Technical information
Malicious functions:
Sends SMS messages:
- 12114: HZSY#<IMSI>
Executes code of the following detected threats:
- Android.SkyMobi.5.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.547.origin
Network activity:
Connecting to:
- a####.####.cn
- col####.####.com
- i####.####.cn
- i####.####.com
- mmy####.####.com
HTTP GET requests:
- a####.####.cn/119e875346024f0ab55583a2664a0771.apk
- i####.####.cn/35cf3e75a5a644749bf19ea9fd148a00.jpg
- i####.####.com/de5e1a16d7ce48258e2480cb462515ca.png
- mmy####.####.com/yysd-cps//plugSwitch.service?&appId=####&channelId=####...
HTTP POST requests:
- col####.####.com/stats.service
Modified file system:
Creates the following files:
- <Package Folder>/app_skypay_newsdk/####/com.skymobi.pay.plugin.main.apk
- <Package Folder>/cache/####/03650f813f90c509be7d36197e755d26.0.tmp
- <Package Folder>/cache/####/03650f813f90c509be7d36197e755d26.1.tmp
- <Package Folder>/cache/####/3c7ebe1a368725093676f2c5d8c824f4.0.tmp
- <Package Folder>/cache/####/3c7ebe1a368725093676f2c5d8c824f4.1.tmp
- <Package Folder>/cache/####/497f9fa97cdac105a1cbbcb328a2f490.0.tmp
- <Package Folder>/cache/####/497f9fa97cdac105a1cbbcb328a2f490.1.tmp
- <Package Folder>/cache/####/574d1ebaeb9bc7b72726b90733ca812d.0.tmp
- <Package Folder>/cache/####/574d1ebaeb9bc7b72726b90733ca812d.1.tmp
- <Package Folder>/cache/####/67c5e97895ac1fae4d9d773c8700043b.0.tmp
- <Package Folder>/cache/####/67c5e97895ac1fae4d9d773c8700043b.1.tmp
- <Package Folder>/cache/####/6be17683a0644938715577244bb7222a.0.tmp
- <Package Folder>/cache/####/6be17683a0644938715577244bb7222a.1.tmp
- <Package Folder>/cache/####/784ee6f5eef7e72ff073474c63a10c2e.0.tmp
- <Package Folder>/cache/####/784ee6f5eef7e72ff073474c63a10c2e.1.tmp
- <Package Folder>/cache/####/91112f5100bb83dffcc908270ce70b36.0.tmp
- <Package Folder>/cache/####/91112f5100bb83dffcc908270ce70b36.1.tmp
- <Package Folder>/cache/####/91d104f26d0bafba42ad6fe209a2e088.0.tmp
- <Package Folder>/cache/####/91d104f26d0bafba42ad6fe209a2e088.1.tmp
- <Package Folder>/cache/####/99dc5b42c9ab86cf69001da9947ca1da.0.tmp
- <Package Folder>/cache/####/99dc5b42c9ab86cf69001da9947ca1da.1.tmp
- <Package Folder>/cache/####/9aff13ebf8bbc5eb53d7884184d9f7df.0.tmp
- <Package Folder>/cache/####/9aff13ebf8bbc5eb53d7884184d9f7df.1.tmp
- <Package Folder>/cache/####/a73a90ec334e634607644fda298ed266.0.tmp
- <Package Folder>/cache/####/a73a90ec334e634607644fda298ed266.1.tmp
- <Package Folder>/cache/####/e93a1609b0a51e4cac6b3894422865b1.0.tmp
- <Package Folder>/cache/####/e93a1609b0a51e4cac6b3894422865b1.1.tmp
- <Package Folder>/cache/####/ee4c57d57086ed953ee1686f63bacdf0.0.tmp
- <Package Folder>/cache/####/ee4c57d57086ed953ee1686f63bacdf0.1.tmp
- <Package Folder>/cache/####/f14b24c820f3da9fca3f64763b6a1415.0.tmp
- <Package Folder>/cache/####/f14b24c820f3da9fca3f64763b6a1415.1.tmp
- <Package Folder>/cache/####/f9ba1910b208d65bb92b242c81e2e5b4.0.tmp
- <Package Folder>/cache/####/f9ba1910b208d65bb92b242c81e2e5b4.1.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/p_db
- <Package Folder>/databases/p_db-journal
- <Package Folder>/databases/recommend_app-journal
- <Package Folder>/databases/statistics_db
- <Package Folder>/databases/statistics_db-journal
- <Package Folder>/databases/sy_pay_record-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/OriginClasses.jar
- <Package Folder>/files/####/busybox
- <Package Folder>/files/####/libinst.so
- <Package Folder>/files/####/nail
- <Package Folder>/files/####/sub_nail
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/com_xl_shared_preferences.xml
- <Package Folder>/shared_prefs/config_ad.xml
- <Package Folder>/shared_prefs/ds_configer.xml
- <Package Folder>/shared_prefs/p_config.xml
- <Package Folder>/shared_prefs/ph_config.xml
- <Package Folder>/shared_prefs/pt.xml
- <Package Folder>/shared_prefs/recommend.xml
- <Package Folder>/shared_prefs/uuid.xml
- <SD-Card>/Android/####/com.skymobi.pay.plugin.main.apk
- <SD-Card>/SAdAssetsAX/game.properties
- <SD-Card>/SAdAssetsAX/game20150817.apk
- <SD-Card>/SPRecordAX/####/1000485c9c8fcd55284d568b5aea9452abd05f
- <SD-Card>/SPRecordAX/####/100107de5e1a16d7ce48258e2480cb462515ca
- <SD-Card>/SPRecordAX/####/1001156bc6719a2a664876975bbbcb2b08bf0a
- <SD-Card>/SPRecordAX/####/100182d778061531a6481899cab0baadc04205
- <SD-Card>/SPRecordAX/####/14075c10f5d776b456fa45866e41c2108fd
- <SD-Card>/SPRecordAX/####/sRecordsAp
- <SD-Card>/SYPAYFILENAME/####/ISDELSMS
- <SD-Card>/sylog/170727_082011.log
- <SD-Card>/sylog/170727_082012.log
- <SD-Card>/sylog/170727_082019.log
- <SD-Card>/sylog/170727_082020.log
- <SD-Card>/sylog/170727_082021.log
- <SD-Card>/sylog/170727_082039.log
- <SD-Card>/sylog/170727_082040.log
Miscellaneous:
Executes next shell scripts:
- cat /proc/version
- chmod 666 /data/data/com.andexew1.dfew/app_skypay_newsdk/plugins/com.skymobi.pay.plugin.main.apk
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
- chmod 666 <Package Folder>/app_skypay_newsdk/plugins/com.skymobi.pay.plugin.main.apk
Loads the following dynamic libraries:
- hammer
- originshell
- videoPlug
- zimon
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Gains access to telephone information (number, imei, etc.).
Gains access to information about APN settings.
Gains access to information about installed applications.
Gains access to information about sent/received SMS messages.