Android.SmsSpy.5961

Technical information

Malicious functions:

Sends SMS messages:

12114: HZSY#####

Sends data on received text messages to remote host.

Network activity:

Connecting to:

p####.####.com:8080
sm####.####.com
mobil####.####.com
p####.####.com
a####.####.com
json####.####.com
collec####.####.com

HTTP GET requests:

json####.####.com/adchannelversion/9.1.0.0426_ad_planlinkchannelanversio...
json####.####.com/adplans/31f72f43289211e7bb779c37f405e458.js
json####.####.com/adplans/3201f0a5289211e7bb779c37f405e458.js
json####.####.com/adplans/31fbd6b6289211e7bb779c37f405e458.js

HTTP POST requests:

collec####.####.com/mobile-service/getOpenImsiMobilePhone.json
p####.####.com:8080/me/publish/activate
mobil####.####.com/mobile-service/getOpenImsiMobilePhone.json
collec####.####.com/pay-data-collect/collectAppStartUserData.json
sm####.####.com/pay-sms-access//getAccessPayChannel.json
p####.####.com/me/publish/spinfo
sm####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
a####.####.com/app_logs
p####.####.com:8080/me/publish/spinfo
collec####.####.com/pay-data-collect/uploadChannelNormalData.json

Modified file system:

Creates the following files:

/data/data/####/databases/cc.db-journal
/data/data/####/cache/sms.apk.apk
/data/data/####/databases/ua.db
/data/data/####/shared_prefs/sy_pay_config.xml.bak
/data/data/####/databases/cc.db
/data/data/####/shared_prefs/31fbd6b6289211e7bb779c37f405e458config.xml
/data/data/####/shared_prefs/plugins.serviceMapping.xml
/data/data/####/shared_prefs/fangan_aliyunconfig.xml
/data/data/####/databases/ua.db-journal
/data/data/####/shared_prefs/phoneInfo.xml
/data/data/####/shared_prefs/price_infoconfig.xml
/data/data/####/databases/sy_pay_record-journal
/data/data/####/shared_prefs/plant_id_fileconfig.xml
/data/data/####/app_apCoreplugn/sms.apk
/data/data/####/cache/smp.apk.apk
/data/data/####/shared_prefs/3201f0a5289211e7bb779c37f405e458config.xml
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/shared_prefs/plugins.installed.xml
/data/data/####/files/.umeng/exchangeIdentity.json
/sdcard/MlVideo/files/user_id
/data/data/####/files/.imprint
/data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk
/data/data/####/app_apCoreplugn/ZIP/plugin-20170302-2.1.8.6.3.bin
/data/data/####/databases/com.souying.pay.plugmain_sy_pay_record-journal
/data/data/####/files/exid.dat
/sdcard/Android/obj/.um/sysid.dat
/data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk
/data/data/####/shared_prefs/com.souying.pay.xml
/data/data/####/app_apCoreplugn/smp.apk
/data/data/####/files/umeng_it.cache
/data/data/####/databases/recordInfo-journal
/data/data/####/shared_prefs/tab_planconfig.xml
/sdcard/Android/data/.um/sysid.dat
/data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/dalvik-cache/base-1.dex
/data/data/####/shared_prefs/activate.xml
/data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/dalvik-cache/base-1.dex
/data/data/####/shared_prefs/sy_pay_config.xml
/data/data/####/shared_prefs/com.souying.pay.plugmain_p_config.xml
/data/data/####/shared_prefs/user_idconfig.xml