Technical information
Malicious functions:
Sends SMS messages:
- 12114516403: cygx#1000820
- 12114516403: cygx#1000819
Network activity:
Connecting to:
- 9####.com
- o####.####.com
- p####.####.com
- i####.####.com
HTTP GET requests:
- o####.####.com/assets/js/login.js?v=####
- o####.####.com/assets/css/login.css
- i####.####.com/service/getIpInfo2.php?ip=####
- 9####.com/templates/37skin/css/index.css
- 9####.com/static/js/jquery.js
- 9####.com/static1/css/main_v2.css
- 9####.com/static1/css/header.css
- 9####.com/index.html
- o####.####.com/assets/image/LOGO.png
- o####.####.com/assets/css/public.css
- o####.####.com/assets/css/reg.css
- o####.####.com/assets/js/jquery.validate.js?v=####
- o####.####.com/assets/js/public.js?v=####
- o####.####.com/assets/js/jquery-1.11.3.js?v=####
- o####.####.com/authorize?response_type=####&client_secret=####&redirect_...
- 9####.com/?code=####
- o####.####.com/assets/image/pwd_hidden.png
- o####.####.com/assets/js/jquery.validate.extend.js?v=####
- o####.####.com/assets/image/clear.png
- o####.####.com/authorize?client_id=####&client_secret=####&redirect_uri=...
- o####.####.com/assets/image/Refresh.png
- 9####.com/templates/37skin/css/base.css
- o####.####.com/assets/image/warn.png
HTTP POST requests:
- o####.####.com/accesstoken
- p####.####.com/egc/code/v2/codeFilter.do
- p####.####.com/egc//user/v2/query_phone_num.do
- p####.####.com/egc/sms/v2/smsFilter.do
- o####.####.com/login
- p####.####.com/egc/code/v2/init.do
- p####.####.com/egc/paysdk/order/1/create.do
- p####.####.com/egc/paysdk/log/v2/create.do
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/sdk.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/shared_prefs/sdk.xml.bak
- /data/data/####/databases/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/Android/data/####/files/cache/efida_pay_config.dat
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/databases/database-journal
- /data/data/####/app_down/_tt.jar
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/shared_prefs/zhangpay_sms_info.xml
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 40 40 156868 /data/data/####/app_down/_tt.jar 1225280561 -224211924 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fr
Contains functionality to send SMS messages automatically.
