Technical information
Malicious functions:
Sends SMS messages:
- 12114: HZSY#####
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- yys####.####.com
- mmy####.####.com
- mo####.####.com
- omujr####.####.com
- priceru####.####.com
HTTP GET requests:
- mmy####.####.com/mmys-cps/appUpgrade.service?deviceId=####&uuid=####&ime...
- mmy####.####.com/mmys-cps/secVideoChlList2.service?cv=####&pageSize=####...
- mmy####.####.com/mmys-cps/runConfig.service?deviceId=####&uuid=####&imei...
- yys####.####.com/yysd-cps/upList.service?deviceId=####&uuid=####&imei=##...
- mmy####.####.com/mmys-cps/styleTopChlVideo.service?pageNo=####&pageSize=...
- mmy####.####.com/mmys-cps/secVideoChlList2.service?pageNo=####&pageSize=...
- omujr####.####.com/parkedmmys?deviceId=####&uuid=####&imei=####&imsi=###...
- mmy####.####.com/mmys-cps/rdContent.service?deviceId=####&uuid=####&imei...
- yys####.####.com/yysd-cps/plugSwitch.service?&deviceId=####&uuid=####&im...
- mmy####.####.com/mmys-cps/searchBlur.service?word=####&rv=####&pageNo=##...
- mmy####.####.com/mmys-cps/bannerInfo.service?showStyle=####&deviceId=###...
- priceru####.####.com/price-rule-cmp/rule/matchRule?version=####&deviceId...
HTTP POST requests:
- mmy####.####.com/sdk-update/sdkUpdateCdnUpload.json
- mmy####.####.com/mmys-cps/userActivation.service?deviceId=####&uuid=####...
- yys####.####.com/dynamicpay//noteStats.json?
- mo####.####.com/mobile-service/getImsiMobilePhone.json
- mmy####.####.com/mmys-cps/searchWordsStat.service?word=####&deviceId=###...
- yys####.####.com/dynamicpay//getSyFormalChannels.json?
- mmy####.####.com/mmys-cps/userVisit.service?deviceId=####&uuid=####&imei...
Modified file system:
Creates the following files:
- /data/data/####/databases/p_db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/gaClientId
- /data/data/####/databases/recommend_app-journal
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/databases/p_db
- /data/data/####/databases/google_analytics_v2.db-journal
- /data/data/####/databases/upgrade_app-journal
- /data/data/####/databases/statistics_db
- /data/data/####/databases/statistics_db-journal
- /data/data/####/shared_prefs/common.xml
- /sdcard/SYPAYFILENAME/CACHE/SMSCACHE/ISDELSMS
- /data/data/####/databases/sy_video_data_cache-journal
- /data/data/####/shared_prefs/p_config.xml
- /data/data/####/shared_prefs/ds_configer.xml
Miscellaneous:
Contains functionality to send SMS messages automatically.
