Technical information
Malicious functions:
Sends SMS messages:
- 12114: HZSY#####
Executes code of the following detected threats:
- Android.SmsSend.1848.origin
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- sm####.####.com
- s####.####.com
- 1####.####.125:8080
- s####.####.com:8888
- hnxi####.com
- a####.####.site
- mobil####.####.com
- 1####.####.125
- p####.####.com
- and####.####.com
- a####.####.site:8090
- 1####.####.34:19000
- collec####.####.com
- d####.####.net
- a####.####.com
- and####.####.com:8077
HTTP GET requests:
- d####.####.net/apkf/3rdapk2/M01/0E/57/wKhklVhl8iuAPRONAASU16x8R3w033.apk
- d####.####.net/apkf/3rdapk2/M01/13/6C/wKhklVjwsaCARWV-AAQm7yY3ixc640.apk
- s####.####.com/v1/sdk/order?sign=####&sdk_type=####&t=####&user_orderid=...
- a####.####.site/afee?cpid=####&appfee_id=####&fee=####&smsc=####&imsi=##...
- a####.####.site/getdata?cpid=####&packagename=####
- s####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sdk...
- hnxi####.com/zr_1.jpg
- s####.####.com:8888/v1/sdk/init?net_name=####&imei=####&package_name=###...
- a####.####.site/phoneget?cpid=####&ismi=####&calltime=####&callcount=###...
- p####.####.com/cityjson?ie=####
- s####.####.com/v1/order/get?app_vername=####&phone=####&imei=####&packag...
- a####.####.site:8090/phoneget?cpid=####&ismi=####&calltime=####&callcoun...
- hnxi####.com/zr_2.jpg
HTTP POST requests:
- and####.####.com/record-plat/record/upload.do
- 1####.####.34:19000/v2/chis
- and####.####.com/android/third/prefetch/index.do
- 1####.####.125:8080/fusion/gateway/init
- sm####.####.com/pay-sms-access//uploadOpenPayOrderResult.json?
- mobil####.####.com/mobile-service/getOpenImsiMobilePhone.json
- collec####.####.com/pay-data-collect/collectAppStartUserData.json
- and####.####.com/android/sms/netpay/prefetch.do
- and####.####.com/query-plat/cap/query.do
- and####.####.com:8077/query-plat/cap/query.do
- sm####.####.com/pay-sms-access//getAccessPayChannel.json
- sm####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
- a####.####.com/app_logs
- and####.####.com/record-plat/seq/query.do
- collec####.####.com/pay-data-collect/uploadClientCrashLog.json
- 1####.####.125/fusion/gateway/init
- collec####.####.com/pay-data-collect/uploadChannelNormalData.json
Modified file system:
Creates the following files:
- /data/data/####/baea/tmb.jar
- /data/data/####/app_workbench83546/apk.zip
- /data/data/####/databases/cc.db-journal
- /data/data/####/shared_prefs/plugins.serviceMapping.xml
- /data/data/####/shared_prefs/ma_data.xml
- /data/data/####/databases/ua.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/sy_pay_config.xml.bak
- /data/data/####/cache/map.apk.apk
- /data/data/####/shared_prefs/ma_call.xml
- /data/data/####/databases/cc.db
- /data/data/####/cache/crash/####/crash-1493728909933.log
- /data/data/####/shared_prefs/b_share.xml
- /data/data/####/app_workbench11256/apk.zip
- /data/data/####/databases/ua.db-journal
- /data/data/####/shared_prefs/new_vvsion.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.data
- /data/data/####/files/e/plus.jar
- /sdcard/Android/data/.nomedia
- /data/data/####/shared_prefs/b_setting.xml.bak
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/shared_prefs/nnt_data.xml
- /data/data/####/shared_prefs/zzconfig.xml
- /data/data/####/shared_prefs/ma_epay_share.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/app_apCoreplugn/map.apk
- /data/data/####/files_main/key_AppPluginCapInfo
- /data/data/####/shared_prefs/plugins.installed.xml
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/BOOT_SMS_SENT_TIME.xml
- /data/data/####/databases/MA_epay_db-journal
- /data/data/####/shared_prefs/mainplugin_query.xml
- /data/data/####/files/.imprint
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.thirdpay.new.data
- /data/data/####/shared_prefs/BOOT_SMS_INFO.xml
- /data/data/####/shared_prefs/ma_phone.xml
- /data/data/####/app_apCoreplugn/ZIP/plugin-20170330-2.1.9-release.bin
- /data/data/####/databases/com.souying.pay.plugmain_sy_pay_record-journal
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk
- /data/data/####/shared_prefs/ma_phone.xml.bak
- /data/data/####/app_workbench78020/apk.zip
- /sdcard/imageloader/Cache/-836608798.tmp
- /data/data/####/cache/sm.apk.apk
- /data/data/####/app_workbench22228/apk.zip
