Technical information
Malicious functions:
Sends SMS messages:
- 12114: ####A
- 13777409245: ####A
Prompts to install third-party applications.
Network activity:
Connecting to:
- s####.####.com
- a####.####.com:10087
- 2####.####.146
- tb####.com
- s####.####.cn
- c####.####.com
- b####.####.cn
- 1####.####.28:9000
- c####.####.cn
- a####.####.com
HTTP GET requests:
- 2####.####.146/api3/paycodev3.php?imsi=####
- 2####.####.146/api3/tongji2.php?imei=####&channelid=####&imsi=####&code=...
- b####.####.cn/tiyan33a.jpg
- c####.####.com/video/img/head2/hd13.jpg
- c####.####.cn/usericon/u8.jpg
- c####.####.com/97video/img/tiyan3.jpg
- b####.####.cn/tiyan10.jpg
- b####.####.cn/tiyan29q.jpg
- b####.####.cn/tiyan7.jpg
- 2####.####.146/api3/paycodev4.php?imsi=####
- tb####.com/image/rp07.jpg
- tb####.com/image/rp04.jpg
- c####.####.com/czav/icon/4.jpg
- tb####.com/image/rp11.jpg
- s####.####.cn/getconfig.aspx?
- c####.####.com/97video/img/tiyan16.jpg
- b####.####.cn/tiyan14.jpg
- s####.####.com/versioncheck.aspx?
- b####.####.cn/tiyan24.jpg
- 2####.####.146/Manerger/index.php/Negative/index/auth/89511
- c####.####.com/czav/jpg/hellogirl.jpg
- b####.####.cn/tiyan37a.jpg
- b####.####.cn/tiyan11.jpg
- c####.####.com/czav/icon/71.jpg
- tb####.com/image/rp05.jpg
- c####.####.com/czav/icon/55.jpg
- c####.####.com/97video/img/tiyan19.jpg
- b####.####.cn/tiyan32a.jpg
- tb####.com/image/rp08.jpg
- c####.####.com/97video/img/tiyan23.jpg
- s####.####.com/getconfig.aspx?
- b####.####.cn/tiyan30a.jpg
- c####.####.com/video/img/head2/hd21.jpg
- c####.####.com/czav/icon/3.jpg
- b####.####.cn/tiyan15.jpg
- b####.####.cn/tiyan13.jpg
- tb####.com/image/rp19.jpg
- c####.####.cn/usericon/u9.jpg
- c####.####.com/video/img/head2/hd14.jpg
- tb####.com/image/rp10.jpg
- tb####.com/image/rp13.jpg
- tb####.com/image/rp06.jpg
- c####.####.com/czav/icon/25.jpg
- c####.####.com/video/img/head2/hd2.jpg
- b####.####.cn/tiyan26.jpg
- b####.####.cn/tiyan21.jpg
- s####.####.cn/versioncheck.aspx?
