Android.SmsSend.18493

Technical information

Malicious functions:

Sends SMS messages:

106584211: 5fd3bec6c0a86a505041108433384121M302000A免费登录短信，请勿修改

Network activity:

Connecting to:

h####.####.com
1####.####.197:8080
7x####.####.com
obf0c####.####.com
w####.####.com
haoh####.cn
1####.####.197
i####.####.cn
haoh####.cn:8080
a####.####.com

HTTP GET requests:

1####.####.197:8080/pubres/downloadzipv1/3x8/38x4/384x2/384206990/2-3842...
a####.####.com/v1/check-update?version=####&platform=####&platform_versi...
w####.####.com/sso/p/logindata.jsp?e_l=9&purl=/r/p/myspacedata.jsp?aaa_f...
a####.####.com/static/data/android-config.json
a####.####.com/v1/forum/nodes/groups
a####.####.com/v3/splash/600*752?density=####
1####.####.197/pubres/downloadzipv1/4x0/40x4/404x9/404944122/1-404944127...
a####.####.com/v1/apps/store-control
7x####.####.com/zip/payjar_-1_20170503222843.zip
a####.####.com/v1/bulletin/android/4.0.4
obf0c####.####.com/visenvt9_9_20160808104730.zip
i####.####.cn/iplookup/iplookup.php?format=####
1####.####.197/pubres/downloadzipv1/4x0/40x4/404x9/404944122/1-404944126...
w####.####.com/r/p/myspacedata.jsp?vt=####&aaa_flag=####

HTTP POST requests:

haoh####.cn/asg/portal.do
a####.####.com/v1/account/reading-stat
h####.####.com/app.gif
haoh####.cn:8080/asg/portal.do

Modified file system:

Creates the following files:

