Technical information
Malicious functions:
Sends SMS messages:
- 075585181130: cyMjUwMDI2Njk5MTg3NzQzIzM1NjUwNzA1OTM1MTg5NSM0LjMuMQ==
Network activity:
Connecting to:
- 1####.####.185
- 1####.####.238
- 1####.####.80
- 1####.####.80:8001
- a####.####.com
- d####.####.com
- g####.####.net
- g####.####.net:8080
- gam####.####.com
- h####.####.com
- i####.####.cn
- s####.####.com
- sd####.####.com
- unitedp####.####.com
- w####.####.com
- w####.####.com:7758
- y####.####.com
HTTP GET requests:
- 1####.####.80/hbilling/10079/hbilling.dat
- 1####.####.80:8001/hbilling/ver
- d####.####.com/egsb/otherPay/querySMSLimitMoney
- s####.####.com/download//pushmessage/image/1496657222285Img.png
- unitedp####.####.com/unitedpaysdk/version
- y####.####.com/group1/M00/00/42/wKgAsFkv4HWEJ5MFAAAAADqFJmY489.jpg
HTTP POST requests:
- 1####.####.185/
- 1####.####.238/updata/interface.html
- a####.####.com/app_logs
- g####.####.net/migusdk/verification/checkSdkUpdate
- g####.####.net:8080/migusdk/tl/initcttl
- gam####.####.com/standalone/thirdpaySupportList
- h####.####.com/app.gif
- i####.####.cn/iplookup/iplookup.php
- sd####.####.com/behaviorLogging/eventLogging/accept?
- w####.####.com/normandie/QuerySafechargeRuleV2
- w####.####.com:7758/normandie/QueryConfigPolicy
Modified file system:
Creates the following files:
- <Package Folder>/app_lemuellabs_reserved/95f8602e37c41a98.jar
- <Package Folder>/app_lemuellabs_reserved/codex.so
- <Package Folder>/app_lemuellabs_reserved/e41a23709078aa37.jar
- <Package Folder>/app_lib/libmiguED.so
- <Package Folder>/databases/chuangwei.db-journal
- <Package Folder>/databases/dk_single_operator.db
- <Package Folder>/databases/dk_single_operator.db-journal
- <Package Folder>/databases/dk_thirdpay.db
- <Package Folder>/databases/dk_thirdpay.db-journal
- <Package Folder>/databases/gp_app.db-journal
- <Package Folder>/files/####/MiguPay.Sdk20.Lib_26002_344EAA6187C551BFE03C528618CB42A2.dat
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/mg20css.dat
- <Package Folder>/files/####/mg20dss.dat
- <Package Folder>/files/.imprint
- <Package Folder>/files/2cb6687eb5__local_last_session.json
- <Package Folder>/files/2cb6687eb5__local_stat_cache.json
- <Package Folder>/files/MiguPay.Sdk20.Lib_26002_344EAA6187C551BFE03C528618CB42A2.dat
- <Package Folder>/files/UNITEDPAYACTLIST_
- <Package Folder>/files/appsdkmg0_.jar
- <Package Folder>/files/hbilling.dat
- <Package Folder>/files/hbilling.dat.temp
- <Package Folder>/files/hbilling.dat.temp (deleted)
- <Package Folder>/files/ly.jar
- <Package Folder>/files/ly.jar.temp (deleted)
- <Package Folder>/files/mg20css.dat
- <Package Folder>/files/mg20dss.dat
- <Package Folder>/files/mg20irid.dat
- <Package Folder>/files/qAueMcUmQkdKZ675pxUFAm3f__local_last_session.json
- <Package Folder>/files/qAueMcUmQkdKZ675pxUFAm3f__local_stat_cache.json
- <Package Folder>/files/sdk_prefs
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/jacruntime.dex
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
- <Package Folder>/shared_prefs/bindcache.xml
- <Package Folder>/shared_prefs/com_dk_shared_preferences.xml
- <Package Folder>/shared_prefs/com_dk_shared_preferences.xml.bak
- <Package Folder>/shared_prefs/com_dk_shared_preferences.xml.bak (deleted)
- <Package Folder>/shared_prefs/isShow.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak (deleted)
- <Package Folder>/shared_prefs/xcngame.xml
- <SD-Card>/Download/####/ShareData.txt
- <SD-Card>/Download/####/deviceId.txt
- <SD-Card>/Download/####/msg.txt
- <SD-Card>/Download/####/msgflag.txt
- <SD-Card>/Download/####/sdk_prefs.txt
- <SD-Card>/baidu/####/pushstat_4.5.1.db
- <SD-Card>/baidu/####/pushstat_4.5.1.db-journal
- <SD-Card>/baidu/.cuid
- <SD-Card>/duoku/####/dklogodata
- <SD-Card>/duoku/####/suspensiondata
Miscellaneous:
Executes next shell scripts:
- /system/bin/sh
- <dexopt>
- app_process /system/bin com.android.commands.pm.Pm list packages
- chmod 777 /data/data/com.mfplay.pbak.baidu/files/ly.jar
- chmod 777 <Package Folder>/files/ly.jar
- ls -l /sbin/su
- ls -l /system/bin/su
- ls -l /system/sbin/su
- ls -l /system/xbin/su
- ls -l /vendor/bin/su
- pm list packages
Contains functionality to send SMS messages automatically.