- b####.####.cn/tiyan9.jpg
- c####.####.com/czav/icon/29.jpg
- b####.####.cn/tiyan17.jpg
- c####.####.com/97video/img/tiyan22.jpg
- tb####.com/image/rp14.jpg
- b####.####.cn/tiyan17.mp4
- b####.####.cn/tiyan28q.jpg
- c####.####.com/czav/jpg/pay_p6.jpg
- b####.####.cn/tiyan36a.jpg
- 2####.####.146/Manerger/index.php/Negative/index
- c####.####.com/97video/img/tiyan18.jpg
- b####.####.cn/tiyan2.jpg
- 2####.####.146/pay_ver/verify.php?order=####&imei=####&imsi=####
- b####.####.cn/tiyan20.jpg
HTTP POST requests:
- a####.####.com:10087/api.php?s=####
- a####.####.com/api.php?s=####
- a####.####.com/app_logs
- 1####.####.28:9000/mvmanager/device/isUserRegister
Modified file system:
Creates the following files:
- /sdcard/av/imagecache/cdn.jore123.com_video_img_head2_hd13.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan24.jpg
- /data/data/####/databases/cc/cc.db-journal
- /sdcard/av/imagecache/cdn.jore123.com_czav_icon_4.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan20.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan36a.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan29q.jpg
- /sdcard/av/imagecache/cdn.jore123.com_video_img_head2_hd21.jpg
- /data/data/####/databases/cc/cc.db
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan32a.jpg
- /sdcard/Android/data/kfmuje.bpgo.bukp/cache/.nomedia
- /sdcard/av/imagecache/cdn.jore123.com_czav_jpg_hellogirl.jpg
- /sdcard/av/imagecache/cdn.jore123.com_czav_jpg_pay_p6.jpg
- /sdcard/av/imagecache/cdn.jore123.com_czav_icon_25.jpg
- /sdcard/Android/data/kfmuje.bpgo.bukp/cache/uil-images/1857460818.0.tmp
- /sdcard/av/imagecache/cdn.ccrtj.com_97video_img_tiyan19.jpg
- /sdcard/av/imagecache/cdn.ccrtj.com_97video_img_tiyan3.jpg
- /data/data/####/shared_prefs/MGTVCommon.xml
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan17.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan7.jpg
- /sdcard/Android/data/kfmuje.bpgo.bukp/cache/uil-images/1829755188.0.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Android/data/kfmuje.bpgo.bukp/cache/uil-images/1830678709.0.tmp
- /sdcard/Android/data/kfmuje.bpgo.bukp/cache/uil-images/1858384339.0.tmp
- /sdcard/av/imagecache/cdn.ccrtj.com_97video_img_tiyan22.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan13.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan37a.jpg
- /sdcard/av/imagecache/cdn.chpia.cn_usericon_u9.jpg
- /data/data/####/files/mobclick_agent_cached_####2147483647
- /sdcard/Android/data/kfmuje.bpgo.bukp/cache/uil-images/1831602230.0.tmp
- /sdcard/av/imagecache/cdn.jore123.com_czav_icon_71.jpg
- /sdcard/av/imagecache/cdn.ccrtj.com_97video_img_tiyan18.jpg
- /sdcard/av/imagecache/cdn.jore123.com_video_img_head2_hd2.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan15.jpg
- /sdcard/av/imagecache/cdn.jore123.com_czav_icon_3.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan28q.jpg
- /sdcard/Android/data/kfmuje.bpgo.bukp/cache/uil-images/1863001944.0.tmp
- /sdcard/av/imagecache/cdn.jore123.com_video_img_head2_hd14.jpg
- /sdcard/av/imagecache/cdn.jore123.com_czav_icon_29.jpg
- /sdcard/Android/data/kfmuje.bpgo.bukp/cache/uil-images/1854690255.0.tmp
- /sdcard/av/imagecache/cdn.ccrtj.com_97video_img_tiyan23.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan10.jpg
- /sdcard/av/imagecache/cdn.jore123.com_czav_icon_55.jpg
- /sdcard/av/imagecache/cdn.ccrtj.com_97video_img_tiyan16.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan26.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan2.jpg
- /sdcard/Android/data/kfmuje.bpgo.bukp/cache/uil-images/journal.tmp
- /sdcard/Android/data/kfmuje.bpgo.bukp/cache/uil-images/1832525751.0.tmp
- /sdcard/av/imagecache/cdn.chpia.cn_usericon_u8.jpg
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan9.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan21.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan30a.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan11.jpg
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan33a.jpg
- /sdcard/Android/data/kfmuje.bpgo.bukp/cache/uil-images/1855613776.0.tmp
- /sdcard/av/imagecache/baidu.jinyuefz.com.cn_tiyan14.jpg
- /sdcard/Android/data/kfmuje.bpgo.bukp/cache/uil-images/1833449272.0.tmp
Miscellaneous:
Contains functionality to send SMS messages automatically.