/sdcard/.ishugui/books/1493729082390.tmp
/sdcard/.ishugui/books/404944122/404944126.kf
/data/data/####/cache/volley/-118490680-1826513182
/sdcard/Anyview/chapters/410731401.chapters
/sdcard/.ishugui/books/393365243/393365246.kf
/data/data/####/shared_prefs/Cookies250026699187743.xml
/sdcard/Anyview/res/front-covers/cache/1b81a72ca481a3e751edee463b557f92
/sdcard/Anyview/res/front-covers/cache/81202b14753a3b91bfcec5ff5e301e7d
/sdcard/.ishugui/books/384206990/bookinfo.bat
/sdcard/.ishugui/books/404944122/404944127.kf
/sdcard/.ishugui/books/389064355/389071023.kf
/data/data/####/cache/volley/-1184906801784778293
/data/data/####/files/__local_ap_info_cache.json
/sdcard/Anyview/res/front-covers/cache/b6650b48bc8958797dfcdd7601ee1559
/data/data/####/files/Reports/1493729034826
/data/data/####/shared_prefs/####_preferences.xml.bak
/sdcard/.ishugui/books/393365243/393365245.kf
/data/data/####/files/__local_stat_cache.json
/sdcard/.ishugui/books/346865084/346865088.kf
/sdcard/.ishugui/books/384206990/384209246.kf
/sdcard/Anyview/sys/.splash
/sdcard/.ishugui/books/393365243/393365247.kf
/data/data/####/databases/history.db
/sdcard/.ishugui/books/1-404944126_404944122.zip
/sdcard/.system/confv9/visen.conf
/data/data/####/shared_prefs/MonitoringServicesPrefs.xml
/data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
/sdcard/backups/system/.confd
/data/data/####/files/Reports/1493729034808
/data/data/####/files/libcuid.so
/sdcard/.ishugui/books/388798774/388801254.kf
/data/data/####/shared_prefs/JsonReportPrefs.xml
/sdcard/Anyview/temp/404944122/405593636
/sdcard/.ishugui/books/374125360/374125362.kf
/data/data/####/shared_prefs/MonitoringServicesPrefs.xml.bak
/sdcard/.ishugui/.log/reqlog.txt
/data/data/####/shared_prefs/shared_preferences.xml
/sdcard/.system/confv9/visen.conf.out.temp
/sdcard/.ishugui/books/377284115/377284118.kf
/sdcard/.ishugui/books/374125360/374125363.kf
/sdcard/.ishugui/Cache/2e6ex4z6ht006fka06av34j3k
/sdcard/.ishugui/Cache/35sqqz6orxc4v73vnpr284k5e
/sdcard/Anyview/temp/384206990/384209243
/sdcard/Anyview/res/front-covers/cache/03d63a8677be215567e8bc002e1c9e01
/data/data/####/shared_prefs/conf_sp_name.xml
/sdcard/.ishugui/payerr.txt
/data/data/####/databases/intercept_pad.db-journal
/sdcard/.ishugui/books/377284115/377284119.kf
/sdcard/backups/system/.timestamp
/sdcard/.system/confv9/visen.conf.temp
/sdcard/.ishugui/books/388798774/388801253.kf
/sdcard/.ishugui/books/2-384209246-384209247_384206990.zip
/sdcard/Android/data/####/cache/.nomedia
/sdcard/.ishugui/books/389064355/389071025.kf
/data/data/####/shared_prefs/CacheLoader.xml
/sdcard/.ishugui/books/392554581/392554585.kf
/sdcard/.ishugui/books/1493729046517.tmp
/data/data/####/shared_prefs/ishugui.shareInfo.xml
/data/data/####/shared_prefs/store_control.xml
/sdcard/Anyview/temp/user_expierence.data
/sdcard/.ishugui/books/404944122/bookinfo.bat
/sdcard/.ishugui/books/388798774/bookinfo.bat
/sdcard/.ishugui/books/374125360/374125364.kf
/sdcard/backups/.SystemConfig/.cuid2
/sdcard/.ishugui/books/346865084/346865087.kf
/data/data/####/databases/ishugui.db-journal
/data/data/####/databases/history.db-journal
/sdcard/.ishugui/books/374125360/bookinfo.bat
/data/data/####/shared_prefs/ishugui.shareInfo.xml.bak
/sdcard/.ishugui/Cache/4ench0d3fs1ljc2as4bpjjc06
/sdcard/Android/data/.nomedia
/sdcard/.ishugui/books/389064355/389071024.kf
/sdcard/.ishugui/books/404944122/404944125.kf
/sdcard/.ishugui/books/384206990/384209243.kf
/sdcard/.system/confv9/visen.conf.mark
/sdcard/.ishugui/books/384206990/384209245.kf
/sdcard/.ishugui/books/1493729079759.tmp
/sdcard/.ishugui/Cache/12xscl4m6z5nhop040m4254uh
/sdcard/Anyview/sys/history.db
/sdcard/.ishugui/Cache/5wu8zq2cpiqxjqci92hyu23jp
/sdcard/.ishugui/books/389064355/bookinfo.bat
/data/data/####/files/__send_data_1493729034159
/sdcard/Anyview/res/front-covers/cache/b30cf89c41cb57c3b687092ab2c6296d
/sdcard/.ishugui/Cache/438423fl0bw9ix5vtkj2iauyv
/sdcard/Anyview/res/front-covers/covers_default.zip.res
/sdcard/.ishugui/Cache/26zocw83tp6wrfpnke3mfigch
/data/data/####/files/__local_last_session.json
/sdcard/Anyview/temp/404944122/404944125
/sdcard/Anyview/temp/404944122/404944124
/sdcard/.ishugui/books/346865084/346865086.kf
/data/data/####/shared_prefs/app_theme_preferences.xml
/sdcard/.ishugui/books/388798774/388801255.kf
/sdcard/Anyview/sys/post_plate.xml
/sdcard/.ishugui/books/404944122/404944124.kf
/sdcard/Anyview/res/front-covers/cache/0ec9b7b243bc781c08a257d1aba61809
/sdcard/.ishugui/books/384206990/384209247.kf
/data/data/####/databases/webview.db-journal
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/shared_prefs/4.0.4.xml.bak
/data/data/####/shared_prefs/4.0.4.xml
/sdcard/Anyview/res/xmls/Env_Config.xml
/sdcard/.ishugui/books/393365243/bookinfo.bat
/sdcard/Anyview/res/front-covers/cache/c624fe48b45725f1ce6ad54782fdc607
/sdcard/.ishugui/books/392554581/392554584.kf
/sdcard/.ishugui/Cache/5jw4rqqoawz35iihfff09kysk
/sdcard/backups/system/.confd-journal
/sdcard/.ishugui/books/346865084/bookinfo.bat
/sdcard/.ishugui/books/384206990/384209244.kf
/sdcard/.ishugui/books/377284115/377284120.kf
/sdcard/.system/confv9/paydex.dzlib.temp
/sdcard/.ishugui/books/1-404944127_404944122.zip
/sdcard/.ishugui/books/392554581/bookinfo.bat
/data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
/sdcard/Anyview/chapters/-188443758.chapters
/sdcard/.ishugui/books/1493729079018.tmp
/sdcard/.ishugui/books/404944122/405593636.kf
/sdcard/.ishugui/books/377284115/bookinfo.bat
/data/data/####/shared_prefs/setting_preferences.xml
/sdcard/backups/.SystemConfig/.cuid
/sdcard/.ishugui/Cache/5k48ekx4mbso0yln05pf6cxkl
/sdcard/.ishugui/books/392554581/392554583.kf

Miscellaneous:

Executes next shell scripts:

/system/bin/dexopt --dex 27 96 40 390196 /storage/emulated/0/.system/confv9/paydex.dzlib 1252242021 -1985031436 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/f

Contains functionality to send SMS messages automatically.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial