Technical information
Malicious functions:
Sends SMS messages:
- 12114: HZSY#####
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- p####.####.com:8080
- sm####.####.com
- mobil####.####.com
- p####.####.com
- a####.####.com
- json####.####.com
- collec####.####.com
HTTP GET requests:
- json####.####.com/adchannelversion/9.1.0.0426_ad_planlinkchannelanversio...
- json####.####.com/adplans/31f72f43289211e7bb779c37f405e458.js
- json####.####.com/adplans/3201f0a5289211e7bb779c37f405e458.js
- json####.####.com/adplans/31fbd6b6289211e7bb779c37f405e458.js
HTTP POST requests:
- collec####.####.com/mobile-service/getOpenImsiMobilePhone.json
- p####.####.com:8080/me/publish/activate
- mobil####.####.com/mobile-service/getOpenImsiMobilePhone.json
- collec####.####.com/pay-data-collect/collectAppStartUserData.json
- sm####.####.com/pay-sms-access//getAccessPayChannel.json
- p####.####.com/me/publish/spinfo
- sm####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
- a####.####.com/app_logs
- p####.####.com:8080/me/publish/spinfo
- collec####.####.com/pay-data-collect/uploadChannelNormalData.json
Modified file system:
Creates the following files:
- /data/data/####/databases/cc.db-journal
- /data/data/####/cache/sms.apk.apk
- /data/data/####/databases/ua.db
- /data/data/####/shared_prefs/sy_pay_config.xml.bak
- /data/data/####/databases/cc.db
- /data/data/####/shared_prefs/31fbd6b6289211e7bb779c37f405e458config.xml
- /data/data/####/shared_prefs/plugins.serviceMapping.xml
- /data/data/####/shared_prefs/fangan_aliyunconfig.xml
- /data/data/####/databases/ua.db-journal
- /data/data/####/shared_prefs/phoneInfo.xml
- /data/data/####/shared_prefs/price_infoconfig.xml
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/shared_prefs/plant_id_fileconfig.xml
- /data/data/####/app_apCoreplugn/sms.apk
- /data/data/####/cache/smp.apk.apk
- /data/data/####/shared_prefs/3201f0a5289211e7bb779c37f405e458config.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/plugins.installed.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/MlVideo/files/user_id
- /data/data/####/files/.imprint
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk
- /data/data/####/app_apCoreplugn/ZIP/plugin-20170302-2.1.8.6.3.bin
- /data/data/####/databases/com.souying.pay.plugmain_sy_pay_record-journal
- /data/data/####/files/exid.dat
- /sdcard/Android/obj/.um/sysid.dat
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk
- /data/data/####/shared_prefs/com.souying.pay.xml
- /data/data/####/app_apCoreplugn/smp.apk
- /data/data/####/files/umeng_it.cache
- /data/data/####/databases/recordInfo-journal
- /data/data/####/shared_prefs/tab_planconfig.xml
- /sdcard/Android/data/.um/sysid.dat
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/activate.xml
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/sy_pay_config.xml
- /data/data/####/shared_prefs/com.souying.pay.plugmain_p_config.xml
- /data/data/####/shared_prefs/user_idconfig.xml
Miscellaneous:
Executes next shell scripts:
- cat /proc/version
Contains functionality to send SMS messages automatically.