- /data/data/####/files/exid.dat
- /data/data/####/files_main/key_ServerPluginInfo
- /data/data/####/databases/Data_sync.db-journal
- /data/data/####/databases/webview.db-journal
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_main/key_ServerPluginInfo
- /data/data/####/shared_prefs/mainplugin_query.xml.bak
- /data/data/####/shared_prefs/com.souying.pay.xml
- /data/data/####/databases/bil_db-journal
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.data
- /data/data/####/app_workbench05730/apk.zip
- /data/data/####/shared_prefs/pref_recomm.xml.bak
- /data/data/####/shared_prefs/ma_data.xml.bak
- /data/data/####/shared_prefs/b_setting.xml
- /data/data/####/databases/MA_epay_db
- /data/data/####/files/umeng_it.cache
- /data/data/####/app_workbench27754/apk.zip
- /data/data/####/app_apCoreplugn/sm.apk
- /sdcard/gooogle/userid.cfg
- /data/data/####/files/libabc
- /sdcard/imageloader/Cache/-835685277.tmp
- /data/data/####/baea/entrance.jar
- /data/data/####/app_workbench11176/apk.zip
- /data/data/####/shared_prefs/nnt_data.xml.bak
- /data/data/####/shared_prefs/edition.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
- /data/data/####/shared_prefs/plugin_record_app_info.xml
- /data/data/####/databases/recordInfo-journal
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data
- /data/data/####/shared_prefs/ma_call.xml.bak
- /data/data/####/shared_prefs/b_share.xml.bak
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.thirdpay.new.data.temp
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/pref_recomm.xml
- /data/data/####/shared_prefs/sy_pay_config.xml
- /data/data/####/databases/bil_db
- /data/data/####/app_workbench00204/apk.zip
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.data.temp
- /data/data/####/shared_prefs/com.souying.pay.plugmain_p_config.xml
Sets the 'executable' attribute to the following files:
- /sdcard/gooogle/userid.cfg
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 101 40 323812 /data/data/####/app_workbench78020/apk.zip 1252156721 1242577948 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sy
- /system/bin/dexopt --dex 27 68 40 94816 /data/data/####/app_workbench05730/apk.zip 1252156731 -264446213 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syst
- /system/bin/dexopt --dex 27 57 40 129872 /data/data/####/app_workbench27754/apk.zip 1252156717 591524218 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syst
- /system/bin/dexopt --dex 27 57 40 129872 /data/data/####/app_workbench11256/apk.zip 1252156730 591524218 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syst
- /system/bin/dexopt --dex 27 81 40 323812 /data/data/####/app_workbench00204/apk.zip 1252156731 1242577948 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
- cat /proc/version
- /system/bin/dexopt --dex 27 61 40 53104 /data/data/####/files/e/plus.jar 1248884930 1047219635 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
- /system/bin/dexopt --dex 27 59 40 265840 /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk 1249861500 -178983397 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.ja
- /system/bin/dexopt --dex 27 83 40 540224 /data/data/####/app_workbench11176/apk.zip 1252156718 1715135955 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
- /system/bin/dexopt --dex 27 82 40 541712 /data/data/####/app_workbench83546/apk.zip 1252156721 -349942904 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
- /system/bin/dexopt --dex 27 71 40 167700 /data/data/####/baea/tmb.jar 1247445146 -1810655209 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework
- /system/bin/dexopt --dex 27 86 40 94816 /data/data/####/app_workbench22228/apk.zip 1252156717 -264446213 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syst
- /system/bin/dexopt --dex 27 71 40 541712 /data/data/####/app_workbench05730/apk.zip 1252156731 -349942904 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
- /system/bin/dexopt --dex 27 62 40 60932 /data/data/####/baea/entrance.jar 1247445111 -2040847232 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/frame
- /system/bin/dexopt --dex 27 88 40 55320 /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk 1249861473 21642890 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/fr
Contains functionality to send SMS messages automatically.
