Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSpy.3832
Network activity:
Connecting to:
- i####.####.com
- d####.####.cn
- 1####.####.56:9039
- p####.####.com:13579
- p####.####.com
- 1####.####.238:8977
- 1####.####.128:8012
- d####.####.com
- 1####.####.238
- d####.####.com:8083
- 1####.####.56
HTTP GET requests:
- d####.####.com/ml212.jar
- 1####.####.56:9039/gamesit/jysdk/initsdk?os_info=####&os_model=####&net_...
- 1####.####.56//gamesit/xysdk/init
- 1####.####.238/dex/ldsource.bin
- 1####.####.128:8012/get.php?apiKey=####&imsi=####
- i####.####.com/service/getIpInfo2.php?ip=####
- 1####.####.238:8977/dex/version.txt
- 1####.####.56/gamesit/jysdk/inix
- 1####.####.56/gamesit/jysdk/initsdk?os_info=####&os_model=####&net_info=...
- 1####.####.238/dex/version.txt
HTTP POST requests:
- d####.####.com/wimipay/getPhoneUrl
- p####.####.com:13579/SMSpay/api/updateVersion.do?
- d####.####.com/mmsdk/mmsdk?func=####&appkey=####&channel=####&code=####
- p####.####.com/SmsPayServer/sms/extra/getbrushpuv
- p####.####.com/SmsPayServer/sms/initMobile/initInfoNew
- p####.####.com/SmsPayServer/sms/initMobile/province
- d####.####.com/wmserver/WMUpdate
- d####.####.com:8083/
- d####.####.cn/wmwkupdate/WMADUpdate
- d####.####.com/
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/lxdMoblieAgent_sys_config.xml.bak
- <Package Folder>/databases/paycard-journal
- <Package Folder>/shared_prefs/util_preference.xml
- <Package Folder>/databases/milipay_sms_one.db
- <Package Folder>/shared_prefs/lxdMoblieAgent_upload_<Package>.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/databases/database-journal
- <Package Folder>/shared_prefs/statistics_soft_list_time.xml
- <Package Folder>/databases/utopay.db
- <Package Folder>/files/mj.dex
- <Package Folder>/files/.libs/libkjOnlinePay.so
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/lxdMoblieAgent_state_<Package>.xml.bak
- <Package Folder>/app_dex/28419B5C4AA334C3655D5AF1901AB735.dex
- <Package Folder>/shared_prefs/version.dat.xml
- <Package Folder>/databases/webview.db
- <Package Folder>/shared_prefs/zhangpay_share.xml
- <Package Folder>/files/goonpost.info
- <Package Folder>/databases/lepeng.db
- <Package Folder>/shared_prefs/jmsdk.dat.xml
- <Package Folder>/shared_prefs/phoneInfo.xml
- <Package Folder>/files/actlxd4
- <Package Folder>/files/.libs/libdsms.so
- <Package Folder>/files/mj.apk
- <Package Folder>/shared_prefs/zhangpay_sms_info.xml
- <Package Folder>/files/cache.info
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/shared_prefs/lxdMoblieAgent_sys_config.xml
- <Package Folder>/libus.lock
- <Package Folder>/files/jarinfo.info
- <Package Folder>/shared_prefs/zhangpay_share.xml.bak
- <Package Folder>/databases/lepeng.db-journal
- <Package Folder>/files/actlxd0
- <Package Folder>/databases/utopay.db-journal
- <Package Folder>/databases/milipay_sms_one.db-journal
- <Package Folder>/shared_prefs/lxdMoblieAgent_event_<Package>.xml
- <Package Folder>/files/.libs/libn0base.so
- <Package Folder>/files/.libs/libus.so
- <Package Folder>/shared_prefs/lxdMoblieAgent_state_<Package>.xml
- <Package Folder>/hunt.conf
- <Package Folder>/files/actlxd3
- <Package Folder>/databases/database
- <Package Folder>/cache/ml206.dex
- <Package Folder>/databases/paycard
- <Package Folder>/cache/info/ml206.jar
- <Package Folder>/databases/webviewCookiesChromium.db
- <Package Folder>/shared_prefs/iapppay_config.xml
- <Package Folder>/shared_prefs/Wimipay_System.xml
- <Package Folder>/files/28419B5C4AA334C3655D5AF1901AB735.jar
- <Package Folder>/shared_prefs/lxdMoblieAgent_config_<Package>.xml
- <Package Folder>/app_dex/classes.jar
- <Package Folder>/files/.libs/libcrypt_sign.so
- <Package Folder>/files/.libs/libcryptooperad.so
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/lxdMoblieAgent_upload_<Package>.xml.bak
- <Package Folder>/EOZTzhVG.jar
- <Package Folder>/files/.libs/libhunt.so
- <Package Folder>/files/evnlxd2
- <Package Folder>/app_dex/classes.dex
- <Package Folder>/files/syslxd1
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- <dexopt>
- getprop apps.customerservice.device
Contains functionality to send SMS messages automatically.
