Technical information
Malicious functions:
Sends SMS messages:
- 12114: dyl#####,####,6000076-1-14-zz_rlys_2-0
- 106904006189121: myqxt####
- 12114000372329: i2mPNk1AOWWu6IO69LttHIXkg==
- 12114: yzw#####A
- 106575206321505460: dyl#####,####,6000076-1-14-zz_rlys_2-0
Executes code of the following detected threats:
- Android.SmsSend.17836
- Android.SmsSend.17837
- Android.Triada.248.origin
- Android.Backdoor.285.origin
- Android.DownLoader.441.origin
- Android.SmsSend.777.origin
- Android.Triada.226.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.285.origin
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- huangda####.com
- ut####.cn
- 1####.####.27:8087
- i####.####.com
- 2####.####.31
- p####.####.com
- 1####.####.111
- s####.####.com
- s####.####.cn
- 6####.####.140
- pass####.####.cn
- a####.####.com:8088
- d####.####.com:8080
- up####.####.info:6020
- up####.####.info
- p####.####.com:7820
- 1####.####.111:8001
- a####.####.com
- d####.####.com
HTTP GET requests:
- 1####.####.27:8087/Larva-inf/charge?body=####&sign=####
- p####.####.com/?igtcmd=####&nativePayCmd=####
- s####.####.cn/getconfig.aspx?
- p####.####.com/?igtcmd=####&nativePayCmd=####&imsi=####
- pass####.####.cn/client/authRequest
- d####.####.com:8080/upload/plugin/net.tt.plugin.myadv_p20170309134229
- s####.####.com/versioncheck.aspx?
- i####.####.com/ando-res/m/4HjBJu51SRZ6w2qcEzn09SbmXnxQ8vbP2y*I88C1gtWjo-...
- 1####.####.111:8001/APP/AppTask.aspx
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- s####.####.com/GetFeeData.aspx?iswifi=####
- 2####.####.31/dl01.toucht.net/update/plugin-release-v4.9.3.zip?wsiphost=...
- d####.####.com/upload/plugin/net.tt.plugin.mysdk_p20170419142856
- 1####.####.111/APP/GetFeePoint.aspx
- a####.####.com:8088/earth/enable?deviceid=####&version=####&imsi=####
- s####.####.com/getconfig.aspx?
- p####.####.com/?igtcmd%####
- p####.####.com/openplg?appid=####&channelid=####
- d####.####.com/upload/plugin/net.tt.plugin.yuanyu_p20170411110136
- s####.####.cn/versioncheck.aspx?
- d####.####.com/update/plugin-release-v4.9.3.zip
- d####.####.com/upload/plugin/net.tt.plugin.shangan_p20170401110757
- p####.####.com/?igtcmd=####&nativePayCmd=####&iccid=####&price=####&imsi...
- p####.####.com/openicon?appid=####&channelid=####
- p####.####.com/?igtcmd=####&order=####&state=####&paymsg=####&fingerprin...
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- p####.####.com/?igtcmd=####&iccid=####&imsi=####&imei=####&order=####&um...
HTTP POST requests:
- p####.####.com/
- 6####.####.140/ando/x/liv?app_id=####&r=####
- p####.####.com:7820/
- up####.####.info:6020/
- ut####.cn/excalibur/avalon/sdk/init.aspx
- up####.####.info/
- a####.####.com/app_logs
- huangda####.com/shop/shop_upload_log
- ut####.cn/excalibur/avalon/sdk/pay.aspx
Droppers:
Downloaded by the following detected threats from the Web:
- Android.DownLoader.329.origin
Modified file system:
Creates the following files:
- /data/data/####/files/net.tt.plugin.yufeng.apk
- /data/data/####/Plugin/net.tt.plugin.yuanyu/apk/base-1.apk
- /data/anr/traces.txt
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/.config
- /data/data/####/Plugin/net.tt.plugin.zhongzhi/apk/base-1.apk
- /data/data/####/files/net.tt.plugin.mysdk.apk
- /data/data/####/Plugin/net.tt.plugin.mysdk/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/ShareFiles.xml
- /data/data/####/files/net.tt.plugin.shangan.apk
- /data/data/####/Plugin/net.tt.plugin.shangan/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.myadv/dalvik-cache/base-1.dex
- /data/data/####/files/splash.dat
- /data/data/####/Plugin/net.tt.plugin.damai/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.zhongzhi/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/third_info.xml
- /sdcard/.d080d3a37b0be7bc7c15c0a5ac76bc64/zip/74606096-625d-4271-b0cc-1a42d860be4c.zip
- /data/data/####/files/mobclick_agent_cached_####
- /data/data/####/Plugin/net.tt.plugin.shangan/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.yuanyu.apk
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /sdcard/.env/.uunique.new
- /data/data/####/Plugin/net.tt.plugin.myadv/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.yuanyu/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.mysdk
- /data/data/####/files/net.tt.plugin.yuanyu
- /data/data/####/files/net.tt.plugin.zhongzhi.apk
- /data/data/####/Plugin/net.tt.plugin.damai/apk/base-1.apk
- /sdcard/.twservice/qshp_3003_2234/tw
- /data/data/####/Plugin/net.tt.plugin.taiku/apk/base-1.apk
- /data/data/####/files/net.tt.plugin.shangan
- /data/data/####/Plugin/net.tt.plugin.taiku/dalvik-cache/base-1.dex
- /sdcard/.tpservice/net.tt.plugin.taiku/download/jar/qsha_80001_5091.jar
- /sdcard/.twservice/qshp_3003_2234.zip
- /data/data/####/shared_prefs/game_state_file.xml
- /sdcard/com.zckj.files/u.apk
- /data/data/####/Plugin/net.tt.plugin.mysdk/Signature/Signature_0.key
- /sdcard/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- /data/data/####/Plugin/net.tt.plugin.yufeng/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.taiku.apk
- /data/data/####/Plugin/net.tt.plugin.yufeng/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.damai/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.myadv.apk
- /sdcard/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- /data/data/####/Plugin/net.tt.plugin.taiku/Signature/Signature_0.key
- /data/data/####/files/net.tt.plugin.myadv
- /data/data/####/Plugin/net.tt.plugin.yuanyu/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.myadv/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.yufeng/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.mysdk/apk/base-1.apk
- /data/data/####/files/net.tt.plugin.damai.apk
- /data/data/####/shared_prefs/userinfo_file.xml
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/Plugin/net.tt.plugin.zhongzhi/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.shangan/apk/base-1.apk
- /data/data/####/files/b6262d4c716eb973166f7e0d0f86a49c.apk
Miscellaneous:
Executes next shell scripts:
- dumpsys meminfo
- cat /sys/block/mmcblk0/device/cid
- cat /data/anr/traces.txt
- chmod -R 755 /data/data/####/Plugin
- getprop apps.customerservice.device
- procrank
Contains functionality to send SMS messages automatically.
