Android.SmsSend.17520

Technical information

Malicious functions:

Sends SMS messages:

075585181130: cyMjUwMDI2Njk5MTg3NzQzIzM1NjUwNzA1OTM1MTg5NSM0LjMuMQ==

Network activity:

Connecting to:

2####.####.140:8080
g####.####.net
unitedp####.####.com
g####.####.net:8080
sd####.####.com
p####.####.com
w####.####.com:7758
d####.####.com
1####.####.192
w####.####.com
1####.####.238
gat####.####.com
1####.####.67

HTTP GET requests:

d####.####.com/egsb/startup/queryConfiguration?channelId=####&contentId=####&gameType=####
unitedp####.####.com/numberbank/interface?getInfo=####
1####.####.67/codex/version
1####.####.192/unitedpay_sdk/version

HTTP POST requests:

2####.####.140:8080/migusdk/tl/enclog
p####.####.com/api/q/a/3f6ec4da684547211e371a67946d85757
gat####.####.com/v3/tj/ad
sd####.####.com/behaviorLogging/eventLogging/accept?
1####.####.238/updata/interface.html
g####.####.net:8080/migusdk/tl/tcttl
g####.####.net/migusdk/verification/checkSdkUpdate
w####.####.com/normandie/QueryConfigPolicy
d####.####.com/egsb/game/getPaymentCapability
w####.####.com:7758/normandie/QueryConfigPolicy
d####.####.com/egsb/thirdPay/queryThirdPayInfo

Modified file system:

Creates the following files:

/sdcard/bazhangsdk/bazhangsdkdex.jar
/data/data/####/files/edfile/armeabi/libmiguED.so
/data/data/####/files/mgid.dat
/data/data/####/files/sdk_prefs
/data/data/####/files/MiguPay.Sdk30.Lib_12003003_07e001f49cf7425a25878b7204c8de63_BN202.cod
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml
/data/data/####/2221.dex
/data/data/####/app_lemuellabs_reserved_/09e5034076de8bdd.jar
/data/data/####/files/mpush_gateway_preferences_file
/data/data/####/shared_prefs/td_pefercen_profile.xml.bak
/data/data/####/files/mpush_version_preferences_file
/data/data/####/app_lemuellabs_reserved_/codex_inner.so
/data/data/####/files/MiguPay.Sdk30.Lib_12003003_07e001f49cf7425a25878b7204c8de63_BN202.dat
/data/data/####/databases/mpush_game.db-journal
/data/data/####/app_lemuellabs_reserved_/f092163beafe3a01.jar
/sdcard/Download/data/cn.cmgame.sdk/sdk_prefs.txt
/sdcard/.tcookieid
/data/data/####/files/ED.ini
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
/data/data/####/files/UNITEDPAYACTLIST_
/data/data/####/2085.dex
/data/data/####/files/mgAS.dat
/data/data/####/shared_prefs/pref_file.xml
/data/data/####/app_lemuellabs_reserved_/lemuel_security_inner.so
/data/data/####/shared_prefs/3f6ec4da684547211e371a67946d85757|account_file.xml
/sdcard/Download/data/cn.cmgame.sdk/ShareData.txt
/data/data/####/shared_prefs/tdid.xml
/data/data/####/shared_prefs/td_pefercen_profile.xml
/sdcard/Download/data/cn.cmgame.sdk/msgflag.txt
/data/data/####/app_lemuellabs_reserved/codex.so
/data/data/####/shared_prefs/pref_file.xml.bak
/data/data/####/app_lemuellabs_reserved/7cef35da052cb62d.jar
/data/data/####/files/libmgRun_04.22.06_01.so
/data/data/####/app_lemuellabs_reserved/e14575ac9702716d.jar
/sdcard/Download/data/cn.cmgame.sdk/log/deviceId.txt