Android.DownLoader.3552

Technical information

Malicious functions:

Sends SMS messages:

10658077696615: YX,264340,10,fe5a,1807926,615004,H7F819350861
10658423: mvwlan,9aa2917125fd11d9730ebe20f6560881,ZpTK
10658999: DH410224
1066510600: 212

Executes code of the following detected threats:

Android.DownLoader.600.origin
Android.SmsSpy.677.origin

Downloads the following detected threats from the Web:

Android.SmsSpy.677.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sdk.qi1####.com:80
TCP(HTTP/1.1) 1####.55.16.91:8080
TCP(HTTP/1.1) q####.qi1####.com:14302
TCP(HTTP/1.1) 1####.55.17.147:8080
TCP(HTTP/1.1) preload####.hishen####.com:5500
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) qyc####.qi1####.com:8200
TCP(HTTP/1.1) q####.qi1####.com:15302
TCP(HTTP/1.1) 88####.net:88
TCP(HTTP/1.1) zxc####.wann####.com:8200
TCP(HTTP/1.1) z####.wann####.com:9500
TCP(HTTP/1.1) p####.nj####.com.####.com:8080
TCP(HTTP/1.1) 1####.149.136.219:80
TCP(HTTP/1.1) d####.kingw####.com.cn:80
TCP(HTTP/1.1) prelo####.hishen####.com:80
TCP(HTTP/1.1) f####.disp####.spcd####.com:80
TCP(HTTP/1.1) z####.wann####.com:9600
TCP(HTTP/1.1) hangzho####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) int.d####.s####.####.cn:80

DNS requests:

88####.net
a####.u####.com
d####.kingw####.com.cn
hangzho####.oss-cn-####.aliy####.com
int.d####.s####.####.cn
oa5cv####.bkt.clo####.com
p####.nj####.com
prelo####.hishen####.com
preload####.hishen####.com
q####.qi1####.com
qyc####.qi1####.com
sdk.qi1####.com
smm-100####.f####.myqc####.com
vb####.wann####.com
z####.wann####.com
zxc####.wann####.com

HTTP GET requests:

88####.net:88/game/cof.do?k=####
d####.kingw####.com.cn/1/40001-C01
f####.disp####.spcd####.com/as.txt
hangzho####.oss-cn-####.aliy####.com/qiyi/client/sdk/so/libzxvps.so
int.d####.s####.####.cn/iplookup/iplookup.php?format=####
p####.nj####.com.####.com:8080/png/ic_jyyy.png
p####.nj####.com.####.com:8080/res/novel/app/content/1.txt
p####.nj####.com.####.com:8080/res/novel/app/content/10.txt
p####.nj####.com.####.com:8080/res/novel/app/content/11.txt
p####.nj####.com.####.com:8080/res/novel/app/content/12.txt
p####.nj####.com.####.com:8080/res/novel/app/content/13.txt
p####.nj####.com.####.com:8080/res/novel/app/content/14.txt
p####.nj####.com.####.com:8080/res/novel/app/content/15.txt
p####.nj####.com.####.com:8080/res/novel/app/content/16.txt
p####.nj####.com.####.com:8080/res/novel/app/content/2.txt
p####.nj####.com.####.com:8080/res/novel/app/content/3.txt
p####.nj####.com.####.com:8080/res/novel/app/content/4.txt
p####.nj####.com.####.com:8080/res/novel/app/content/5.txt
p####.nj####.com.####.com:8080/res/novel/app/content/6.txt
p####.nj####.com.####.com:8080/res/novel/app/content/7.txt
p####.nj####.com.####.com:8080/res/novel/app/content/8.txt
p####.nj####.com.####.com:8080/res/novel/app/content/9.txt
p####.nj####.com.####.com:8080/res/novel/app/icon/1.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/2.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/3.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/4.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/5.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/6.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/7.jpg
p####.nj####.com.####.com:8080/sdk/dp_1.6.2.jar
p####.nj####.com.####.com:8080/sdk/spaycoredex_so_2050.jar
prelo####.hishen####.com/project_preloaded/36dd4e9586a7461ab707925c0ac78...
prelo####.hishen####.com/project_preloaded/4cb6e199a3c546b29bd508100c87e...
prelo####.hishen####.com/project_preloaded/69a5abb02d194050a4995a7fbafd6...
prelo####.hishen####.com/project_preloaded/b0a7a2a12f4f49168816270ec4419...
prelo####.hishen####.com/project_preloaded/c6af18944ba64e0f86ee9cecc7b60...
qyc####.qi1####.com:8200/sdk/file?6aMmDnb####
sdk.qi1####.com/qiyi/client/sdk/PaySDK-1.2.16.8-UR_yx.jar
sdk.qi1####.com/vpssdk/andrcool_1.0.1.jar
t####.c####.q####.####.com/ic_ttxcwewx.png

HTTP POST requests:

88####.net:88/game/open.do
88####.net:88/game/start.do?ver=####
a####.u####.com/app_logs
preload####.hishen####.com:5500/api-log-server/userDeviceInfo/saveDevice
preload####.hishen####.com:5500/api-log-server/userDeviceInfo/saveFile
q####.qi1####.com:14302/sdk_login?t=####
q####.qi1####.com:15302/sdk_login?t=####
qyc####.qi1####.com:8200/sdk/log
z####.wann####.com:9500/
z####.wann####.com:9600/
zxc####.wann####.com:8200/qy/acceptSdkFileReq
zxc####.wann####.com:8200/qy/getOnlineLoginHttpReq

Modified file system:

Creates the following files:

/data/data/####/._logo_img_0.jpg
/data/data/####/._mm_show_0_0.jpg
/data/data/####/._mm_show_0_1.jpg
/data/data/####/._mm_show_0_2.jpg
/data/data/####/._mm_show_0_3.jpg
/data/data/####/._mm_show_1_0.jpg
/data/data/####/._mm_show_1_1.jpg
/data/data/####/._mm_show_1_2.jpg
/data/data/####/._mm_show_1_3.jpg
/data/data/####/._mm_show_2_0.jpg
/data/data/####/._mm_show_2_1.jpg
/data/data/####/._mm_show_2_2.jpg
/data/data/####/._mm_show_2_3.jpg
/data/data/####/._mm_show_3_0.jpg
/data/data/####/._mm_show_3_1.jpg
/data/data/####/._mm_show_3_2.jpg
/data/data/####/._mm_show_4_0.jpg
/data/data/####/._mm_show_4_1.jpg
/data/data/####/._mm_show_4_2.jpg
/data/data/####/._mm_show_5_0.jpg
/data/data/####/._mm_show_5_1.jpg
/data/data/####/._mm_show_5_2.jpg
/data/data/####/._mm_show_6_0.jpg
/data/data/####/._mm_show_6_1.jpg
/data/data/####/._mm_show_6_2.jpg
/data/data/####/._pg_1.png
/data/data/####/._pg_2.png
/data/data/####/._pg_3.png
/data/data/####/._pic_bg.png
/data/data/####/._pic_mm_0.jpg
/data/data/####/._pic_mm_1.jpg
/data/data/####/._pic_mm_2.jpg
/data/data/####/._pic_mm_3.jpg
/data/data/####/._pic_mm_4.jpg
/data/data/####/._pic_mm_5.jpg
/data/data/####/._pic_mm_6.jpg
/data/data/####/._pic_mm_7.jpg
/data/data/####/._price1.jpg
/data/data/####/._price3.png
/data/data/####/.imprint
/data/data/####/.jar
/data/data/####/1122150653473.36
/data/data/####/1122150653473.36 (deleted)
/data/data/####/1122150653489.12
/data/data/####/1122150653489.12 (deleted)
/data/data/####/1122150653566.55
/data/data/####/1122150653566.55 (deleted)
/data/data/####/1122150653778.63
/data/data/####/1122150653778.63 (deleted)
/data/data/####/1122150653796.25
/data/data/####/1122150653796.25 (deleted)
/data/data/####/1122150653834.89
/data/data/####/1122150653834.89 (deleted)
/data/data/####/1122150653836.56
/data/data/####/1122150653836.56 (deleted)
/data/data/####/1122150654023.6
/data/data/####/1122150654023.6 (deleted)
/data/data/####/1122150654135.34
/data/data/####/1122150654135.34 (deleted)
/data/data/####/1122150654141.2
/data/data/####/1122150654141.2 (deleted)
/data/data/####/1122150654160.54
/data/data/####/1122150654160.54 (deleted)
/data/data/####/1122150654230.72
/data/data/####/1122150654230.72 (deleted)
/data/data/####/1122150654438.85
/data/data/####/1122150654438.85 (deleted)
/data/data/####/1132.30089999093
/data/data/####/1132.30089999093 (deleted)
/data/data/####/1132.34542065845
/data/data/####/1132.34542065845 (deleted)
/data/data/####/1132.38994132597
/data/data/####/1132.38994132597 (deleted)
/data/data/####/1132.43446199348
/data/data/####/1132.43446199348 (deleted)
/data/data/####/1132.478982661
/data/data/####/1132.478982661 (deleted)
/data/data/####/1132.52350332852
/data/data/####/1132.52350332852 (deleted)
/data/data/####/1132.56802399603
/data/data/####/1132.56802399603 (deleted)
/data/data/####/161.918512514603
/data/data/####/161.918512514603 (deleted)
/data/data/####/2325850080122.39
/data/data/####/2325850080122.39 (deleted)
/data/data/####/2325850081007.37
/data/data/####/2325850081007.37 (deleted)
/data/data/####/2325850081488.87
/data/data/####/2325850081488.87 (deleted)
/data/data/####/2325850082007.48
/data/data/####/2325850082007.48 (deleted)
/data/data/####/2325850082183.63
/data/data/####/2325850082183.63 (deleted)
/data/data/####/2325850082613.85
/data/data/####/2325850082613.85 (deleted)
/data/data/####/2325850086733.55
/data/data/####/2325850086733.55 (deleted)
/data/data/####/261210153604.006
/data/data/####/261210153604.006 (deleted)
/data/data/####/261210153703.395
/data/data/####/261210153703.395 (deleted)
/data/data/####/261210153757.471
/data/data/####/261210153757.471 (deleted)
/data/data/####/261210153815.715
/data/data/####/261210153815.715 (deleted)
/data/data/####/261210153835.498
/data/data/####/261210153835.498 (deleted)
/data/data/####/261210153883.815
/data/data/####/261210153883.815 (deleted)
/data/data/####/261210154346.488
/data/data/####/261210154346.488 (deleted)
/data/data/####/2965458876185.74
/data/data/####/2965458876185.74 (deleted)
/data/data/####/2965458876227.39
/data/data/####/2965458876227.39 (deleted)
/data/data/####/2965458876431.99
/data/data/####/2965458876431.99 (deleted)
/data/data/####/2965458876992.45
/data/data/####/2965458876992.45 (deleted)
/data/data/####/2965458877039.02
/data/data/####/2965458877039.02 (deleted)
/data/data/####/2965458877141.13
/data/data/####/2965458877141.13 (deleted)
/data/data/####/2965458877145.56
/data/data/####/2965458877145.56 (deleted)
/data/data/####/2965458877639.83
/data/data/####/2965458877639.83 (deleted)
/data/data/####/2965458877935.12
/data/data/####/2965458877935.12 (deleted)
/data/data/####/2965458877950.6
/data/data/####/2965458877950.6 (deleted)
/data/data/####/2965458878001.72
/data/data/####/2965458878001.72 (deleted)
/data/data/####/2965458878187.18
/data/data/####/2965458878187.18 (deleted)
/data/data/####/2965458878737.2
/data/data/####/2965458878737.2 (deleted)
/data/data/####/3660380.04099951
/data/data/####/3660380.04099951 (deleted)
/data/data/####/3660380.34145408
/data/data/####/3660380.34145408 (deleted)
/data/data/####/5950279.47887045
/data/data/####/5950279.47887045 (deleted)
/data/data/####/690288747022.976
/data/data/####/690288747022.976 (deleted)
/data/data/####/690288747285.628
/data/data/####/690288747285.628 (deleted)
/data/data/####/690288747428.532
/data/data/####/690288747428.532 (deleted)
/data/data/####/690288747582.451
/data/data/####/690288747582.451 (deleted)
/data/data/####/690288747634.731
/data/data/####/690288747634.731 (deleted)
/data/data/####/690288747762.416
/data/data/####/690288747762.416 (deleted)
/data/data/####/690288748985.102
/data/data/####/690288748985.102 (deleted)
/data/data/####/889.37042982576
/data/data/####/889.37042982576 (deleted)
/data/data/####/889.414950493276
/data/data/####/889.414950493276 (deleted)
/data/data/####/889.459471160793
/data/data/####/889.459471160793 (deleted)
/data/data/####/889.503991828309
/data/data/####/889.503991828309 (deleted)
/data/data/####/889.548512495826
/data/data/####/889.548512495826 (deleted)
/data/data/####/889.593033163343
/data/data/####/889.593033163343 (deleted)
/data/data/####/889.637553830859
/data/data/####/889.637553830859 (deleted)
/data/data/####/889.682074498376
/data/data/####/889.682074498376 (deleted)
/data/data/####/889.726595165892
/data/data/####/889.726595165892 (deleted)
/data/data/####/__gather_impl-207718191436313063506.jar
/data/data/####/__gather_impl.jar
/data/data/####/a.db
/data/data/####/a.db-journal
/data/data/####/andrcool.jar
/data/data/####/cache155804822736312540770
/data/data/####/cache47545721936312793612
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/device_info.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/fruto.mjcco.sylxm.erogq.jar
/data/data/####/getprop
/data/data/####/libgather.xml
/data/data/####/libzxsessionsafe.so
/data/data/####/logo_img_0.jpg
/data/data/####/maan.so
/data/data/####/mm_show_0_0.jpg
/data/data/####/mm_show_0_1.jpg
/data/data/####/mm_show_0_2.jpg
/data/data/####/mm_show_0_3.jpg
/data/data/####/mm_show_1_0.jpg
/data/data/####/mm_show_1_1.jpg
/data/data/####/mm_show_1_2.jpg
/data/data/####/mm_show_1_3.jpg
/data/data/####/mm_show_2_0.jpg
/data/data/####/mm_show_2_1.jpg
/data/data/####/mm_show_2_2.jpg
/data/data/####/mm_show_2_3.jpg
/data/data/####/mm_show_3_0.jpg
/data/data/####/mm_show_3_1.jpg
/data/data/####/mm_show_3_2.jpg
/data/data/####/mm_show_4_0.jpg
/data/data/####/mm_show_4_1.jpg
/data/data/####/mm_show_4_2.jpg
/data/data/####/mm_show_5_0.jpg
/data/data/####/mm_show_5_1.jpg
/data/data/####/mm_show_5_2.jpg
/data/data/####/mm_show_6_0.jpg
/data/data/####/mm_show_6_1.jpg
/data/data/####/mm_show_6_2.jpg
/data/data/####/pg_1.png
/data/data/####/pg_2.png
/data/data/####/pg_3.png
/data/data/####/pic_bg.png
/data/data/####/pic_mm_0.jpg
/data/data/####/pic_mm_1.jpg
/data/data/####/pic_mm_2.jpg
/data/data/####/pic_mm_3.jpg
/data/data/####/pic_mm_4.jpg
/data/data/####/pic_mm_5.jpg
/data/data/####/pic_mm_6.jpg
/data/data/####/pic_mm_7.jpg
/data/data/####/pid
/data/data/####/price1.jpg
/data/data/####/price3.png
/data/data/####/qy_db_pay-journal
/data/data/####/qy_device_info_sdk_update.jar
/data/data/####/qy_video_ad_sdk_update.jar
/data/data/####/story_btn_read.png
/data/data/####/tab1_0.png
/data/data/####/tab1_1.png
/data/data/####/tab2_0.png
/data/data/####/tab2_1.png
/data/data/####/tmp_jar
/data/data/####/tmp_so
/data/data/####/twsdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/unknown.xml
/data/data/####/userData.xml
/data/data/####/userDatas.xml
/data/data/####/video_brush_update.jar
/data/data/####/web_page_sdk_update.jar
/data/data/####/webview.db-journal
/data/data/####/xUtils_http_cache.db
/data/data/####/xUtils_http_cache.db-journal
/data/data/####/xUtils_http_cookie.db
/data/data/####/xUtils_http_cookie.db-journal
/data/media/####/.cfg
/data/media/####/031f04ef44c86d37888b9206208ab7ff
/data/media/####/1.txt.tmp
/data/media/####/10.txt.tmp
/data/media/####/11.txt.tmp
/data/media/####/110b6dcd7a403d3581b21c2d9d50f95c
/data/media/####/12.txt.tmp
/data/media/####/13.txt.tmp
/data/media/####/14.txt.tmp
/data/media/####/15.txt.tmp
/data/media/####/16.txt.tmp
/data/media/####/2.txt.tmp
/data/media/####/3.txt.tmp
/data/media/####/300f50dfb16e035d7ba2ebd4753b36b8
/data/media/####/331f98a2bef20e0a6dd488950b30e096
/data/media/####/37369606dabb1294642a0c943d568811
/data/media/####/4.txt.tmp
/data/media/####/4a8ed236d3c1180efa3876375671c949
/data/media/####/5.txt.tmp
/data/media/####/5c4ec0f1f4d088a045f2232d7ba42734
/data/media/####/6.txt.tmp
/data/media/####/614b01e4628d6b78f36743a3105948fe
/data/media/####/62f1907afbb95f64ac01e4c5b38fb577
/data/media/####/641396e85bf54468fe7cee3296fab1be
/data/media/####/650e95b5e1cede70521b40312c9b8778
/data/media/####/66ddf3f162a970b60b9c258d5a0e1375
/data/media/####/6df305578d33b959aa5a3d558d1de3da
/data/media/####/7.txt.tmp
/data/media/####/75477a75b778b73231f6f7c956598382
/data/media/####/8.txt.tmp
/data/media/####/87443ebddac237f9f5a2de2bfddd4543
/data/media/####/897f47697ee1e6f740a2bff65a9d1b9e
/data/media/####/8acf08558ad9a62966ddb70b9a7b29a0
/data/media/####/9.txt.tmp
/data/media/####/90390554d94bc5ccfaca4c526a975414
/data/media/####/FrameCore.jar
/data/media/####/a92e50a79bd7c8354a7440e213277927
/data/media/####/af86db672271d83d2e193d717def0b90
/data/media/####/com.chaodong.fate.android.png.tmp
/data/media/####/com.molove.mobile.sjwwx.apk.tmp
/data/media/####/com.molove.mobile.sjwwx.png.tmp
/data/media/####/device
/data/media/####/dp.jar.tmp

Miscellaneous:

Executes next shell scripts:

app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.google.android.gms.analytics.CampaignTrackingService
cat /sys/block/mmcblk0/device/cid
chmod 777 <Package Folder>/lib/helper
dd if=<Package Folder>/lib/libhelper.so of=<Package Folder>/lib/helper
df
getprop
ls -l /system/bin/su
ps | grep <Package>
sh

Loads the following dynamic libraries:

libhelper
libsmsmanager
libzxsessionsafe
libzxvps

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-ECB-PKCS5Padding
DES
DES-ECB-NoPadding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Parses information from SMS messages.

Gains access to information about sent/received SMS messages.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial