Android.SmsSpy.4904

Technical information

Malicious functions:

Sends SMS messages:

12114: HZSY#####

Executes code of the following detected threats:

Android.SmsSend.10559

Network activity:

Connecting to:

i####.cn
t####.####.net
vid####.####.com
as####.####.com
dyn####.####.com
1####.####.201:9400
1####.####.201
b####.####.cn
t####.####.cn
pr####.####.com

HTTP GET requests:

as####.####.com/uploads/advertisement/apk/911/1
as####.####.com/uploads/advertisement/apk/912/0
b####.####.cn/images/lanmang/img/images/icon_no.png
as####.####.com/uploads/advertisement/apk/905/5
b####.####.cn/images/lanmang/img/jquery.lavalamp.1.3.2-min.js
b####.####.cn/images/lanmang/img/images/nav_selected.png
b####.####.cn/images/lanmang/img/images/low.png
b####.####.cn/images/lanmang/img/style.css
b####.####.cn/
b####.####.cn/images/lanmang/img/jquery.min.js
b####.####.cn/images/lanmang/img/images/stat.gif
b####.####.cn/images/lanmang/img/images/nav.png
i####.cn/a/301b3f813caec23a2976bf05ebed89089
1####.####.201/logo.png
1####.####.201/bg.jpg
b####.####.cn/images/lanmang/img/images/banner.jpg
b####.####.cn/images/lanmang/img/images/logo.jpg
b####.####.cn/images/lanmang/img/images/login.jpg
as####.####.com/uploads/advertisement/apk/909/2
as####.####.com/uploads/advertisement/apk/907/3
1####.####.201:9400/404.html
vid####.####.com/shipin33foryue/index.html
b####.####.cn/system/user/verifypicture.php
as####.####.com/uploads/advertisement/apk/906/4
b####.####.cn/js/md5.js

HTTP POST requests:

pr####.####.com/prc-has/getImsiMobilePhone.json
t####.####.net/g/d?crc=####
pr####.####.com/prc-has/getThirdPluginAccountInfo.json
t####.####.cn/api/q/a/301b3f813caec23a2976bf05ebed89089
dyn####.####.com/dynamicpay//getSyFormalChannels.json?

Modified file system:

Creates the following files:

/data/data/####/shared_prefs/TDCloudSettingsConfig39C202CE6589097E3E0B7DC16EFE5E42.xml
/data/data/####/app_payload_odex/AGl61bFp8G9_payload.apk
/data/data/####/shared_prefs/TDpref_shorttime.xml
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/Plugin/com.jslr.im.wei/dalvik-cache/base-1.dex
/data/data/####/databases/cc/cc.db
/data/data/####/shared_prefs/TDpref_longtime.xml
/data/data/####/files/td.lock
/data/data/####/files/mpush_version_preferences_file
/data/data/####/app_payload_odex/Hh9NmpHIgHo_payload.apk
/data/data/####/shared_prefs/TDCloudSettingsConfig39C202CE6589097E3E0B7DC16EFE5E42.xml.bak
/data/data/####/databases/cc/cc.db-journal
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/files/tdlock.txt
/data/data/####/shared_prefs/TDpref_longtime.xml.bak
/data/data/####/databases/mpush_app.db-journal
/data/data/####/files/mobclick_agent_cached_####70
/sdcard/.tcookieid
/data/data/####/Plugin/com.jslr.im.wei/apk/base-1.apk
/data/data/####/files/mpush_gateway_preferences_file
/sdcard/SYPAYFILENAME/CACHE/SMSCACHE/ISDELSMS
/data/data/####/app_downloads/5
/data/data/####/app_downloads/1
/data/data/####/app_downloads/0
/data/data/####/app_downloads/3
/data/data/####/app_downloads/2
/data/data/####/files/TDtcagent.db
/data/data/####/app_downloads/4
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
/data/data/####/shared_prefs/tdid.xml
/data/data/####/files/TDtcagent.db-journal
/data/data/####/shared_prefs/TDpref_shorttime.xml.bak
/data/data/####/Plugin/com.jslr.im.wei/Signature/Signature_0.key
/data/data/####/Plugin/com.jslr.im.wei/lib/tmp.OC2097