JavaScript support is required for our site to be fully operational in your browser.
Android.SmsSpy.7142
Added to the Dr.Web virus database:
2018-08-14
Virus description added:
2018-08-14
Technical information
Malicious functions:
Sends SMS messages:
1043992720: Snapple Whistler:null
1064931079: Runway Darling:null
1113949215: Mafia Rapunzel:null
1142481866: Wooden German:null
1163968006: Cosmo:null
1201489294: Mafia Rapunzel:null
1362646290: Swan Mustang:null
1616561530: Stallion Patton:null
1654007457: Swan Mustang:null
1775586431: Risen:null
2031009865: Dandelion:null
2354508950: Dandelion:null
2456682248: Frenzy:null
2501614547: BearDrift:null
2555811474: DreadSherX:null
3454987976: Ladybird:null
3536907946: Shy Warrior:null
3556679508: Wooden German:null
3623146972: Speedwell:null
3672547070: Skull Crusher:null
4163942730: Mindless Bobcat:null
4356706435: Mafia Rapunzel:null
4411012013: Stacker of Wheat:null
4651868321: Ladybird:null
4652083291: Omega Sub:null
4732682109: Cosmo:null
5256037002: Nibbler:null
5337143919: Stallion Patton:null
5622829885: Voluntary:null
5712971673: Runway Darling:null
5721935629: Mr. Alien:null
5726666779: Mr. Alien:null
6111138029: Cosmo:null
6241256948: Voluntary:null
6321219754: Sw33per:null
6322585926: Skull Crusher:null
6526946239: FrankenGrin:null
7143244934: Snapple Whistler:null
7154342805: FrankenGrin:null
7166122334: Sw33per:null
7216091506: DreadSherX:null
7231674775: Mindless Bobcat:null
7265308424: Speedwell:null
7311624140: Frenzy:null
7311855283: Prof. Smirk:null
7534033906: Mr. Alien:null
7654089974: Risen:null
7655332786: Snapple Whistler:null
7756113822: Mindless Bobcat:null
Executes code of the following detected threats:
Android.SmsSpy.559.origin
Network activity:
Connecting to:
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) and####.b####.qq.com:80
DNS requests:
aexcep####.b####.qq.com
and####.b####.qq.com
mt####.go####.com
HTTP POST requests:
aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
Modified file system:
Creates the following files:
/data/data/####/bugly_db_legu-journal
/data/data/####/libnfix.so
/data/data/####/libshella-2.9.0.1.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/mix.dex
/data/data/####/native_record_lock
/data/data/####/security_info
Miscellaneous:
Executes next shell scripts:
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.9.0.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
Loads the following dynamic libraries:
Bugly
libnfix
libshella-2.9.0.1
libufix
nfix
ufix
Uses the following algorithms to encrypt data:
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
Uses special library to hide executable bytecode.
Gains access to telephone information (number, imei, etc.).
Curing recommendations
Android
If the mobile device is operating normally, download and install Dr.Web for Android Light . Run a full system scan and follow recommendations to neutralize the detected threats.
If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
Switch off your device and turn it on as normal.
Find out more about Dr.Web for Android
このウェブサイトを継続して訪問する場合、訪問者に関する統計データを収集するためのCookieファイルおよび他のテクノロジーを弊社が利用することに同意したものとします。詳細
OK