Android.SmsSend.20890

Technical information

Malicious functions:

Sends SMS messages:

12114: HZSY#<IMSI>

Executes code of the following detected threats:

Android.Triada.247.origin
Android.Triada.248.origin
Android.Triada.248.origin

Downloads the following detected threats from the Web:

Android.Triada.247.origin
Android.Triada.248.origin
Android.Triada.248.origin

Network activity:

Connecting to:

6####.####.140
cser####.####.cn
huangda####.com
i####.####.com
i####.####.com:10003
l####.####.com
p####.####.com
re####.####.com
re####.####.com:10002
sm####.####.com

HTTP GET requests:

6####.####.140/ando/i/mon?k=####&d=####
huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
i####.####.com/ando-res/m/mTcb2th3ZzbBw7odDGaHLNm7oebJifH-u5olP7zGxOgtLj...
p####.####.com/cityjson?ie=####
re####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sd...
re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...

HTTP POST requests:

cser####.####.cn/channel/paymentHandle.action?v=####&requestId=####
i####.####.com:10003/v2/chis
l####.####.com/sdk.php
sm####.####.com/pay-sms-access//uploadSmsDetailInfo.json?

Modified file system:

Creates the following files:

<Package Folder>/app_apCoreplugn/####/lol.so
<Package Folder>/app_apCoreplugn/map.apk
<Package Folder>/app_apCoreplugn/sm.apk
<Package Folder>/app_plugin_dir/####/base-1.apk
<Package Folder>/app_plugin_dir/####/base-1.dex
<Package Folder>/cache/####/crash-1496212843785.log
<Package Folder>/cache/####/crash-1496212855907.log
<Package Folder>/cache/####/crash-1496212878848.log
<Package Folder>/cache/####/crash-1496212889685.log
<Package Folder>/cache/map.apk.apk
<Package Folder>/cache/sm.apk.apk
<Package Folder>/code-6682118/MlsfTWcI4f4lMD4-
<Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_41c0o5oEPKe9dhx-D85J_34EFt0=
<Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_41c0o5oEPKe9dhx-D85J_34EFt0=-journal
<Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_6-2v5qOQaGoPLRewj7eqaw==
<Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_6-2v5qOQaGoPLRewj7eqaw==-journal
<Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_OxMQg40yF41muSiNynyHkQ==
<Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_OxMQg40yF41muSiNynyHkQ==-journal
<Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_PnlaX8MQyhU=
<Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_PnlaX8MQyhU=-journal
<Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_nhAFBV5Wm9cMlvOR
<Package Folder>/databases/Hb_hsRlgjvn_x7OJb4hkNPuY9ZmOG0pi_nhAFBV5Wm9cMlvOR-journal
<Package Folder>/databases/com.souying.pay.plugmain_sy_pay_record-journal
<Package Folder>/databases/recordInfo-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/-2vjl3G--a8U5ykORclELK6MDp9haIJ7.new
<Package Folder>/files/####/-UgmpPqLxO9r8zFY.zip
<Package Folder>/files/####/0EsDqD5-9rnX8xRPpkkVTAEmHO8=.new
<Package Folder>/files/####/0R5H1mqXLiUvN9NZq_cxeWnRorw=.temp
<Package Folder>/files/####/0d4a58eb-0e91-4ea3-a994-a2cdc27a5446.pic.temp
<Package Folder>/files/####/0gzZtiFR6PDgwa88UVVQd_z0ZAhx5FUi.new
<Package Folder>/files/####/0pqyD_y_Tb5mV42h52rjLmzx6_B1H8kl.new
<Package Folder>/files/####/1496212843647_2112
<Package Folder>/files/####/1496212843763_2112
<Package Folder>/files/####/1496212844004_2112
<Package Folder>/files/####/1496212844142_2112
<Package Folder>/files/####/1496212855933_2270
<Package Folder>/files/####/1496212855997_2270
<Package Folder>/files/####/1496212856128_2270
<Package Folder>/files/####/1496212878908_2406
<Package Folder>/files/####/1496212879009_2406
<Package Folder>/files/####/1496212879064_2406
<Package Folder>/files/####/1496212889686_2584
<Package Folder>/files/####/1496212889926_2584
<Package Folder>/files/####/1496212890052_2584
<Package Folder>/files/####/2db2718e-ba5f-4b8d-98e8-7e408c0f5890.pic.temp
<Package Folder>/files/####/2e1060f2-ecc7-45ea-aa72-a716b509aeab.pic
<Package Folder>/files/####/5-543EOYaSfhWw0vHeAxszQvoMEevesI_Eeilw==.new
<Package Folder>/files/####/6edf55da-dfe8-41f1-8e3f-bfa78d56ea27.pic.temp
<Package Folder>/files/####/8c24042d-f6d1-4467-9437-3a96a88d5dc7.pic.temp
<Package Folder>/files/####/90048096-6f9a-4598-b3bb-ae848f6ab3bd.pic.temp
<Package Folder>/files/####/9q-kTQN9zH5JBfDmgRuumTatHi8=.temp
<Package Folder>/files/####/DVFY6buDBBu62zA9_Mij9w==
<Package Folder>/files/####/EJo515QJrxAuQgaBb870PtkhMofan8zpfhiTlf357wc=.new
<Package Folder>/files/####/Nfg6j9hL1Y4OJnaezOLu-Q==
<Package Folder>/files/####/Nfg6j9hL1Y4OJnaezOLu-Q==.new
<Package Folder>/files/####/Nfg6j9hL1Y4OJnaezOLu-Q==.old (deleted)
<Package Folder>/files/####/R-NhGgp6aFXtXmU7zSk6vXcWV2xD1bhc.new
<Package Folder>/files/####/Xo6-3qwGzkm9fogQkhgmRc5FLMI=.new
<Package Folder>/files/####/Y1Ju0vEZgP4H58-Q7yJWKY_h9hdFPVpm_M9tjg==.new
<Package Folder>/files/####/Z_HePOFFkwTcFaEttcgoY-CUD260KBKz50EGBMA-WJo=.new
<Package Folder>/files/####/_BRJX23DsQ310V6_RTLoPg==
<Package Folder>/files/####/a93e4ca2-5f77-422c-9de1-385da38d138a.pic
<Package Folder>/files/####/b90ce8cc-c4bd-46aa-bb3d-a2d359472ccc.pic.temp
<Package Folder>/files/####/bZmzLjTVpcPfYCX0eaYW69O3UCA=.new
<Package Folder>/files/####/cuGq9417EUnIiZlS
<Package Folder>/files/####/fgZevgA9cuxXtSS0nNTq4Ik_76mvLeDLn7QzpxJgF6Q=.new
<Package Folder>/files/####/gb7PiirCI4PiQ1WzEu1QJpAHIVI10D1C
<Package Folder>/files/####/gb7PiirCI4PiQ1WzEu1QJpAHIVI10D1C.new
<Package Folder>/files/####/hAul4_MuyaC7EMW8LkIj-lW-FMg=
<Package Folder>/files/####/hbipuw_f.zip
<Package Folder>/files/####/kzR7R3JpD2Eb-oWonPKAL66oe9M=.new
<Package Folder>/files/####/lk2qXbA1FF27iyePqhzHEGeAXwk=
<Package Folder>/files/####/o6rPr8BdFAsCNgqRXQU4Lw==.new
<Package Folder>/files/####/pMLR3oW4Hf_BYnzFcY_wHEnUBE6IBGARr2-Jxw==.new
<Package Folder>/files/####/plus.jar
<Package Folder>/files/####/psGN2tKDrbrfSBY7.new
<Package Folder>/files/####/qGrFhVb_eMVKjx6YOWEk0K5LkqKSaegy.new
<Package Folder>/files/####/rTS-TPwYaHCVyfLMxj7ViNq2QBK48x6_.new
<Package Folder>/files/####/runner_info.prop.new
<Package Folder>/files/####/sDqpwVl5M7z5WeiXTzkuWw==.new
<Package Folder>/files/####/xKmPdzBBrdcdvtkY1tqCs2EbQlUaEWtPAryfRI10h2E=.new
<Package Folder>/files/####/zf5ch58V0JbxbVnQTX-gHgoC8JuXiUc9.new
<Package Folder>/files/rdata_comyvznyxpn.new
<Package Folder>/files/yy.dt
<Package Folder>/shared_prefs/315432f0c34a6005ff1c18a57a27f742e|account_file.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
<Package Folder>/shared_prefs/TDpref_game.xml
<Package Folder>/shared_prefs/TDpref_longtime.xml
<Package Folder>/shared_prefs/TDpref_longtime3.xml
<Package Folder>/shared_prefs/TDpref_longtime3.xml.bak
<Package Folder>/shared_prefs/TDpref_shorttime.xml
<Package Folder>/shared_prefs/com.souying.pay.plugmain_p_config.xml
<Package Folder>/shared_prefs/com.souying.pay.xml
<Package Folder>/shared_prefs/plugins.installed.xml
<Package Folder>/shared_prefs/plugins.serviceMapping.xml
<Package Folder>/shared_prefs/pretw.xml
<Package Folder>/shared_prefs/pretw.xml.bak
<Package Folder>/shared_prefs/sdk.xml
<Package Folder>/shared_prefs/sy_pay_config.xml
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/twc.xml
<Package Folder>/shared_prefs/twc.xml.bak
<Package Folder>/shared_prefs/zzconfig.xml
<SD-Card>/.armsd/####/54a9e46d-1606-4fc1-8f7b-f941253d96b4.res
<SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
<SD-Card>/.armsd/####/842095b4-dc43-457e-9ad8-76838a530709.res
<SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
<SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
<SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
<SD-Card>/.armsd/####/bdc2636e-9258-4ded-8fa2-19df12681b7b.res
<SD-Card>/.armsd/####/e27b35bc-5fac-4b74-a59b-87a637900950.res
<SD-Card>/.armsd/####/f76e7ba6-f0cb-4807-b498-9328b76f3b64.res
<SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
<SD-Card>/.env/.uunique.new
<SD-Card>/.tcookieid
<SD-Card>/.twservice/####/tw
<SD-Card>/.twservice/tkddbp_3001_2275.zip
<SD-Card>/CrashLog/WyyyCrashLog_20170531064055_2270.log
<SD-Card>/CrashLog/WyyyCrashLog_20170531064118_2406.log
<SD-Card>/CrashLog/WyyyCrashLog_20170531064129_2584.log

Miscellaneous:

Executes next shell scripts:

/data/data/com.i.i/code-6577864/MlsfTWcI4f4lMD4- -p com.i.i -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
/data/data/com.i.i/code-6682118/MlsfTWcI4f4lMD4- -p com.i.i -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
<dexopt>
<error:2>
cat /proc/version
cat /sys/block/mmcblk0/device/cid
getprop
sh <Package Folder>/code-6577864/MlsfTWcI4f4lMD4- -p <Package> -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
sh <Package Folder>/code-6682118/MlsfTWcI4f4lMD4- -p <Package> -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial