Technical information
Malicious functions:
Sends SMS messages:
- 18863718395: kiuizwzifkiadfi,hizzhuuffadwwpk,0001520012,2.0.7,336
Executes code of the following detected threats:
- Android.SmsSend.17051
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- q####.####.com:8080
- d####.####.cn
- d####.####.cn:8888
- a####.####.com
HTTP GET requests:
- d####.####.cn/qingse/img/jp/26.jpg
- d####.####.cn/qingse/img/jp/20.jpg
- d####.####.cn/qingse/img/jp/11.jpg
- d####.####.cn/qingse/img/jp/5.jpg
- d####.####.cn/qingse/img/jp/28.jpg
- d####.####.cn/qingse/img/jp/30.jpg
- d####.####.cn/qingse/img/jp/4.jpg
- d####.####.cn/qingse/img/jp/21.jpg
- d####.####.cn/qingse/img/jp/12.jpg
- d####.####.cn/qingse/img/jp/16.jpg
- d####.####.cn/qingse/img/jp/19.jpg
- d####.####.cn/qingse/img/jp/29.jpg
- d####.####.cn/qingse/img/jp/22.jpg
- d####.####.cn/qingse/img/jp/13.jpg
- d####.####.cn/qingse/img/jp/15.jpg
- d####.####.cn/qingse/img/jp/25.jpg
- d####.####.cn/qingse/img/jp/6.jpg
- d####.####.cn/qingse/img/jp/17.jpg
- d####.####.cn/qingse/img/jp/27.jpg
- d####.####.cn/qingse/img/jp/8.jpg
- d####.####.cn/qingse/img/jp/23.jpg
- d####.####.cn/qingse/img/jp/2.jpg
- d####.####.cn/qingse/img/jp/24.jpg
- d####.####.cn/qingse/img/jp/14.jpg
- d####.####.cn/qingse/img/jp/9.jpg
- d####.####.cn/qingse/img/jp/7.jpg
- d####.####.cn/qingse/img/jp/3.jpg
- d####.####.cn/qingse/img/jp/18.jpg
- d####.####.cn:8888/qingse/img/jp/1.jpg
- d####.####.cn/qingse/img/jp/10.jpg
HTTP POST requests:
- q####.####.com:8080/api.php?act=####&page=####&pageSize=####
- a####.####.com/api/s_get_abs.php
- a####.####.com/api/s_getadJars.php?t=####&re=####
- a####.####.com/api/s_1.php
Modified file system:
Creates the following files:
- /data/data/####/files/cmy.jar
- /data/data/####/shared_prefs/Savefile.xml
- /data/data/####/shared_prefs/Savefile.xml.bak
Miscellaneous:
Contains functionality to send SMS messages automatically.
