Technical information
Malicious functions:
Sends SMS messages:
- 075585181130: cyMjUwMDI2Njk5MTg3NzQzIzM1NjUwNzA1OTM1MTg5NSM0LjMuMQ==
Network activity:
Connecting to:
- 2####.####.140
- 1####.####.80:8000
- 2####.####.140:8080
- g####.####.net
- unitedp####.####.com
- 1####.####.192
- sd####.####.com
- 1####.####.80
- w####.####.com:7758
- d####.####.com
- g####.####.net:8080
- 1####.####.238
- t####.####.cn
- 1####.####.67
HTTP GET requests:
- d####.####.com/egsb/otherPay/querySMSLimitMoney
- d####.####.com/egsb/startup/queryConfiguration?channelId=####&contentId=####&gameType=####
- 1####.####.67/codex/version
- 1####.####.192/unitedpay_sdk/version
- unitedp####.####.com/numberbank/interface?getInfo=####
HTTP POST requests:
- 1####.####.80:8000/intp/6ce649412ba45e84f1f00f7de6875f541d880eae
- 2####.####.140:8080/migusdk/tl/enclog
- t####.####.cn/api/q/a/35313985d3b9ccc38ab579d35065afe66
- sd####.####.com/behaviorLogging/eventLogging/accept?
- d####.####.com/egsb/verification/getUpdateUrl
- d####.####.com/egsb/verification/checkSdkUpdate
- 1####.####.238/updata/interface.html
- d####.####.com/egsb/activityCfg/queryCfgAct
- g####.####.net:8080/migusdk/tl/tcttl
- g####.####.net/migusdk/tl/tcttl
- g####.####.net/migusdk/verification/checkSdkUpdate
- d####.####.com/egsb/desktopShortcut/queryAll
- d####.####.com/egsb/otherPay/querySMSInterceptorConf
- d####.####.com/egsb/gshare/switches
- 2####.####.140/migusdk/tl/enclog
- d####.####.com/egsb/game/getPaymentCapability
- w####.####.com:7758/normandie/QueryConfigPolicy
- 1####.####.80/intp/6ce649412ba45e84f1f00f7de6875f541d880eae
- d####.####.com/egsb/thirdPay/queryThirdPayInfo
Modified file system:
Creates the following files:
- /data/data/####/files/edfile/armeabi/libmiguED.so
- /data/data/####/files/mgid.dat
- /data/data/####/files/sdk_prefs
- /data/data/####/files/MiguPay.Sdk30.Lib_12003003_4d4c7afc770b3429d59fe361edcdfd5f_BN202.dat
- /data/data/####/files/libmgRun_04.22.05_01.so
- /data/data/####/files/MiguPay.Sdk30.Lib_12003003_4d4c7afc770b3429d59fe361edcdfd5f_BN202.cod
- /data/data/####/files/oX10W95WSDkGp2w5-TtS1hSM7u3yDoK2LpCmHw==/MmrJkS6pdsaaZsyy7onJLg==
- /data/data/####/files/mpush_gateway_preferences_file
- /data/data/####/shared_prefs/td_pefercen_profile.xml.bak
- /data/data/####/app_lemuellabs_reserved_/lemuel_security_inner.so
- /data/data/####/app_lemuellabs_reserved/f9cfc29277de9b79.jar
- /data/data/####/files/ly.jar
- /data/data/####/files/mpush_version_preferences_file
- /data/data/####/shared_prefs/35313985d3b9ccc38ab579d35065afe66|account_file.xml
- /data/data/####/files/gecobq_d/gecobq_f.zip
- /data/data/####/app_lemuellabs_reserved_/codex_inner.so
- /data/data/####/files/oX10W95WSDkGp2w5-TtS1hSM7u3yDoK2LpCmHw==/MmrJkS6pdsaaZsyy7onJLg==.new
- /data/data/####/databases/mpush_game.db-journal
- /data/data/####/files/oX10W95WSDkGp2w5-TtS1hSM7u3yDoK2LpCmHw==/yWTQPs9m5ucTwqUDgkANMQ==/sfDEcvArz1x4okKc
- /data/data/####/files/oX10W95WSDkGp2w5-TtS1hSM7u3yDoK2LpCmHw==/mF1f3GEoIx_IxqbAYcLnYw==.new
- /data/data/####/files/rdata_comdsfkrdfwdhjawe.new
- /sdcard/Download/data/cn.cmgame.sdk/sdk_prefs.txt
- /sdcard/.tcookieid
- /data/data/####/app_lemuellabs_reserved/54ab6ed88190a984.jar
- /data/data/####/files/ED.ini
- /data/data/####/files/UNITEDPAYACTLIST_
- /data/data/####/files/mgAS.dat
- /data/data/####/files/mgSS.dat
- /data/data/####/shared_prefs/pref_file.xml
- /data/data/####/app_lemuellabs_reserved/75fd608818730682.jar
- /data/data/####/files/oX10W95WSDkGp2w5-TtS1hSM7u3yDoK2LpCmHw==/2oXLOnoxvZFHyoYAocimIw==/vCRTluFf7KKYslou.zip
- /data/data/####/files/hbilling.dat
- /sdcard/Download/data/cn.cmgame.sdk/ShareData.txt
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/shared_prefs/td_pefercen_profile.xml
- /sdcard/Download/data/cn.cmgame.sdk/msgflag.txt
- /data/data/####/files/oX10W95WSDkGp2w5-TtS1hSM7u3yDoK2LpCmHw==/Nucu9ElUkLsQf6i8XKvN9A==/data.dat.tmp
- /data/data/####/app_lemuellabs_reserved/codex.so
- /data/data/####/shared_prefs/pref_file.xml.bak
- /data/data/####/temp.dex
- /data/data/####/files/oX10W95WSDkGp2w5-TtS1hSM7u3yDoK2LpCmHw==/mF1f3GEoIx_IxqbAYcLnYw==
- /sdcard/Download/data/cn.cmgame.sdk/log/deviceId.txt
- /data/data/####/files/oX10W95WSDkGp2w5-TtS1hSM7u3yDoK2LpCmHw==/yWTQPs9m5ucTwqUDgkANMQ==/YmnBhr4hT5rBVIBfF4_2rg==
Miscellaneous:
Executes next shell scripts:
- /data/data/####/code-225117/kO7Esr4evl5ZBKS9 -p #### -c com.dsfkrdfw.dhjawe.airba.a.a.c.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- procrank
- ls -l /system/bin/su
- cat /data/anr/traces.txt
- dumpsys meminfo
Contains functionality to send SMS messages automatically.
