Technical information
Malicious functions:
Sends SMS messages:
- LBrH: LBrH
- 10667766: AA67FD
- 106581673061: AP3
- 106604306: BK*9003
- 106604306: BK*52U
- 1065800830195468: 100#L71027
- 1065888018: DM340
- 1065800830195202: 100#L61000a2
- 1065800830195468: 100#L845
- 10660662: 1015211
- 12114: dyl#####,####,6000123-1-70418-ZZ_x00014-0
- 106618281: RB104
- 800011: 1absse
- 106604306: BK*298
- 10660840: CG01
- 1065800830195364: 100#5364UA71
- 106620009: 1Y81
- 1065888018: HYB1
- 1065888018: DM67W
- 10629922: tp536
- 106618281: RGf02
- 10658008101815775: 080#8#BZra#merexpand#886#fe638041674662c4
- 106575206321505460: dyl#####,####,6000123-1-70418-ZZ_x00014-0
- 12114516412: systemcGx1dG8yNTAwMjY2OTkxODc3NDM=
- 1065800810025828: 100#008080206
- 12114: HZSY#####
- 1065888018: HY6BT
Executes code of the following detected threats:
- Android.Spy.205.origin
- Android.SmsSend.1848.origin
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- a####.####.com:6099
- mobil####.####.com
- o####.####.com
- s####.####.cn
- a####.####.site:8090
- collec####.####.com
- p####.####.cn
- l####.####.com
- greenxs####.net
- 1####.####.4
- a####.####.com
HTTP GET requests:
- greenxs####.net/resource!chargeUpdate?resTypes=####&dexId=####&dexVer=##...
- greenxs####.net/resource!resource?resTypes=####&appid=####&channel=####&...
- greenxs####.net/doking/smsd!hiGo.action?t=####&dexId=####&dexVer=####&ap...
- greenxs####.net/active!activeLog.action?provider=####&clickId=####&manu=...
- a####.####.com:6099/sunnyinit?channel=####&imsi=####&calltime=####&callc...
- 1####.####.4/update/updateclz.zip
- s####.####.cn/getconfig.aspx?
- a####.####.site:8090/phoneget?cpid=####&ismi=####&calltime=####&callcoun...
- a####.####.com/sunnyinit?channel=####&imsi=####&calltime=####&callcount=...
HTTP POST requests:
- l####.####.com/sp/getSPCode
- greenxs####.net/shop/shop_upload_log
- p####.####.cn/index.php/API
- collec####.####.com/pay-sms-access//getAccessPayChannel.json
- l####.####.com/zf/getAll
- mobil####.####.com/mobile-service/getOpenImsiMobilePhone.json
- collec####.####.com/pay-data-collect/collectAppStartUserData.json
- o####.####.com/v2/get_update_time
- collec####.####.com/pay-sms-access//uploadOpenPayOrderResult.json?
- collec####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
- greenxs####.net/mobilepay/v2/getPayInfoListX3.do
- o####.####.com/v2/check_config_update
- l####.####.com/wxqk/hmAdd
- a####.####.com/app_logs
- mobil####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
- l####.####.com/ip/getIPCode
- collec####.####.com/pay-data-collect/uploadClientCrashLog.json
- l####.####.com/cn/getADCF
- collec####.####.com/pay-data-collect/uploadChannelNormalData.json
Miscellaneous:
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
