Technical information
Malicious functions:
Sends SMS messages:
- 075585181130: cyMjUwMDI2Njk5MTg3NzQzIzM1NjUwNzA1OTM1MTg5NSM0LjMuMQ==
Network activity:
Connecting to:
- 2####.####.140
- 1####.####.80:8000
- 2####.####.140:8080
- 1####.####.67
- unitedp####.####.com
- g####.####.net:8080
- sd####.####.com
- 1####.####.80
- p####.####.com
- w####.####.com:7758
- d####.####.com
- 1####.####.192
- 1####.####.238
- g####.####.net
HTTP GET requests:
- d####.####.com/egsb/otherPay/querySMSLimitMoney
- d####.####.com/egsb/startup/queryConfiguration?channelId=####&contentId=####&gameType=####
- 1####.####.67/codex/version
- 1####.####.192/unitedpay_sdk/version
- unitedp####.####.com/numberbank/interface?getInfo=####
HTTP POST requests:
- 2####.####.140:8080/migusdk/tl/enclog
- p####.####.com/api/q/a/3f6ec4da684547211e371a67946d85757
- 1####.####.80/intp/ded7060cd675907e7d5f6e59d91c966bddc5e587
- sd####.####.com/behaviorLogging/eventLogging/accept?
- d####.####.com/egsb/verification/getUpdateUrl
- d####.####.com/egsb/verification/checkSdkUpdate
- 1####.####.238/updata/interface.html
- d####.####.com/egsb/activityCfg/queryCfgAct
- g####.####.net:8080/migusdk/tl/tcttl
- 1####.####.80:8000/intp/ded7060cd675907e7d5f6e59d91c966bddc5e587
- g####.####.net/migusdk/tl/tcttl
- 2####.####.140/migusdk/tl/enclog
- d####.####.com/egsb/desktopShortcut/queryAll
- d####.####.com/egsb/otherPay/querySMSInterceptorConf
- d####.####.com/egsb/gshare/switches
- g####.####.net/migusdk/verification/checkSdkUpdate
- d####.####.com/egsb/game/getPaymentCapability
- w####.####.com:7758/normandie/QueryConfigPolicy
- d####.####.com/egsb/thirdPay/queryThirdPayInfo
Modified file system:
Creates the following files:
- /data/data/####/files/kS9x1U8UZPfjZlZT_xdMnMxCMRQCm9JhRcHtZw==/bMQwBhR2CKBu1hdoLE8QAA==.new
- /data/data/####/files/edfile/armeabi/libmiguED.so
- /data/data/####/files/mgid.dat
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
- /data/data/####/files/MiguPay.Sdk30.Lib_12003003_4d4c7afc770b3429d59fe361edcdfd5f_BN202.dat
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml
- /data/data/####/files/libmgRun_04.22.05_01.so
- /data/data/####/files/MiguPay.Sdk30.Lib_12003003_4d4c7afc770b3429d59fe361edcdfd5f_BN202.cod
- /data/data/####/files/mpush_gateway_preferences_file
- /data/data/####/shared_prefs/td_pefercen_profile.xml.bak
- /data/data/####/app_lemuellabs_reserved_/lemuel_security_inner.so
- /data/data/####/files/ly.jar
- /data/data/####/app_lemuellabs_reserved_/6c1b0146f46767ca.jar
- /data/data/####/files/mgSS.dat
- /data/data/####/app_lemuellabs_reserved_/codex_inner.so
- /data/data/####/files/UNITEDPAYACTLIST_
- /data/data/####/databases/mpush_game.db-journal
- /data/data/####/app_lemuellabs_reserved/94d52286c6d6d278.jar
- /data/data/####/app_lemuellabs_reserved/1302cb95b5c728d7.jar
- /sdcard/Download/data/cn.cmgame.sdk/sdk_prefs.txt
- /sdcard/.tcookieid
- /data/data/####/app_lemuellabs_reserved_/3b37893bc3b37226.jar
- /data/data/####/files/ED.ini
- /data/data/####/app_lemuellabs_reserved/03feddd61273c530.jar
- /data/data/####/files/mpush_version_preferences_file
- /data/data/####/files/mgAS.dat
- /data/data/####/files/gecobq_d/gecobq_f.zip
- /data/data/####/shared_prefs/pref_file.xml
- /data/data/####/shared_prefs/3f6ec4da684547211e371a67946d85757|account_file.xml
- /data/data/####/files/hbilling.dat
- /sdcard/Download/data/cn.cmgame.sdk/ShareData.txt
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/shared_prefs/td_pefercen_profile.xml
- /sdcard/Download/data/cn.cmgame.sdk/msgflag.txt
- /data/data/####/files/kS9x1U8UZPfjZlZT_xdMnMxCMRQCm9JhRcHtZw==/ITZnYCEbtfK7nYUcdbuTlA==.new
- /data/data/####/app_lemuellabs_reserved/codex.so
- /data/data/####/shared_prefs/pref_file.xml.bak
- /data/data/####/temp.dex
- /sdcard/Download/data/cn.cmgame.sdk/log/deviceId.txt
Miscellaneous:
Executes next shell scripts:
- ls -l /system/bin/su
Contains functionality to send SMS messages automatically.
