Android.SmsSend.15463

Technical information

Malicious functions:

Sends SMS messages:

1069009512114: 苏州易N支付##########

Network activity:

Connecting to:

i####.####.com
1####.####.212:9002
7x####.####.com
o####.####.com
1####.cn
i####.####.com:8081
d####.####.com
1####.####.90
w####.####.com
w####.cn
ut####.cn:8080
a####.####.com

HTTP GET requests:

a####.####.com/dianbo%2Fimg%2Fb_3.jpg
a####.####.com/dianbo%2Fvip_info
a####.####.com/dianbo%2Fimg%2F15.jpg
a####.####.com/dianbo%2Fimg%2F61.jpg
7x####.####.com/videoimg_55.jpg
a####.####.com/dianbo%2Fimg%2F19.jpg
a####.####.com/dianbo%2Fimg%2F54.jpg
a####.####.com/dianbo%2Fimg%2F9.jpg
a####.####.com/location/ip?ak=####
i####.####.com/ZBZP/1.26/4.jpg
a####.####.com/dianbo%2Fimg%2F57.jpg
i####.####.com/ZBZP/1.26/32.jpg
a####.####.com/dianbo%2Fimg%2F51.jpg
i####.####.com/service/getIpInfo2.php?ip=####
a####.####.com/dianbo%2Fimg%2Fgg_2.jpg
a####.####.com/dianbo%2Fimg%2F1_5.jpg
w####.####.com/r/374577408/index.htm?cm=####
1####.####.90/code/init?app=####&lon=####&count=####&imei=####&iccid=####&nwtype=####&ctech=####&aimsi=####&cpid=####&cid=####&osversion=####&pck=####...
a####.####.com/dianbo%2Fimg%2F11.jpg
a####.####.com/dianbo%2Fimg%2F47.jpg
i####.####.com/APP/AppTask.aspx
a####.####.com/dianbo%2Fimg%2Fbanner_03.jpg
o####.####.com/wmapp/update/d_data_wimipay.dat
a####.####.com/dianbo%2Fimg%2F58.jpg
a####.####.com/dianbo%2Fimg%2F1_6.jpg
a####.####.com/dianbo%2Fimg%2Ffree_img%2F2.jpg
a####.####.com/dianbo%2Fimg%2F42.jpg
a####.####.com/dianbo%2Fimg%2F48.jpg
a####.####.com/dianbo%2Fimg%2F59.jpg
a####.####.com/dianbo%2Fimg%2F10.jpg
a####.####.com/dianbo%2Fimg%2F1_b.jpg
a####.####.com/dianbo%2Fimg%2F37.jpg
a####.####.com/dianbo%2Fimage%2Fshikan_1.jpg
i####.####.com/ZBZP/1.26/3.jpg
a####.####.com/dianbo%2Fimg%2F52.jpg
a####.####.com/dianbo%2Fimg%2F20.jpg
a####.####.com/dianbo%2Fimg%2F53.jpg
a####.####.com/dianbo%2Fimg%2F1.jpg
a####.####.com/dianbo%2Fpay_mode
a####.####.com/dianbo%2Fimg%2F60.jpg
a####.####.com/dianbo%2Fimg%2F56.jpg
a####.####.com/dianbo%2Fimg%2Ffree_img%2F4.jpg
a####.####.com/dianbo%2Fimg%2Fbanner_01.jpg
a####.####.com/dianbo%2Fimg%2F46.jpg
a####.####.com/dianbo%2Fimg%2F2_b.jpg
a####.####.com/dianbo%2Ffree_info
a####.####.com/dianbo%2Fimg%2F4_b_mjzw.jpg
a####.####.com/dianbo%2Fimg%2F50.jpg
a####.####.com/dianbo%2Fimg%2F45.jpg
i####.####.com:8081/ZBZP/1.26/2.jpg
a####.####.com/dianbo%2Fimg%2F7.jpg
a####.####.com/dianbo%2Fbanner_info
a####.####.com/dianbo%2Fimg%2F6.jpg
a####.####.com/dianbo%2Fanchor_info
7x####.####.com/utopay_20170119.zip
a####.####.com/dianbo%2Fimg%2Fbanner_02_2.jpg
a####.####.com/dianbo%2Fimg%2F25.jpg
1####.####.212:9002/install.php?imei=####&imsi=####&provice=####&model=####&os=####&wnet=####&appid=####&freeNode=####&appkey=####&service=####&iccid=...

HTTP POST requests:

d####.####.com/wmserver/WMUpdate
o####.####.com/v2/get_update_time
w####.cn/wosdk/appalive
1####.cn/phone/fetch
o####.####.com/v2/check_config_update
a####.####.com/app_logs
ut####.cn:8080/excalibur/avalon/sdk/init.aspx

Modified file system:

Creates the following files:

