Technical information
Malicious functions:
Sends SMS messages:
- 0016124659478: f: 900 n: ####
- 0016124659478: kd2407862169安装运行
- 0016124659478: kd2407862169激活成功
- 0016124659478: MyContentObserver####
Executes code of the following detected threats:
- Android.SmsSpy.206.origin
Network activity:
Connecting to:
- s####.####.com
- c####.####.net
- p####.####.com
- c####.####.com
- f####.####.com
- w####.####.com
- l####.####.com
- i####.####.cn
- c####.####.cn
- a####.####.com
- m####.####.cn
HTTP GET requests:
- w####.####.com/adx.php?c=####
- c####.####.com/cpro/ui/noexpire/img/chapin/shrink2.png
- c####.####.cn/mobile/images/iconfont.ttf?t=####
- p####.####.com/tcwm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- p####.####.com/bcqm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- f####.####.com/it/u=531867547,2241303236&fm=76
- c####.####.cn/mobile/js/static.js
- p####.####.com/scjm?rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&coa=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=##...
- i####.####.cn/iplookup/iplookup.php?format=####
- m####.####.cn/result.html?no=####&com=####&no-query-button=####
- c####.####.cn/mobile/images/query.min.css
- c####.####.com/cpro/ui/noexpire/img/chapin/stand.png
- p####.####.com/scjm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- c####.####.cn/mobile/js/query.2015.js
- p####.####.com/sync_pos.htm?cproid=####
- m####.####.cn/outlets/
- p####.####.com/pcgm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- p####.####.com/ucjm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- p####.####.com/kcem?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- s####.####.com/s.htm?cproid=####&t=####
- c####.####.com/gpixel?google_gid=####&google_cver=####
- m####.####.cn/
- p####.####.com/pcgm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- c####.####.com/cpro/ui/noexpire/img/2.0.1/bd-logo4.png
- p####.####.com/sccm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- c####.####.com/cpro/ui/noexpire/img/chapin/look2.png
- m####.####.cn/result.html
- f####.####.com/it/u=628479198,2725176490&fm=76
- l####.####.com/js/zepto/0.8/zepto.min.js
- c####.####.com/cpro/ui/noexpire/img/mob_adicon.png
- p####.####.com/pcgm?rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&coa=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=##...
- c####.####.com/dex/container_165.dex
- p####.####.com/ncam?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- p####.####.com/scjm?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- c####.####.cn/mobile/js/query.min.js
- c####.####.com/du?&baidu_user_id=####&cookie_version=####×tamp=####&ext_data=####
- c####.####.cn/mobile/images/logos/auto.png
- c####.####.com/cpro/ui/cm.js
- p####.####.com/scem?sz=####&rdid=####&dc=####&di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=###...
- p####.####.com/bcqm?di=####&dri=####&dis=####&dai=####&ps=####&dcb=####&dtm=####&dvi=####&dci=####&dpt=####&tsr=####&tpr=####&ti=####&ari=####&dbv=###...
- c####.####.net/pixel?google_nid=####&google_cm=####&google_tc=####
- c####.####.com/cpro/expire/time2.js
- f####.####.com/it/u=1132667197,202151339&fm=76
- c####.####.net/pixel?google_nid=####&googl####
- c####.####.cn/mobile/js/zepto.min.js
- f####.####.com/it/u=3709221014,1546371582&fm=76
- c####.####.com/sync.htm?cproid=####
- c####.####.cn/mobile/images/mlogo.png
- p####.####.com/sync_pos.htm?cproid=####&t=####
- c####.####.cn/mobile/images/mobile.css?ver=####
- c####.####.com/pixel?dspid=####
- c####.####.com/cpro/ui/noexpire/img/chapin/blank.png
HTTP POST requests:
- a####.####.com/collector/apk_install?cid=####&udid=####&cv=####
- a####.####.com/collector/features?cid=####&udid=####&cv=####
- a####.####.com/rt/st?cid=####&udid=####&cv=####
- a####.####.com/collector/app_usage?cid=####&udid=####&cv=####
- a####.####.com/collector/static_info?cid=####&udid=####&cv=####
- a####.####.com/container/global_config?cid=####&udid=####&cv=####
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_bangcleplugin/container.apk
- /data/data/####/files/nneo.function.impl.feturesfnimpl_nneo.function.impl.feturesfnimpl
- /data/data/####/app_data/container.pre_need_update_plugins
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/shared_file.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/.cache/libsecexe.x86.so
- /data/data/####/.cache/####
- /data/data/####/files/collector_app_start
- /data/data/####/files/collector_static_info
- /data/data/####/.md5
- /data/data/####/.cache/libsecmain.x86.so
- /sdcard/Android/ApplicationHash
- /data/data/####/files/collector_my_mf_md5
- /data/data/####/app_bangcleplugin/collector.dex
- /data/data/####/files/nneo.function.impl.trafficfnimpl_Traffic
- /data/data/####/.sec_version
- /data/data/####/app_bangcleplugin/container.dex
- /data/data/####/databases/webview.db-journal
- /data/data/####/.cache/####.art
- /data/data/####/app_data/container.pre_global_config
- /data/data/####/.cache/classes.jar
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/.cache/classes.dex
- /data/data/####/files/collector_last_app_info
- /data/data/####/app_bangcleplugin/libcpu
- /data/data/####/files/collector_change_app_info
- /sdcard/.Android/ApplicationInfo
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/files/libcpu
Sets the 'executable' attribute to the following files:
- /data/data/####/.cache/####
- /data/data/####/app_bangcleplugin/libcpu
- /data/data/####/files/libcpu
Miscellaneous:
Executes next shell scripts:
- sh -c chmod 775 /data/data/####/app_bangcleplugin/libcpu
- chmod 755 /data/data/####/.cache/####
- sh -c /data/data/####/files/libcpu /storage/emulated/0/.7a51f438-af72-3169-8941-b9f89e0b7a94 18 1 ####
- sh -c chmod 775 /data/data/####/files/libcpu
- sh -c /data/data/####/app_bangcleplugin/libcpu /storage/emulated/0/.7a51f438-af72-3169-8941-b9f89e0b7a94 18 1
- ls -l /system/bin/su
- chmod 755 /data/data/####/.cache/####.art
Uses administrator priveleges.
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
