Android.SmsSend.20144

Technical information

Malicious functions:

Sends SMS messages:

12114516420: <IMSI>

Network activity:

Connecting to:

1####.####.226
1####.####.226:8002
1####.####.238
1####.####.238:8977
7j####.####.com
a####.####.com
and####.####.com
and####.####.com:8077
c####.####.com
c####.####.com:10101
c-h####.####.com
huangda####.com
i####.####.cn
i####.####.com:10003
iji####.com
m####.####.com
p####.####.com
re####.####.com:10002
s####.####.com
v####.####.com
w####.####.com

HTTP GET requests:

1####.####.238/dex/ldsource.bin
1####.####.238:8977/dex/version.txt
7j####.####.com/tdata_smp819
a####.####.com/fetch.php?gid=####&ch=####&key=####
a####.####.com/location/ip?ak=####&mcode=####
c####.####.com/v1/sdk/report?sdk_type=####&sdk_status=####&trade_id=####...
c####.####.com:10101/v1/order/get?phone=####&imei=####&sdk_version=####&...
huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
i####.####.cn/iplookup/iplookup.php?format=####
iji####.com/tcmn/home/user_setting?vncode=####&channel=####&uid=####&prv...
m####.####.com/course/504703.html?cm=####
p####.####.com/cityjson?ie=####
re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
s####.####.com/config/hz-hzv3.conf
v####.####.com/pic/tcmn/wap/images/yf_service_24.png
w####.####.com/r/378609775/378609778/index.htm?cm=####

HTTP POST requests:

1####.####.226/api/sl/vcoderule/getvalid
1####.####.226:8002/api/sl/vcoderule/getvalid
and####.####.com/record-plat/record/upload.do
and####.####.com:8077/record-plat/seq/query.do
c-h####.####.com/api.php?format=####&t=####
i####.####.com:10003/v2/chis
s####.####.com/api.php?format=####&t=####

Modified file system:

Creates the following files:

<Package Folder>/app_dex/classes.jar
<Package Folder>/app_workbench89680/apk.zip
<Package Folder>/app_workbench95206/apk.zip
<Package Folder>/cache/####/-10834477481532826292
<Package Folder>/cache/####/-1176971578-573101368
<Package Folder>/cache/####/-1177243917-1791807692
<Package Folder>/cache/####/-1232232054-81481422
<Package Folder>/cache/####/-1338047288-1094911917
<Package Folder>/cache/####/-1338047288-115143683
<Package Folder>/cache/####/-1338047288-127082432
<Package Folder>/cache/####/-1338047288-1314233318
<Package Folder>/cache/####/-1338047288-1397785788
<Package Folder>/cache/####/-1338047288-151434212
<Package Folder>/cache/####/-1338047288-1620069699
<Package Folder>/cache/####/-1338047288-1627937145
<Package Folder>/cache/####/-1338047288-1858231835
<Package Folder>/cache/####/-1338047288-2024016358
<Package Folder>/cache/####/-1338047288-2102695262
<Package Folder>/cache/####/-1338047288-377866644
<Package Folder>/cache/####/-1338047288-69566903
<Package Folder>/cache/####/-13380472881552276613
<Package Folder>/cache/####/-13380472881774510173
<Package Folder>/cache/####/-13380472881896295776
<Package Folder>/cache/####/-13380472881925521409
<Package Folder>/cache/####/-1338047288487330842
<Package Folder>/cache/####/-1338047288507594253
<Package Folder>/cache/####/-1669846188963412396
<Package Folder>/cache/####/-17667535292081835108
<Package Folder>/cache/####/-1766753532-105485907
<Package Folder>/cache/####/-1797371345-202952788
<Package Folder>/cache/####/-1799176523-1097279239
<Package Folder>/cache/####/-1960877716-1175751853
<Package Folder>/cache/####/-220731785-1123529328
<Package Folder>/cache/####/-220731785-1866934318
<Package Folder>/cache/####/-220731785248271371
<Package Folder>/cache/####/-406083722-1913861903
<Package Folder>/cache/####/-406083722-1915535325
<Package Folder>/cache/####/-406083722-673808585
<Package Folder>/cache/####/-40608372285953041
<Package Folder>/cache/####/-502396558-1216320515
<Package Folder>/cache/####/-60686588-557616946
<Package Folder>/cache/####/1112325137-1421146515
<Package Folder>/cache/####/1112325137-1878663413
<Package Folder>/cache/####/1112325137-427747099
<Package Folder>/cache/####/1112325137-658176393
<Package Folder>/cache/####/1112325137-695850567
<Package Folder>/cache/####/1112325137-696774088
<Package Folder>/cache/####/1112325137-725403239
<Package Folder>/cache/####/1112325137101390396
<Package Folder>/cache/####/11123251371138282312
<Package Folder>/cache/####/111232513713399480
<Package Folder>/cache/####/11123251371806588945
<Package Folder>/cache/####/1112325137276443918
<Package Folder>/cache/####/1112325137827543757
<Package Folder>/cache/####/1118866582-678079405
<Package Folder>/cache/####/1125621043-1324749441
<Package Folder>/cache/####/1127560768466089623
<Package Folder>/cache/####/1133380402-1324749441
<Package Folder>/cache/####/1154100341-1689772810
<Package Folder>/cache/####/11631529321947563317
<Package Folder>/cache/####/12774691571734758029
<Package Folder>/cache/####/1281235307-81481422
<Package Folder>/cache/####/1282807442-2002900101
<Package Folder>/cache/####/1282807442-2003823622
<Package Folder>/cache/####/1282807442-2007517706
<Package Folder>/cache/####/1282807442-2010288269
<Package Folder>/cache/####/12828074421746016962
<Package Folder>/cache/####/1282807442185859017
<Package Folder>/cache/####/128280744219076090
<Package Folder>/cache/####/1470207151-371174193
<Package Folder>/cache/####/1787337156110697322
<Package Folder>/cache/####/1853553663-815849171
<Package Folder>/cache/####/1969322505-395713923
<Package Folder>/cache/####/295742079953527087
<Package Folder>/cache/####/2963066051238296686
<Package Folder>/cache/####/2963066051474777807
<Package Folder>/cache/####/392148792-175152531
<Package Folder>/cache/####/595570210-1327660140
<Package Folder>/cache/####/595570210408523933
<Package Folder>/cache/####/595570210458385214
<Package Folder>/cache/####/595570210992581184
<Package Folder>/cache/####/619711243-825302173
<Package Folder>/databases/####/cc.db
<Package Folder>/databases/####/cc.db-journal
<Package Folder>/databases/Data_sync.db-journal
<Package Folder>/databases/my_pagecache.db-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/plus.jar
<Package Folder>/files/init.pid
<Package Folder>/files/init_c1.pid
<Package Folder>/files/libabc
<Package Folder>/files/mobclick_agent_cached_<Package>192
<Package Folder>/files/noend.ini
<Package Folder>/files/push.pid
<Package Folder>/files/run.pid
<Package Folder>/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
<Package Folder>/shared_prefs/BOOT_SMS_INFO.xml
<Package Folder>/shared_prefs/BOOT_SMS_SENT_TIME.xml
<Package Folder>/shared_prefs/DB_MTS.xml
<Package Folder>/shared_prefs/QugouUser.xml
<Package Folder>/shared_prefs/QugouUserTag.xml
<Package Folder>/shared_prefs/UNICOM_LOG_UA.xml
<Package Folder>/shared_prefs/VistorNo.xml
<Package Folder>/shared_prefs/dispatch_log.xml
<Package Folder>/shared_prefs/first_pref.xml
<Package Folder>/shared_prefs/first_register.xml
<Package Folder>/shared_prefs/getui_sp.xml
<Package Folder>/shared_prefs/jmsdk.dat.xml
<Package Folder>/shared_prefs/mgsdkfin1.xml
<Package Folder>/shared_prefs/mgsdkfin1.xml.bak
<Package Folder>/shared_prefs/plugin_record_app_info.xml
<Package Folder>/shared_prefs/pref_recomm.xml
<Package Folder>/shared_prefs/pref_recomm.xml.bak
<Package Folder>/shared_prefs/pretw.xml
<Package Folder>/shared_prefs/syndatabackup.xml
<Package Folder>/shared_prefs/tpservices.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/version.dat.xml
<Package Folder>/shared_prefs/zzconfig.xml
<SD-Card>/.tpservice/####/qsha_80001_5096.jar
<SD-Card>/.twservice/####/tw
<SD-Card>/.twservice/qshp_3003_2270.zip
<SD-Card>/<Package>/####/TYDSETTING
<SD-Card>/<Package>/####/f42a2f3be7be22d7413a108337d7f9e0
<SD-Card>/Android/####/com.skymobi.pay.plugin.main.data
<SD-Card>/Android/####/com.skymobi.pay.plugin.recordupload.data
<SD-Card>/Android/####/com.skymobi.pay.plugin.smspay.data
<SD-Card>/Android/####/user.sys
<SD-Card>/libs/<Package>.bin
<SD-Card>/libs/<Package>.db
<SD-Card>/libs/app.db
<SD-Card>/libs/com.igexin.sdk.deviceId.db

Miscellaneous:

Executes next shell scripts:

<dexopt>
cat /sys/block/mmcblk0/device/cid

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial