Android.SmsSend.20375

Technical information

Malicious functions:

Sends SMS messages:

12114: HZSY#<IMSI>

Executes code of the following detected threats:

Android.Triada.247.origin
Android.Triada.248.origin

Downloads the following detected threats from the Web:

Android.Triada.247.origin
Android.Triada.248.origin

Network activity:

Connecting to:

6####.####.140
collec####.####.com
cser####.####.cn
huangda####.com
i####.####.com
i####.####.com:10003
l####.####.com
mobil####.####.com
p####.####.com
re####.####.com
re####.####.com:10002
sm####.####.com

HTTP GET requests:

6####.####.140/ando/i/mon?k=####&d=####
huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
i####.####.com/ando-res/ads/30/14/f15541de-b7bd-4ff9-97fb-9e6cc9e4e044/0...
p####.####.com/cityjson?ie=####
re####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sd...
re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...

HTTP POST requests:

collec####.####.com/pay-data-collect/collectAppStartUserData.json
cser####.####.cn/channel/paymentHandle.action?v=####&requestId=####
i####.####.com:10003/v2/chis
l####.####.com/sdk.php
mobil####.####.com/mobile-service/getOpenImsiMobilePhone.json
sm####.####.com/pay-sms-access//uploadSmsDetailInfo.json?

Modified file system:

Creates the following files:

<Package Folder>/app_apCoreplugn/####/lol.so
<Package Folder>/app_apCoreplugn/map.apk
<Package Folder>/app_apCoreplugn/sm.apk
<Package Folder>/app_plugin_dir/####/base-1.apk
<Package Folder>/app_plugin_dir/####/base-1.dex
<Package Folder>/cache/####/crash-1496217054901.log
<Package Folder>/cache/####/crash-1496217078256.log
<Package Folder>/cache/map.apk.apk
<Package Folder>/cache/sm.apk.apk
<Package Folder>/code-2295660/jK8pQk8OmWtqOV3s
<Package Folder>/code-6565579/jK8pQk8OmWtqOV3s
<Package Folder>/databases/com.souying.pay.plugmain_sy_pay_record-journal
<Package Folder>/databases/q5BezUabgt1sDCbrBGUnOwcYJLACPKDK_9sKPPP9OthpZg6IGNobS6tnpf2s=
<Package Folder>/databases/q5BezUabgt1sDCbrBGUnOwcYJLACPKDK_9sKPPP9OthpZg6IGNobS6tnpf2s=-journal
<Package Folder>/databases/q5BezUabgt1sDCbrBGUnOwcYJLACPKDK_JaS9w-hMu8c1ApM6qBV18A==
<Package Folder>/databases/q5BezUabgt1sDCbrBGUnOwcYJLACPKDK_JaS9w-hMu8c1ApM6qBV18A==-journal
<Package Folder>/databases/q5BezUabgt1sDCbrBGUnOwcYJLACPKDK_Ma1Key-_N6jnVcSO
<Package Folder>/databases/q5BezUabgt1sDCbrBGUnOwcYJLACPKDK_Ma1Key-_N6jnVcSO-journal
<Package Folder>/databases/q5BezUabgt1sDCbrBGUnOwcYJLACPKDK_S47L8apZtLY=
<Package Folder>/databases/q5BezUabgt1sDCbrBGUnOwcYJLACPKDK_S47L8apZtLY=-journal
<Package Folder>/databases/q5BezUabgt1sDCbrBGUnOwcYJLACPKDK_rV977eq2VFtkgpOPbiqDSA==
<Package Folder>/databases/q5BezUabgt1sDCbrBGUnOwcYJLACPKDK_rV977eq2VFtkgpOPbiqDSA==-journal
<Package Folder>/databases/recordInfo-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/0442fb8e-1492-4e38-aa7b-d6b16e66176f.pic.temp
<Package Folder>/files/####/0NKrqH2jqfyXyya85liUFuWpjcA=
<Package Folder>/files/####/1407b4d2-4086-4588-bb8e-72d11eda29f6.pic.temp
<Package Folder>/files/####/1496217055052_2101
<Package Folder>/files/####/1496217055111_2101
<Package Folder>/files/####/1496217055353_2101
<Package Folder>/files/####/1496217055439_2101
<Package Folder>/files/####/1496217077743_2255
<Package Folder>/files/####/1496217077792_2255
<Package Folder>/files/####/1496217077885_2255
<Package Folder>/files/####/305b2877-00aa-44ee-ab00-e216e74cb518.pic.temp
<Package Folder>/files/####/5N0p-hMJO8oZk4AfC2Ab8gBorFO6Qrrcwc--nwvTXiI=.new
<Package Folder>/files/####/61PNLky86F-eBq-5BjowEeaLiYU=.new
<Package Folder>/files/####/6Q-RxDrctKQoS7liZW3jQzHJ1zo1EpVmgPtN3A==.new
<Package Folder>/files/####/7FopnbaNDQZRrwwn.zip
<Package Folder>/files/####/7pl70tZYih1ytpIf6Do9T4dvLR3ZtJnXPawolaVWplA=.new
<Package Folder>/files/####/8c5d0b4c-4a66-44c0-976a-433b796d3062.pic
<Package Folder>/files/####/8so3WOhF3XU1G6yD
<Package Folder>/files/####/960ed76e-3b92-4f7e-9323-ad2f3c86409a.pic.temp
<Package Folder>/files/####/97d1a12f-c987-4779-aeeb-de4489769e60.pic
<Package Folder>/files/####/Cte6KHxb6cOqw0R9O7nAKp30aZyqGAgp.new
<Package Folder>/files/####/D5SkEOMLJlhVy0kKsUA1StTDKKB6L3bczybfC30sxnk=.new
<Package Folder>/files/####/DOWwMpIFD4ATugL-lJ8icgn94oOjrR0S
<Package Folder>/files/####/DOWwMpIFD4ATugL-lJ8icgn94oOjrR0S.new
<Package Folder>/files/####/EXVjsxyEnCRuOvKMp2lop--2ZKpt7LVs.new
<Package Folder>/files/####/JUIfi2Mgbzf3MKSLQFo6tv7mhvo=.new
<Package Folder>/files/####/PlDH9VK7cNbjybKzCXRO-L4hNufjzNGH.new
<Package Folder>/files/####/QLGoKmaUwUCCc4cxDeW_nlNRWUfSreAK.new
<Package Folder>/files/####/TUSy7S21XrjWrn4O2XAXli7Lni1_hO8z5KrX2Q==.new
<Package Folder>/files/####/UywvNyvlMx2m4N1avRhPXQ==
<Package Folder>/files/####/YF2qtK_uuaSpZc9MFYdbhTI_96I=
<Package Folder>/files/####/YF2qtK_uuaSpZc9MFYdbhTI_96I=.new
<Package Folder>/files/####/YF2qtK_uuaSpZc9MFYdbhTI_96I=.old (deleted)
<Package Folder>/files/####/ZsY8yLZCuo3DMg-QtRDIqeSI24kv-FYxdEUmbw==.new
<Package Folder>/files/####/ZsaOqNT25x8Qit3aNsHfbg==
<Package Folder>/files/####/ZsaOqNT25x8Qit3aNsHfbg==.new
<Package Folder>/files/####/ZsaOqNT25x8Qit3aNsHfbg==.old (deleted)
<Package Folder>/files/####/_en0Q8B45iAkPuH9bxbHjQuTONPnGN_U.new
<Package Folder>/files/####/dSvbrBVGfrQ2zRzP0jbL4ecowq8=.temp
<Package Folder>/files/####/dde9ef77-f1b4-4f9b-8108-ae0b64ccda8e.pic.temp
<Package Folder>/files/####/de6rMMsQlQphojJ1rjSjEGw3IwzYZrJC.new
<Package Folder>/files/####/e98dd64a-64d5-4720-828a-91655243538c.pic.temp
<Package Folder>/files/####/ew8vfLd4uOILEBRWOw3FIwTXm5E=
<Package Folder>/files/####/f-Got9Et8sRdCbw4eOxccujRsUCE4INly_-YZdUhLW4=.new
<Package Folder>/files/####/hbipuw_f.zip
<Package Folder>/files/####/iPM9gHaR0OwXYYbXb3571sFrkSa2EJi_.new
<Package Folder>/files/####/iyzKuPFVgg7D_UP6IFUyR7ZGYlE=.new
<Package Folder>/files/####/lPzhpshtI-4VnEHUjkUQ7A==.new
<Package Folder>/files/####/plus.jar
<Package Folder>/files/####/runner_info.prop.new
<Package Folder>/files/####/tMffDVykSiz0kczGj946CQ==.new
<Package Folder>/files/####/xiIfNBZWK7RUbby4.new
<Package Folder>/files/####/y3jzwJgBTsLsq4LhO6aA8g==
<Package Folder>/files/####/zXrm7yKTyMVJXs5zQjMGuqf_arw=.temp
<Package Folder>/files/rdata_comyvznyxpn.new
<Package Folder>/files/yy.dt
<Package Folder>/shared_prefs/3db355750bea842d8ee0cece950aa5ecd|account_file.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/TDpref_game.xml
<Package Folder>/shared_prefs/TDpref_longtime.xml
<Package Folder>/shared_prefs/TDpref_longtime.xml.bak
<Package Folder>/shared_prefs/TDpref_longtime3.xml
<Package Folder>/shared_prefs/TDpref_longtime3.xml.bak
<Package Folder>/shared_prefs/TDpref_shorttime.xml
<Package Folder>/shared_prefs/com.souying.pay.plugmain_p_config.xml
<Package Folder>/shared_prefs/com.souying.pay.xml
<Package Folder>/shared_prefs/plugins.installed.xml
<Package Folder>/shared_prefs/plugins.serviceMapping.xml
<Package Folder>/shared_prefs/plugins.serviceMapping.xml.bak (deleted)
<Package Folder>/shared_prefs/pretw.xml
<Package Folder>/shared_prefs/pretw.xml.bak
<Package Folder>/shared_prefs/sdk.xml
<Package Folder>/shared_prefs/sy_pay_config.xml
<Package Folder>/shared_prefs/sy_pay_config.xml.bak
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/twc.xml
<Package Folder>/shared_prefs/zzconfig.xml
<SD-Card>/.armsd/####/01cfaca9-4515-4d0d-9041-c22dbb782f69.res
<SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
<SD-Card>/.armsd/####/68cec78a-7a9c-4943-88a9-58455dc1e5b9.res
<SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
<SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
<SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
<SD-Card>/.armsd/####/c3856029-3730-408b-9f1c-7a324fe335b5.res
<SD-Card>/.armsd/####/e4c52e14-78ff-4c73-b88b-8c487b9ab888.res
<SD-Card>/.armsd/####/f24fc011-6666-4976-ace4-907ca9711647.res
<SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
<SD-Card>/.env/.uunique.new
<SD-Card>/.tcookieid
<SD-Card>/.twservice/####/tw
<SD-Card>/.twservice/tkddbp_3001_2275.zip
<SD-Card>/CrashLog/WyyyCrashLog_20170531075118_2255.log

Miscellaneous:

Executes next shell scripts:

/data/data/com.p.s.h/code-2295660/jK8pQk8OmWtqOV3s -p com.p.s.h -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
/data/data/com.p.s.h/code-6565579/jK8pQk8OmWtqOV3s -p com.p.s.h -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
<dexopt>
cat /proc/version
cat /sys/block/mmcblk0/device/cid
getprop
sh <Package Folder>/code-2295660/jK8pQk8OmWtqOV3s -p <Package> -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
sh <Package Folder>/code-6565579/jK8pQk8OmWtqOV3s -p <Package> -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial