Technical information
Malicious functions:
Sends SMS messages:
- 106904006189121: myqxt####
Executes code of the following detected threats:
- Android.DownLoader.441.origin
Network activity:
Connecting to:
- pus####.####.cn
- pus####.####.net
- g####.####.info:7820
- p####.####.com:7820
- g####.####.info
- a####.####.com
HTTP GET requests:
- g####.####.info/earth/download/an/alipay?chn=####&price=####
- pus####.####.cn/upfile/v1/2017-02-10f0a86a4e-f300-48aa-ae2e-90994f193eff.jpg
- g####.####.info/earth/download/an/prepay?chn=####&price=####
- pus####.####.cn/upfile/v1/2017-02-09143ccc4c-66da-4d20-bc3c-0e539c9b359d.jpg
- pus####.####.cn/upfile/v1/2017-02-1080430a48-f898-40d0-855e-b506e2f9ee8e.jpg
- g####.####.info/?igtcmd=####&nativePayCmd=####
- pus####.####.cn/upfile/v1/2017-02-09a47568d5-0784-44a0-88dc-17f2a12a692a.jpg
- pus####.####.cn/upfile/v1/2017-02-09e2446f1d-cb44-481d-940c-77a9ce5c1323.jpg
- g####.####.info/?igtcmd=####&nativePayCmd=####&iccid=####&price=####&imsi=####&imei=####&gameid=####&channel=####&payperiod=####&pointid=####
- pus####.####.cn/upfile/v1/2017-02-09fcc1cb82-f18c-4bf9-ac6b-2b167ddf82fe.jpg
- g####.####.info/?zckjvideocmd=####&platform=####
- g####.####.info/earth/video/needshow2?channel=####
- pus####.####.net/upfile/v1/2016-08-097084def1-343b-4f6a-a680-3f022cac3d2e.jpg
- g####.####.info/?igtcmd=####&nativePayCmd=####&gameid=####&imsi=####&iccid=####
- g####.####.info/?igtcmd=####&gameid=####
- pus####.####.cn/upfile/v1/2017-02-091570b9d3-5442-4c51-89b2-ad4ceadf7165.jpg
- p####.####.com:7820/?igtcmd=####&nativePayCmd=####&iccid=####&price=####&imsi=####&imei=####&gameid=####&payperiod=####&pointid=####
- pus####.####.cn/upfile/v1/2017-02-09f6ac751c-2fc2-4b2f-acf3-9fae3dbf83ff.jpg
- g####.####.info/earth/enable?deviceid=####&version=####&imsi=####
- pus####.####.net/czfiles/payApk-release.apk
- g####.####.info/?igtcmd=####&iccid=####&imsi=####&imei=####&order=####&umeng=####&price=####&cpid=####&gameid=####&sdk=####&gamename=####&sdkpaypoint=...
- pus####.####.cn/upfile/v1/2017-02-10c8c472e9-ab9d-4e3b-9ef3-dc54a2e26853.jpg
- g####.####.info/?igtcmd=####&nativePayCmd=####&gameid=####&imsi=####
- pus####.####.cn/upfile/v1/2017-02-0929c7de1a-d3a3-42c2-b237-046d5df8a7e7.jpg
- g####.####.info/earth/video/svip?platform=####
- pus####.####.cn/upfile/v1/2017-02-094a88162d-bb7d-4928-a9bb-e6811ebf8035.jpg
- g####.####.info/?igtcmd=####&nativePayCmd=####&iccid=####&imsi=####&imei=####&sdk=####&price=####&payorder=####&umeng=####&msg=####&stepcode=####&cpid...
- pus####.####.cn/upfile/v1/2017-02-093e7ae36c-a608-4af6-a81c-1380ec3936f9.jpg
- pus####.####.net/upfile/v1/2016-08-091b863372-f092-496d-abf4-e0ec5acc1d4a.jpg
- pus####.####.cn/upfile/v1/2017-02-097779ce00-4452-4ea6-906b-7568253d6049.jpg
- pus####.####.cn/upfile/v1/2017-02-103bc32c26-5e94-48a9-9fa1-79e986a73358.jpg
- g####.####.info:7820/?igtcmd=####
- g####.####.info/?igtcmd=####&order=####&state=####&paymsg=####&fingerprint=####
- g####.####.info/?igtcmd=####&nativePayCmd=####&imsi=####
- g####.####.info/?zckjvideocmd=####&channelid=####&inmainview=####
HTTP POST requests:
- a####.####.com/app_logs
Modified file system:
Creates the following files:
- /data/data/####/cache/volley/-1443761252211432082
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_09f6ac751c_2fc2_4b2f_acf3_9fae3dbf83ff_jpg
- /data/data/####/cache/volley/-1990989554-762936491
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_09a47568d5_0784_44a0_88dc_17f2a12a692a_jpg
- /data/data/####/shared_prefs/ShareFiles.xml
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_09143ccc4c_66da_4d20_bc3c_0e539c9b359d_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_093e7ae36c_a608_4af6_a81c_1380ec3936f9_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_08_097084def1_343b_4f6a_a680_3f022cac3d2e_jpg
- /data/data/####/Plugin/net.tt.plugin.myadv/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/userinfo_file.xml
- /data/data/####/cache/volley/-1522524993-1587196783
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_094a88162d_bb7d_4928_a9bb_e6811ebf8035_jpg
- /data/data/####/files/mobclick_agent_cached_####
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_09fcc1cb82_f18c_4bf9_ac6b_2b167ddf82fe_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_09e2446f1d_cb44_481d_940c_77a9ce5c1323_jpg
- /data/data/####/cache/volley/-19580148151910550083
- /data/data/####/cache/volley/368117834-410387428
- /data/data/####/cache/volley/318933706641002782
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/cache/volley/-1240838503-1462073027
- /data/data/####/files/net.tt.plugin.myadv.apk
- /data/data/####/Plugin/net.tt.plugin.myadv/apk/base-1.apk
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_097779ce00_4452_4ea6_906b_7568253d6049_jpg
- /data/data/####/shared_prefs/game_state_file.xml
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_10c8c472e9_ab9d_4e3b_9ef3_dc54a2e26853_jpg
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_1080430a48_f898_40d0_855e_b506e2f9ee8e_jpg
- /data/data/####/files/net.ttpay.apkYingmei.apk
- /data/data/####/cache/volley/-1591133931269507520
- /data/data/####/cache/volley/8919486601652094165
- /data/data/####/databases/trinea_android_common.db-journal
- /data/data/####/cache/volley/7422405111293101637
- /sdcard/com.zckj.files/zcpf.apk_t
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_toucht_net_upfile_v1_2016_08_091b863372_f092_496d_abf4_e0ec5acc1d4a_jpg
- /data/data/####/cache/volley/-404085071-1462073027
- /data/data/####/cache/volley/5211055931223374083
- /data/data/####/files/net.ttpay.apkSky.apk
- /data/data/####/cache/volley/-1212491106-628482428
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_10f0a86a4e_f300_48aa_ae2e_90994f193eff_jpg
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml.bak
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_0929c7de1a_d3a3_42c2_b237_046d5df8a7e7_jpg
- /data/data/####/cache/volley/-2117162112071843454
- /data/data/####/shared_prefs/ShareFiles.xml.bak
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_091570b9d3_5442_4c51_89b2_ad4ceadf7165_jpg
- /sdcard/com.zckj.files/zcpf.apk
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /sdcard/Trinea/AndroidDemo/ImageCache/http___pushcdn_tourket_cn_upfile_v1_2017_02_103bc32c26_5e94_48a9_9fa1_79e986a73358_jpg
- /data/data/####/cache/volley/-1381278054-484261934
- /data/data/####/files/libcryptooperad.so
Miscellaneous:
Contains functionality to send SMS messages automatically.
