####
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- 3####.####.com
- mo####.####.top
- p####.####.com
- pa####.####.com
- a####.####.com
- res####.####.com
- collec####.####.com
HTTP GET requests:
- mo####.####.top/common/json/provence.json
- mo####.####.top/common/js/robotMessage.js?v=####
- p####.####.com/cityjson?ie=####
- mo####.####.top/assets/img/horn.png
- mo####.####.top/common/js/lib/jquery.min.js?v=####
- mo####.####.top/assets/css/index.css
- mo####.####.top/common/js/global.js
- mo####.####.top/common/js/uuid.js?v=####
- mo####.####.top/assets/img/footer_img_grey_1.png
- mo####.####.top/common/json/enum.json
- mo####.####.top/common/js/checkFreeInfo.js?v=####
- mo####.####.top/common/js/lib/crypto-js.js
- mo####.####.top/js/index/footer.js?v=####
- mo####.####.top/assets/img/footer_img_red_0.png
- 3####.####.com/lightmap/components/geolocation/geolocation.min.js
- mo####.####.top/common/js/tools.js?v=####
- mo####.####.top/common/js/toOrder.js?v=####
- mo####.####.top/common/js/lib/seajs-text.js
- mo####.####.top/js/index.js?v=####
- mo####.####.top/common/js/goback.js?v=####
- mo####.####.top/assets/img/footer_img_grey_2.png
- mo####.####.top/common/js/globalState.js?v=####
- mo####.####.top/assets/css/loading.css?v=####
- mo####.####.top/js/index/index_recommend.js?v=####
- mo####.####.top/
- mo####.####.top/common/js/greet.js?v=####
- mo####.####.top/common/components/hint.js?v=####
- mo####.####.top/common/js/sea.min.js
- mo####.####.top/assets/img/footer_img_grey_3.png
- mo####.####.top/common/js/isVip.js?v=####
- mo####.####.top/assets/common/global.css
- mo####.####.top/common/js/batchChat.js?v=####
- mo####.####.top/common/js/config.js
- mo####.####.top/common/js/lib/doT.js?v=####
- mo####.####.top/common/js/ajax/ajax.js?v=####
- mo####.####.top/js/index/index_fate.js?v=####
HTTP POST requests:
- a####.####.com/lp-advert-msc/f_105_10_2.service
- pa####.####.com/mobile-service/getOpenImsiMobilePhone.json
- res####.####.com/v3/ip
- pa####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
- pa####.####.com/pay-data-collect/collectAppStartUserData.json
- pa####.####.com/pay-data-collect/uploadChannelNormalData.json
- pa####.####.com/pay-sms-access//getAccessPayChannel.json
- collec####.####.com/pay-data-collect/uploadClientCrashLog.json
Modified file system:
Creates the following files:
- /data/data/####/databases/social_ad_db-journal
- /data/data/####/shared_prefs/plugins.serviceMapping.xml
- /data/data/####/cache/sms.apk.apk
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_plugin_dir/com.souying.pay.plugin.ui/1.0_1/base-1.apk
- /data/data/####/databases/cc/cc.db
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/sui.apk.apk
- /data/data/####/app_apCoreplugn/ZIP/plugin-20170111-2.1.8.6.1.bin
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /sdcard/Android/data/.nomedia
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/files/mobclick_agent_cached_####1001
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/app_apCoreplugn/sms.apk
- /data/data/####/cache/smap.apk.apk
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/plugins.installed.xml
- /data/data/####/app_plugin_dir/com.souying.pay.plugin.ui/1.0_1/dalvik-cache/base-1.dex
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk
- /data/data/####/databases/com.souying.pay.plugmain_sy_pay_record-journal
- /data/data/####/app_apCoreplugn/smap.apk
- /data/data/####/databases/webview.db-journal
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk
- /data/data/####/shared_prefs/com.souying.pay.xml
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/app_apCoreplugn/sui.apk
- /data/data/####/cache/crash/####/crash-1485418423718.log
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/databases/recordInfo-journal
- /data/data/####/cache/crash/####/crash-1485418431460.log
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/dalvik-cache/base-1.dex
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/shared_prefs/advertise.xml
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/sy_pay_config.xml
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/com.souying.pay.plugmain_p_config.xml
Miscellaneous:
Executes next shell scripts:
- cat /proc/version
Contains functionality to send SMS messages automatically.