/data/data/####/shared_prefs/MmData.xml
/data/data/####/databases/utopay.db-journal
/sdcard/Android/data/####/cache/uil-images/71fw90qtv36f2kfinhyw5laow.0.tmp
/sdcard/Android/data/####/cache/uil-images/53e4nfkjflsvux4de3xe60ngl.0.tmp
/data/data/####/files/212FEFE2A924077B2EF078AC774A9D73.jar
/sdcard/Android/data/####/cache/uil-images/bdlw5ztcqaiy9ijs7em3ejof.0.tmp
/sdcard/Android/data/####/cache/uil-images/13jrjkej9kzgzfvsat1h3g0jl.0.tmp
/sdcard/Android/data/####/cache/uil-images/50ssdew036uq6i24mffnxvj5l.0.tmp
/sdcard/Android/data/####/cache/uil-images/78h2nwil5rwsvig09dfzsolng.0.tmp
/sdcard/Android/data/####/cache/uil-images/1o3cqo5klo9np3no7xxuh4msg.0.tmp
/sdcard/Android/data/####/cache/uil-images/6qauywjpocc4e4g576i4worwp.0.tmp
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/shared_prefs/Wimipay_System.xml
/sdcard/Android/data/####/cache/uil-images/7h4lqumcyumri9996966pdevk.0.tmp
/sdcard/Android/data/####/cache/uil-images/1fde6n2hegajpz15aknq03ipd.0
/data/data/####/databases/lepeng.db-journal
/sdcard/Android/data/####/cache/uil-images/190myxn74cstzk77t09lj9fd8.0.tmp
/data/data/####/shared_prefs/device_authenticity.xml
/sdcard/Android/data/####/cache/uil-images/4ppwiyg8mj3m4r1a0qsiwrf53.0.tmp
/data/data/####/app_dex/utopay.jar
/sdcard/Android/data/####/cache/uil-images/348oeu43vvl7ums5c5p6p09dp.0.tmp
/sdcard/fywx_sdk_log.txt
/sdcard/Android/data/####/cache/uil-images/27nucl2h0s178ib7nocjk0niy.0.tmp
/sdcard/Android/data/####/cache/uil-images/5sv84tt1hjgjkfuh6hohgdmzs.0.tmp
/sdcard/Android/data/####/cache/uil-images/12lasvh68n578fm7fmk6oj0pz.0.tmp
/sdcard/Android/data/####/cache/uil-images/3ds1mvhrlmc11qpq5jv9nowld.0.tmp
/sdcard/Android/data/####/cache/uil-images/28fybzyo3bnu9t89kio5wib9y.0.tmp
/data/data/####/shared_prefs/device_authenticity.xml.bak
/data/data/####/shared_prefs/umeng_general_config.xml
/sdcard/Android/data/####/cache/uil-images/171crjzsz3hvglbc2i662fnfo.0.tmp
/sdcard/Android/data/####/cache/uil-images/5eavtk0cc2cmxvbgexixbv641.0
/sdcard/Android/data/####/cache/uil-images/749lfalkmc043bn0dyoika82u.0.tmp
/data/data/####/app_dex/utopay_close.png
/sdcard/Android/data/####/cache/uil-images/7ifzfk6cz1itma0wioqmkoydx.0.tmp
/sdcard/Android/data/####/cache/uil-images/3l4zk9xo7ii6uktwpmc5kiaj3.0.tmp
/sdcard/Android/data/####/cache/uil-images/67njh4kol85fkf2up18xrsjk5.0.tmp
/sdcard/Android/data/####/cache/uil-images/13mphd723ahhgfq6eugr03b6z.0.tmp
/data/data/####/app_dex/utopay_icon.gif
/sdcard/Android/data/####/cache/uil-images/56gbt182qmr9wb724zqfxkxv2.0.tmp
/sdcard/Android/data/####/cache/uil-images/3yed517j8m7z9yt85x5eeva1t.0.tmp
/sdcard/Android/data/####/cache/uil-images/6p5d44aar3qu6gs544gj5wtai.0.tmp
/sdcard/Android/data/####/cache/uil-images/47hiezqb0d53tfelle472t1gj.0.tmp
/data/data/####/files/.imprint
/data/data/####/shared_prefs/util_preference.xml
/sdcard/Android/data/####/cache/uil-images/3x9tsaw6ntw8gwmhkf8j6fxl0.0.tmp
/data/data/####/shared_prefs/####_preferences.xml.bak
/sdcard/Android/data/####/cache/uil-images/34y3gdls3uriwu959197kf7ks.0.tmp
/sdcard/Android/data/####/cache/uil-images/11scco0dhaxzxax2564zhmiw.0.tmp
/data/data/####/app_dex/utopay.dex
/sdcard/Android/data/####/cache/uil-images/2fadgy87dg43gx5bih1ozxm6m.0.tmp
/sdcard/Android/data/####/cache/uil-images/2ekuv5yhlquristq42zode5hz.0.tmp
/data/data/####/shared_prefs/Filter.xml
/sdcard/Android/data/####/cache/uil-images/2k1qp20y1nwngmrrukyjs72tx.0
/sdcard/Android/data/####/cache/uil-images/4nch0x1ex37org4hcde01uojl.0
/data/data/####/shared_prefs/wosdk_day.xml
/sdcard/Android/data/####/cache/uil-images/4cs1c48wxd22wf7ix4nok4kyj.0.tmp
/sdcard/Android/data/####/cache/uil-images/6h9em7cq22bx0vvcagdcbe1m5.0.tmp
/data/data/####/files/umeng_it.cache
/sdcard/Android/data/####/cache/uil-images/7d4wrkojm2hzahpccjz141y59.0.tmp
/sdcard/Android/data/####/cache/.nomedia
/sdcard/Android/data/####/cache/uil-images/48sf4prigi28zit7gwirjgusa.0
/sdcard/Android/data/####/cache/uil-images/6krfz30zndke9ynbur3mqpy5g.0.tmp
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/sdcard/Android/data/####/cache/uil-images/3ph174fvh87itda5u4z0wuh46.0.tmp
/data/data/####/app_dex/utopay.zip
/sdcard/Android/data/####/cache/uil-images/3urhku8rtjaknwhjiw2cqg2un.0.tmp
/sdcard/Android/data/####/cache/uil-images/journal.tmp
/data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
/sdcard/Android/data/####/cache/uil-images/6bm530eboe2x9lgswh2e3f9oz.0.tmp

Miscellaneous:

Executes next shell scripts:

getprop apps.customerservice.device

Contains functionality to send SMS messages automatically.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial