Android.SmsSend.18156

Technical information

Malicious functions:

Sends SMS messages:

106584211: 5fd3bec6c0a86a404271828230574330M302000A免费登录短信，请勿修改

Network activity:

Connecting to:

h####.####.com
1####.####.197:8080
7x####.####.com
obf0c####.####.com
w####.####.com
haoh####.cn
1####.####.197
i####.####.cn
haoh####.cn:8080
a####.####.com

HTTP GET requests:

1####.####.197/pubres/downloadzipv1/3x9/39x2/392x5/392554581/2-392554588...
w####.####.com/r/p/myspacedata.jsp?vt=####&aaa_flag=####
a####.####.com/v1/bulletin/android/4.0.2
a####.####.com/static/data/recommend-images/VkKIelb1Rh.jpg
a####.####.com/v1/apps/store-control
obf0c####.####.com/visenvt9_9_20160808104730.zip
7x####.####.com/zip/payjar_-1_20170423120749.zip
1####.####.197:8080/pubres/downloadzipv1/3x9/39x2/392x5/392554581/2-3925...
a####.####.com/static/data/android-config.json
a####.####.com/v3/recommend/android
i####.####.cn/iplookup/iplookup.php?format=####
w####.####.com/sso/p/logindata.jsp?e_l=9&purl=/r/p/myspacedata.jsp?aaa_f...
a####.####.com/static/data/recommend-images/i7jHZEz8RT.jpg

HTTP POST requests:

haoh####.cn/asg/portal.do
h####.####.com/app.gif
haoh####.cn:8080/asg/portal.do

Modified file system:

Creates the following files:

