Technical information
Malicious functions:
Sends SMS messages:
- 106584211: 5fd3bec6c0a86a604131838572824155本条免费短信用于快速登录，请勿修改
Network activity:
Connecting to:
- h####.####.com
- obf0c####.####.com
- w####.####.com
- haoh####.cn
- haoh####.cn:8080
- a####.####.com
HTTP GET requests:
- w####.####.com/r/p/myspacedata.jsp?vt=####
- w####.####.com/sso/p/logindata.jsp?e_l=####&purl=####
- obf0c####.####.com/visenvt9_9_20160808104730.zip
- a####.####.com/v1/apps/store-control
- a####.####.com/v3/recommend/android
HTTP POST requests:
- haoh####.cn/asg/portal.do
- a####.####.com/app_logs
- h####.####.com/app.gif
- haoh####.cn:8080/asg/portal.do
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/Cookies250026699187743.xml
- /data/data/####/databases/ishugui.db-journal
- /data/data/####/shared_prefs/shared_preferences.xml
- /data/data/####/databases/history.db-journal
- /data/data/####/shared_prefs/3.1.0.xml
- /sdcard/.system/confv9/visen.conf.mark
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.imprint
- /data/data/####/databases/history.db
- /data/data/####/shared_prefs/conf_sp_name.xml
- /data/data/####/databases/intercept_pad.db-journal
- /sdcard/.system/confv9/visen.conf.temp
- /sdcard/baidu/.cuid
- /data/data/####/files/__local_stat_cache.json
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/ishugui.shareInfo.xml
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/shared_prefs/CacheLoader.xml
- /data/data/####/shared_prefs/app_theme_preferences.xml
- /sdcard/.ishugui/.log/reqlog.txt
- /sdcard/.system/confv9/visen.conf
- /data/data/####/shared_prefs/store_control.xml
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
Miscellaneous:
Contains functionality to send SMS messages automatically.
