Technical information
Malicious functions:
Sends SMS messages:
- 4446: SHNMB 7533 SDK0070NG12312P123J095W116I####ED
Network activity:
Connecting to:
- ap####.mobi
- e####.####.com:9090
- c####.####.com
- e####.####.com
- trac####.####.biz
- a####.####.com
HTTP GET requests:
- e####.####.com/sdkcp/ibsbill.php?pushId=####&lpId=####&linkId=####&imsi=####&subid=####&cpid=####&pjid=####&uid=####&net=####&linkid=####&leix=####&pl...
- a####.####.com/ajax/libs/jqueryui/1.11.2/jquery-ui.min.js
- c####.####.com/mobile/1.4.5/jquery.mobile-1.4.5.min.js
- e####.####.com/sdkcp/user_visit_appcp.jsp?uid=####&Cptime=####&imei=####&cpid=####&imsi=####&net=####&pjid=####&subid=####&
- e####.####.com/sdkcp/push_msgcp_new.jsp?uid=####&comptime=####&imei=####&cpid=####&imsi=####&net=####&pjid=####&subid=####&
- e####.####.com/sdkcp/pushAdwap_new.jsp?uid=####&comptime=####&model=####&plugVersion=####&imei=####&cpid=####&imsi=####&net=####&pjid=####&advid=####&...
- e####.####.com/wapbill/sale_static_newcp.jsp?uid=####&Cptime=####&imei=####&cpid=####&imsi=####&net=####&pjid=####&subid=####&
- c####.####.com/jquery-1.11.1.min.js
- e####.####.com/wapbill/Bfeecnf.jsp?dangwei=####&uid=####&imei=####&cpid=####&jid=####&imsi=####&net=####&pjid=####&subid=####&
- e####.####.com/wapbill/Allfeecnf.jsp?uid=####&plmn=####&mcc=####&imei=####&cpid=####&imsi=####&net=####&pjid=####&subid=####&
- e####.####.com/sdkcp/sub_payquery.jsp?uid=####&sendtimes=####&model=####&symbol=####&sysver=####&imei=####&show=####&cpid=####&net=####&pjid=####&send...
- ap####.mobi/red/8d121b23-b4a1-11e5-a414-0cc47a44dbaa/?alg=####&clickid=####&source=####&source2=####&idfa=####&androidid=####
- trac####.####.biz/tl?a=####&o=####&s1=####&s2=####
- e####.####.com:9090/sdkcp/plugUpdate.jsp?uid=####&plugVersion=####&imei=####&cpid=####&imsi=####&type=####&net=####&pjid=####&subid=####&
Modified file system:
Creates the following files:
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/b.log
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/shared_prefs/shony_global.xml
- /data/data/####/files/ow.apk
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/shony_global.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/files/playerData
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/files/mo.apk
- /data/data/####/cache/webviewCacheChromium/data_1
Miscellaneous:
Contains functionality to send SMS messages automatically.