/data/data/####/cache/volley/-118490680-1826513182
/sdcard/.ishugui/books/393365243/393365246.kf
/data/data/####/shared_prefs/Cookies250026699187743.xml
/sdcard/Anyview/res/front-covers/cache/1b81a72ca481a3e751edee463b557f92
/sdcard/Anyview/res/front-covers/cache/81202b14753a3b91bfcec5ff5e301e7d
/sdcard/.ishugui/books/384206990/bookinfo.bat
/data/data/####/files/Reports/1493317692942
/sdcard/.ishugui/books/389064355/389071023.kf
/data/data/####/cache/volley/-1184906801784778293
/sdcard/Anyview/res/front-covers/cache/b6650b48bc8958797dfcdd7601ee1559
/data/data/####/shared_prefs/####_preferences.xml.bak
/sdcard/.ishugui/books/393365243/393365245.kf
/sdcard/.ishugui/books/346865084/bookinfo.bat
/data/data/####/files/__local_stat_cache.json
/sdcard/.ishugui/books/1493317703178.tmp
/sdcard/.ishugui/books/346865084/346865088.kf
/data/data/####/files/__local_ap_info_cache.json
/sdcard/.ishugui/books/393365243/393365247.kf
/data/data/####/databases/history.db
/sdcard/.ishugui/books/2-392554588-392554589_392554581.zip
/sdcard/.system/confv9/visen.conf
/data/data/####/shared_prefs/MonitoringServicesPrefs.xml
/sdcard/.ishugui/books/388798774/388801254.kf
/data/data/####/shared_prefs/JsonReportPrefs.xml
/sdcard/Anyview/temp/361579171.tmp
/sdcard/.ishugui/books/374125360/374125362.kf
/data/data/####/shared_prefs/MonitoringServicesPrefs.xml.bak
/sdcard/.ishugui/.log/reqlog.txt
/data/data/####/shared_prefs/shared_preferences.xml
/sdcard/.ishugui/books/377284115/377284120.kf
/sdcard/.ishugui/books/392554581/392554584.kf
/sdcard/.ishugui/books/392554581/392554589.kf
/sdcard/.ishugui/books/2-392554586-392554587_392554581.zip
/sdcard/.ishugui/Cache/2e6ex4z6ht006fka06av34j3k
/sdcard/.ishugui/Cache/35sqqz6orxc4v73vnpr284k5e
/sdcard/Anyview/res/front-covers/cache/03d63a8677be215567e8bc002e1c9e01
/sdcard/.ishugui/books/392554581/392554587.kf
/data/data/####/shared_prefs/conf_sp_name.xml
/sdcard/.ishugui/payerr.txt
/data/data/####/databases/intercept_pad.db-journal
/sdcard/.ishugui/books/377284115/377284119.kf
/sdcard/.system/confv9/visen.conf.temp
/sdcard/.ishugui/books/388798774/388801253.kf
/data/data/####/shared_prefs/4.0.2.xml
/sdcard/Android/data/####/cache/.nomedia
/sdcard/.ishugui/books/389064355/389071025.kf
/data/data/####/shared_prefs/CacheLoader.xml
/sdcard/.ishugui/books/392554581/392554585.kf
/data/data/####/shared_prefs/ishugui.shareInfo.xml
/data/data/####/shared_prefs/store_control.xml
/sdcard/Anyview/temp/user_expierence.data
/sdcard/.ishugui/books/404944122/bookinfo.bat
/sdcard/.ishugui/books/388798774/bookinfo.bat
/sdcard/.ishugui/books/374125360/374125364.kf
/sdcard/.ishugui/books/392554581/392554588.kf
/sdcard/.ishugui/books/346865084/346865087.kf
/data/data/####/databases/ishugui.db-journal
/data/data/####/databases/history.db-journal
/sdcard/.ishugui/books/374125360/bookinfo.bat
/data/data/####/shared_prefs/ishugui.shareInfo.xml.bak
/sdcard/.ishugui/Cache/4ench0d3fs1ljc2as4bpjjc06
/sdcard/Android/data/.nomedia
/sdcard/.ishugui/books/389064355/389071024.kf
/sdcard/.ishugui/books/404944122/404944125.kf
/sdcard/.ishugui/books/384206990/384209243.kf
/sdcard/.system/confv9/visen.conf.mark
/sdcard/Anyview/chapters/-1337991640.chapters
/sdcard/.ishugui/books/384206990/384209245.kf
/sdcard/.ishugui/Cache/12xscl4m6z5nhop040m4254uh
/sdcard/.ishugui/Cache/5wu8zq2cpiqxjqci92hyu23jp
/sdcard/.ishugui/books/389064355/bookinfo.bat
/sdcard/Anyview/res/front-covers/cache/b30cf89c41cb57c3b687092ab2c6296d
/sdcard/.ishugui/Cache/438423fl0bw9ix5vtkj2iauyv
/sdcard/Anyview/res/front-covers/covers_default.zip.res
/sdcard/.ishugui/Cache/26zocw83tp6wrfpnke3mfigch
/data/data/####/files/__local_last_session.json
/sdcard/.ishugui/books/1493317725126.tmp
/sdcard/.ishugui/books/346865084/346865086.kf
/sdcard/.ishugui/books/392554581/392554586.kf
/data/data/####/shared_prefs/app_theme_preferences.xml
/sdcard/.ishugui/books/388798774/388801255.kf
/sdcard/.ishugui/books/374125360/374125363.kf
/sdcard/.ishugui/books/404944122/404944124.kf
/sdcard/Anyview/res/front-covers/cache/0ec9b7b243bc781c08a257d1aba61809
/data/data/####/databases/webview.db-journal
/data/data/####/shared_prefs/####_preferences.xml
/sdcard/Anyview/res/xmls/Env_Config.xml
/data/data/####/files/Reports/1493317692921
/sdcard/Anyview/sys/.recsv3
/sdcard/.ishugui/books/384206990/384209244.kf
/sdcard/Anyview/res/front-covers/cache/c624fe48b45725f1ce6ad54782fdc607
/sdcard/.ishugui/books/377284115/377284118.kf
/sdcard/.ishugui/Cache/5jw4rqqoawz35iihfff09kysk
/sdcard/Anyview/temp/392554581/392554584
/sdcard/Anyview/temp/392554581/392554585
/sdcard/Anyview/temp/392554581/392554586
/sdcard/.ishugui/books/393365243/bookinfo.bat
/sdcard/Anyview/temp/392554581/392554583
/sdcard/.system/confv9/visen.conf.out.temp
/sdcard/.system/confv9/paydex.dzlib.temp
/sdcard/.ishugui/books/392554581/bookinfo.bat
/data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
/sdcard/baidu/.cuid
/sdcard/.ishugui/books/404944122/405593636.kf
/sdcard/Anyview/temp/-658672869.tmp
/sdcard/.ishugui/books/377284115/bookinfo.bat
/data/data/####/shared_prefs/setting_preferences.xml
/sdcard/.ishugui/Cache/5k48ekx4mbso0yln05pf6cxkl
/sdcard/.ishugui/books/392554581/392554583.kf

Miscellaneous:

Executes next shell scripts:

/system/bin/dexopt --dex 27 94 40 390064 /storage/emulated/0/.system/confv9/paydex.dzlib 1251434669 -1857557483 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f

Contains functionality to send SMS messages automatically.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial