Android.SmsSend.17282

Technical information

Malicious functions:

Sends SMS messages:

1065710106000002: user_reg:EAl/bGUHeHpRvjYKc382vCmO5Ataz8i+h8dKgzc9Cu3EiRqtWDeLOedv4XPQGE/TkPow8KXDlaPEs9xvbv+PZrc8JA/UcsfQ

Downloads the following detected threats from the Web:

Android.SmsSend.8822

Network activity:

Connecting to:

c####.####.net
1####.####.247
1####.####.120
2####.####.60:8080
2####.####.60
2####.####.178
2####.####.189
a####.####.com
2####.####.189:8080

HTTP GET requests:

2####.####.189/uploadfiles/partpic/2016-03-10_084313.jpg
2####.####.189/uploadfiles/partpic/2016-03-10_084252.jpg
2####.####.60/Message/source/f698f105b2cf6eefc6bb48b35b304580.zip
c####.####.net/pak/sq1234567890.apk
2####.####.60:8080/Message/GetJsonData?time=####&masterId=####
2####.####.60/Message/GetJsonData?time=####&masterId=####
1####.####.120/info/sdkinfo.php?k=####&tr=####&pt=####
2####.####.189/uploadfiles/partpic/2016-06-13_102055.png
1####.####.120/event/info.php?k=####&tr=####&pt=####
2####.####.60/Message/source/27d35e0f0e970356e8dde95a45f1378c.zip
1####.####.247/image.php?im=####&sid=####&pid=####&mt=####&sn=####
2####.####.178/sdk_sms/Fee_sdk_more.php
2####.####.189/uploadfiles/partpic/2016-03-10_084303.jpg
2####.####.189/jssm/js/getExitPic
2####.####.189:8080/jssm/js/getExitPic
2####.####.189/jssm/js/getIndexSortInfo?partId=####
2####.####.189/jssm/js/getUpdateInfo?isActive=####
2####.####.189/jssm/js/getIndexInfo
2####.####.189/uploadfiles/partpic/2016-06-20_160423.png

HTTP POST requests:

a####.####.com/app_logs

Modified file system:

Creates the following files:

/sdcard/AppPush/f698f105b2cf6eefc6bb48b35b304580.zip
/sdcard/AppPush/f698f105b2cf6eefc6bb48b35b304580/data.txt
/sdcard/init_data.dat
/sdcard/Appcache/53507393352d1f9b4750d7e9afdc6d18
/data/data/####/files/Control.txt
/sdcard/AppPush/27d35e0f0e970356e8dde95a45f1378c/deb4f0463ccb45398ba841a374f38aa1.res
/sdcard/Download/sq1234567890.apk
/data/data/####/shared_prefs/initSQ.xml
/sdcard/AppPush/27d35e0f0e970356e8dde95a45f1378c/data.txt
/sdcard/Appcache/b91c0a9044ccdfea78beb6594c3bec8d
/sdcard/Appcache/a0dcec18d6e7b5d6377caafa545dc4ca
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/files/.umeng/exchangeIdentity.json
/data/data/####/files/.imprint
/sdcard/Appcache/410d3740eb1077caeb4b127a1f4d295c
/sdcard/Appcache/0f56608767b25d0e6d2f96a4d62d95f3
/sdcard/Appcache/d132a82eb876d84496df06fe179ef202
/sdcard/Appcache/2a026ffca96048da33ed475335408b90
/sdcard/Appcache/5669e2b358ba7c2b418dbf4b9d91d3fb
/data/data/####/files/mobclick_agent_cached_####2
/data/data/####/databases/filedownloader-journal
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/sdcard/Appcache/8db1364266426c6daa40105c07e9aa4f
/sdcard/Appcache/6154812be8ad1fa8fbd77650eca2b578
/sdcard/Appcache/fb3a1e8c98f72fc83d50a4e53edf4190
/sdcard/AppPush/27d35e0f0e970356e8dde95a45f1378c.zip
/data/data/####/files/umeng_it.cache
/sdcard/Appcache/7d37c05cbddf16035126481d8edba792
/sdcard/Appcache/cfedebf269099156d700820a4b7d88e4
/sdcard/AppPush/f698f105b2cf6eefc6bb48b35b304580/f0bfda427f95404885c9a4289c60159f.res
/sdcard/Appcache/cc336433f38a6fb136aaccb079f7ed70
/sdcard/Appcache/exitPic