Android.SmsSend.18564

Technical information

Malicious functions:

Sends SMS messages:

1069013312315: y####

Executes code of the following detected threats:

Android.SkyMobi.5.origin

Sends data on received text messages to remote host.

Network activity:

Connecting to:

p####.####.cn
tra####.####.cn
pl####.####.com
7x####.####.com
and####.####.com
w####.####.com
col####.####.cn
d####.####.net
vide####.####.com
m####.####.com
pr####.####.com
and####.####.com:8077

HTTP GET requests:

7x####.####.com/000002/paster
pl####.####.com/20161220sy69.apk
vide####.####.com/72ac0c0fecd241ac9bb9bb8f2fac0172.jpg
w####.####.com/r/378609775/index.htm?cm=####
d####.####.net/apkf/3rdapk2/M01/0E/44/wKhklVhSBoWAJ5_wAADszVT7EOk135.apk
7x####.####.com/000002/upmList
d####.####.net/apkf/3rdapk2/M01/11/94/wKhklFjcoxSAVfVsAAQi2GM2SW4351.apk
d####.####.net/apkf/3rdapk2/M01/0F/82/wKhklFiFqJKAOnnKAACb3YsVzOg199.apk
w####.####.com/r/p/index.jsp?vt=####&cm=####
w####.####.com/r/378609775/378609778/index.htm?cm=####
tra####.####.cn/traffic-server/plug!plugSwitch.action?appId=####&channel...
d####.####.net/apkf/3rdapk2/M00/01/33/wKhklVVtdKOAVv5IAAFBG_mUhK4571.apk
m####.####.com/course/504703.html?cm=####
d####.####.net/apkf/3rdapk2/M01/0E/56/wKhklFhksvuANqoTAALWgjTX0vU609.apk
w####.####.com/r/p/lyxy.jsp?ln=####&t1=####&cm=####
d####.####.net/apkf/3rdapk2/M01/0E/56/wKhklVhksWiALyCVAAnz180ECbU177.apk
d####.####.net/apkf/3rdapk2/M01/0E/56/wKhklVhkstyAFxIaAACsjOPx_g8159.apk

HTTP POST requests:

pr####.####.com/dynamicpay//syPayInfo.json?
and####.####.com/zm-adv-mis/recommwall/active/query.do
and####.####.com/zm-adv-mis/folder/list/query.do
and####.####.com/zm-adv-mis/push/active/query.do
col####.####.cn/stats.service
pr####.####.com/dynamicpay//getSyFormalChannels.json?
and####.####.com/android/sms/netpay/prefetch.do
and####.####.com/zm-adv-mis/recommwall/list/query.do
and####.####.com/zm-adv-mis/adv/list/query.do
and####.####.com:8077/query-plat/cap/query.do
and####.####.com/zm-adv-mis/push/list/query.do
and####.####.com/zm-adv-mis/folder/active/query.do
pr####.####.com/prc-has/getThirdPluginAccountInfo.json
and####.####.com/record-plat/seq/query.do
p####.####.cn/prc-has/getImsiMobilePhone.json
and####.####.com/zm-adv-mis/advplugin/query.do

Modified file system:

Creates the following files:

/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.new.apk
/data/data/####/SkyAdver_file/NotifyBarAdvResponse
/data/data/####/databases/video_record-journal
/data/data/####/shared_prefs/paypush_preference.xml.bak
/sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.zhongzhisdk.new.apk
/sdcard/SYPAYFILENAME/CACHE/SMSCACHE/ISDELSMS
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.new.apk
/data/data/####/databases/video_record
/data/data/####/databases/p_db
/data/data/####/app_workbench19860/apk.zip
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.apk
/data/data/####/shared_prefs/pref_folder.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/LatestPushIndex
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/NextReqInterval
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
/data/data/####/SkyAdver_file/NextReqInterval
/data/data/####/shared_prefs/ntf_idpadv.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/PushDataServerTime
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.new.apk.temp
/data/data/####/shared_prefs/ds_configer.xml
/data/data/####/app_workbench03282/apk.zip
/data/data/####/shared_prefs/paypush_preference.xml
/data/data/####/databases/webviewCookiesChromium.db-journal
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.apk
/data/data/####/databases/sy_pay_record-journal
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.new.apk
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.new.apk
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.new.apk.temp
/data/data/####/files####/.libs/libhammer.so
/data/data/####/files_main/key_AppPluginCapInfo
/data/data/####/shared_prefs/BOOT_SMS_SENT_TIME.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.new.apk.temp
/data/data/####/shared_prefs/mainplugin_query.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.new.apk.temp
/data/data/####/app_workbench97756/apk.zip
/data/data/####/shared_prefs/pref_recomm.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.zhongzhisdk.new.apk.temp
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.apk.temp
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.ovspay.new.apk
/data/data/####/databases/p_db-journal
/data/data/####/app_workbench86704/apk.zip
/data/data/####/EOZTzhVG.jar
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/NotifyBarAdvResponse
/data/data/####/files_main/key_ServerPluginInfo
/data/data/####/files####/.libs/libmy-ndk.so
/data/data/####/databases/Data_sync.db-journal
/data/data/####/databases/webview.db-journal
/sdcard/Android/data/com.skymobi.pay.newsdk/files_main/key_ServerPluginInfo
/data/data/####/databases/statistics_db-journal
/data/data/####/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
/data/data/####/shared_prefs/config.xml
/data/data/####/shared_prefs/p_config.xml
/data/data/####/shared_prefs/config_ad.xml
/data/data/####/shared_prefs/BOOT_SMS_INFO.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/user.sys
/sdcard/Android/data/com.skymobi.pay.newsdk/files_push/dolls_push/sharemem_push.lock
/data/data/####/files/syHello
/data/data/####/app_workbench25386/apk.zip
/data/data/####/SkyAdver_file/PushDataServerTime
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/PushDataReciveTime
/data/data/####/app_workbench92230/apk.zip
/data/data/####/databases/app_download_record-journal
/data/data/####/shared_prefs/onlinePh.xml
/data/data/####/shared_prefs/plugin_record_app_info.xml
/data/data/####/databases/statistics_db
/sdcard/syMediacool30216/images/149372963064572ac0c0fecd241ac9bb9bb8f2fac0172
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.ovspay.new.apk.temp
/data/data/####/SkyAdver_file/PushDataReciveTime
/data/data/####/cache/webviewCacheChromium/index
/data/data/####/SkyAdver_file/LatestPushIndex

Sets the 'executable' attribute to the following files:

/data/data/####/files/syHello

Miscellaneous:

Executes next shell scripts:

/system/bin/dexopt --dex 27 69 40 122528 /data/data/####/app_workbench92230/apk.zip 1252157112 -1051659587 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/
/system/bin/dexopt --dex 27 48 40 125092 /data/data/####/app_workbench25386/apk.zip 1252157109 1437815336 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.apk
chmod 777 /data/data/####/files/syHello
/system/bin/dexopt --dex 27 98 40 369136 /data/data/####/app_workbench86704/apk.zip 1252157112 437129257 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
sh
chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
/system/bin/dexopt --dex 27 66 40 796196 /data/data/####/app_workbench97756/apk.zip 1252157112 582532082 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
/system/bin/dexopt --dex 27 40 40 1125364 /data/data/####/EOZTzhVG.jar 1220936874 -1455556798 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fra
chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.apk
/system/bin/dexopt --dex 27 54 40 80704 /data/data/####/app_workbench19860/apk.zip 1252157109 -2103829846 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
/system/bin/dexopt --dex 27 59 40 540224 /data/data/####/app_workbench03282/apk.zip 1252157111 1715135955 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.apk

Contains functionality to send SMS messages automatically.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial