Android.SmsSend.20797

Technical information

Malicious functions:

Sends SMS messages:

106575206321505460: dyl#null,<IMEI>,6000098-1-214748-ssys_00613-0
10691009: @8DYL#null,<IMEI>,6000098-1-214748-ssys_00613-0
12114516412: systemcGx1dG8yNTAwMjY2OTkxODc3NDM=

Network activity:

Connecting to:

a####.####.cn
col####.####.com
huangda####.com
i####.####.cn
mo####.####.com
p####.####.cn
s####.####.com
v####.####.cn
z####.####.com

HTTP GET requests:

a####.####.cn/video-app/server/userHelp.html
huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
i####.####.cn/iplookup/iplookup.php?format=####
v####.####.cn/FjQPv7dlKae6jPgR3KsVRpdTarro-AvatarMiddle
z####.####.com/m/m151.mp4

HTTP POST requests:

col####.####.com/pay-data-collect/collectAppStartUserData.json
mo####.####.com/mobile-service/getOpenImsiMobilePhone.json
p####.####.cn/index.php/API
s####.####.com/pay-sms-access//uploadSmsDetailInfo.json?

Modified file system:

Creates the following files:

<Package Folder>/app_apCoreplugn/####/23uiusfjc.bin
<Package Folder>/app_apCoreplugn/sinner.apk
<Package Folder>/app_apCoreplugn/sky.apk
<Package Folder>/app_apCoreplugn/smap.apk
<Package Folder>/app_apCoreplugn/sms.apk
<Package Folder>/app_apCoreplugn/sqq.apk
<Package Folder>/app_apCoreplugn/sweb.apk
<Package Folder>/app_apCoreplugn/syl.apk
<Package Folder>/app_plugin_dir/####/base-1.apk
<Package Folder>/app_plugin_dir/####/base-1.dex
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/index
<Package Folder>/cache/sinner.apk.apk
<Package Folder>/cache/sky.apk.apk
<Package Folder>/cache/smap.apk.apk
<Package Folder>/cache/sms.apk.apk
<Package Folder>/cache/sqq.apk.apk
<Package Folder>/cache/sweb.apk.apk
<Package Folder>/cache/syl.apk.apk
<Package Folder>/databases/####/cc.db
<Package Folder>/databases/####/cc.db-journal
<Package Folder>/databases/TestinAgent.db
<Package Folder>/databases/TestinAgent.db-journal
<Package Folder>/databases/com.core.main.pay.plugmain_sy_pay_record-journal
<Package Folder>/databases/mp.db
<Package Folder>/databases/mp.db-journal
<Package Folder>/databases/recordInfo-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/databases/xUtils_http_cookie.db
<Package Folder>/databases/xUtils_http_cookie.db-journal
<Package Folder>/files/mobclick_agent_cached_<Package>2147483647
<Package Folder>/shared_prefs/CHECK_VERSION_TIME.xml
<Package Folder>/shared_prefs/CONFIGS.xml
<Package Folder>/shared_prefs/FIRST_ENTER_PLAY.xml
<Package Folder>/shared_prefs/LOGIN_TIME.xml
<Package Folder>/shared_prefs/PAY_STATUS.xml
<Package Folder>/shared_prefs/PLAY_COUNT.xml
<Package Folder>/shared_prefs/PROTOCOL_SHOW.xml
<Package Folder>/shared_prefs/RECORD_INFOS.xml
<Package Folder>/shared_prefs/RECORD_INFOS.xml.bak
<Package Folder>/shared_prefs/SAFETIPS.xml
<Package Folder>/shared_prefs/THIRD_STATUS_UPLOAD.xml
<Package Folder>/shared_prefs/TestinAgent.xml
<Package Folder>/shared_prefs/UPDATE_VERSION.xml
<Package Folder>/shared_prefs/USER_EXTRA_INFO.xml
<Package Folder>/shared_prefs/USER_OPEN_COUNT.xml
<Package Folder>/shared_prefs/com.core.main.pay.plugmain_p_config.xml
<Package Folder>/shared_prefs/com.souying.pay.xml
<Package Folder>/shared_prefs/cpMsg.xml
<Package Folder>/shared_prefs/device_id.xml.xml
<Package Folder>/shared_prefs/getFlag.xml
<Package Folder>/shared_prefs/plugins.installed.xml
<Package Folder>/shared_prefs/plugins.serviceMapping.xml
<Package Folder>/shared_prefs/pretw.xml
<Package Folder>/shared_prefs/signUpload.xml
<Package Folder>/shared_prefs/sy_pay_config.xml
<Package Folder>/shared_prefs/sy_pay_config.xml.bak
<Package Folder>/shared_prefs/twc.xml
<Package Folder>/shared_prefs/twc.xml.bak
<Package Folder>/shared_prefs/umengEnable.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/userInfo.xml
<SD-Card>/.twservice/####/tw
<SD-Card>/.twservice/qshp_3001_2274.zip
<SD-Card>/Android/####/-119364979
<SD-Card>/Android/####/-125424024.tmp
<SD-Card>/Android/####/-1260819636.tmp
<SD-Card>/Android/####/-1268207648.tmp
<SD-Card>/Android/####/-136292001.tmp
<SD-Card>/Android/####/-1433934119.tmp
<SD-Card>/Android/####/-147419963.tmp
<SD-Card>/Android/####/-1741023183.tmp
<SD-Card>/Android/####/-183924152.tmp
<SD-Card>/Android/####/-185846556.tmp
<SD-Card>/Android/####/-1928952030.tmp
<SD-Card>/Android/####/-1952831884.tmp
<SD-Card>/Android/####/-2082275344.tmp
<SD-Card>/Android/####/-2099478909.tmp
<SD-Card>/Android/####/-24037258.tmp
<SD-Card>/Android/####/-381324218.tmp
<SD-Card>/Android/####/-67389520.tmp
<SD-Card>/Android/####/-678369030.tmp
<SD-Card>/Android/####/-67970597.tmp
<SD-Card>/Android/####/-781822830.tmp
<SD-Card>/Android/####/-812369691.tmp
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/1047061303.tmp
<SD-Card>/Android/####/1122775634.tmp
<SD-Card>/Android/####/1235034122.tmp
<SD-Card>/Android/####/1323884823.tmp
<SD-Card>/Android/####/1413924631
<SD-Card>/Android/####/143246314
<SD-Card>/Android/####/1470231709.tmp
<SD-Card>/Android/####/1505132456.tmp
<SD-Card>/Android/####/1510971595.tmp
<SD-Card>/Android/####/1540288370.tmp
<SD-Card>/Android/####/1582227920.tmp
<SD-Card>/Android/####/1620296718.tmp
<SD-Card>/Android/####/1898151556.tmp
<SD-Card>/Android/####/1971445410.tmp
<SD-Card>/Android/####/1978821443.tmp
<SD-Card>/Android/####/2035494241.tmp
<SD-Card>/Android/####/2060744266.tmp
<SD-Card>/Android/####/298299142.tmp
<SD-Card>/Android/####/316362759.tmp
<SD-Card>/Android/####/334446035.tmp
<SD-Card>/Android/####/365245048.tmp
<SD-Card>/Android/####/582158801.tmp
<SD-Card>/Android/####/617565282.tmp
<SD-Card>/Android/####/911312921.tmp

Miscellaneous:

Executes next shell scripts:

<dexopt>
cat /proc/version
cat /sys/block/mmcblk0/device/cid

Contains functionality to send SMS messages automatically.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial