Android.SmsSend.18696

Technical information

Malicious functions:

Sends SMS messages:

12114516412: systemcGx1dG8yNTAwMjY2OTkxODc3NDM=
106575206321505460: dyl#####,####,6000098-1-214748-ddssys_00485-0
12114: dyl#####,####,6000098-1-214748-ddssys_00485-0

Executes code of the following detected threats:

Android.Spy.205.origin

Sends data on received text messages to remote host.

Network activity:

Connecting to:

dynami####.####.com
v####.####.cn
a####.####.cn
apm-col####.####.com
p####.####.cn
z####.####.com
greenxs####.net
i####.####.cn
collec####.####.com

HTTP GET requests:

greenxs####.net/resource!chargeUpdate?resTypes=####&dexId=####&dexVer=##...
v####.####.cn/Fn_ioiXNsES9i_9weRAbncmtAZMh-AvatarMiddle
greenxs####.net/resource!resource?resTypes=####&appid=####&channel=####&...
v####.####.cn/o_1atnn3s8olql1jm812a1sojvn9a.jpg-ImageMiddle
v####.####.cn/o_1b559jqeeoma1ih01uqq6llf7da.jpg-ListMiddle
v####.####.cn/o_1atnne163fie1r1qlmhmfb3rpa.jpg-ImageMiddle
v####.####.cn/FnSPduFwskzltql19rktwzUiNJi4-AvatarMiddle
z####.####.com/m/m72.mp4
v####.####.cn/o_1b4fum13t1jti1rjq1gdm1eh6v9gh.jpg-ListMiddle
v####.####.cn/FmD4FYufTyMy9cLu1135QR2Y561D-AvatarMiddle
v####.####.cn/m201611150007.jpg-ImageMiddle
v####.####.cn/Fu6XdyhIP8uJPq2080xpr5NONoNs-AvatarMiddle
v####.####.cn/o_1b4fujfrr14f612lkple1frocfrh.jpg-ListMiddle
i####.####.cn/iplookup/iplookup.php?format=####
v####.####.cn/o_1b4fun87j151l1nvf123lhfgouah.jpg-ListMiddle
v####.####.cn/FpXXi0Gmsn-lnfT1QWaE9h1CMCuk
v####.####.cn/FtxpWtJ6D0WjCFrzjuk-g3bCD3z-
v####.####.cn/Ft5gZRpyBr1a4UOy5LkdILz6xUsf-AvatarMiddle
v####.####.cn/pay201704130001.png
v####.####.cn/m201611150001.jpg-ImageMiddle
v####.####.cn/o_1atnmig621atb7s0ddm1o25rf9a.jpg-ImageMiddle
v####.####.cn/o_1atnn4ni51igt1e5g1ilc1fbf15mja.jpg-ImageMiddle
v####.####.cn/o_1b4fus2ls66qp2c1l4n1q6417n2h.jpg-ListMiddle
v####.####.cn/start_20170413.jpg?imageMo####
v####.####.cn/o_1b4e1n7bd15gj3ii1sau1vjde8dh.jpg-ListMiddle
v####.####.cn/FsgMLuvKm0c5XtgErnJOd_jDYVJQ-AvatarMiddle
v####.####.cn/o_1atnn2m4b1l101l0gtj618h01o3a.jpg-ImageMiddle
v####.####.cn/o_1b4e1cf0t30j1s6sckgkh1c4kh.jpg-ListMiddle
greenxs####.net/doking/smsd!hiGo.action?t=####&dexId=####&dexVer=####&ap...
v####.####.cn/o_1akabn0u86ub8uubh98gv1rtj1e.jpg-AvatarMiddle
v####.####.cn/o_1b4dtdam119ifcpm1nos1ohk1c7sh.jpg-ListMiddle
v####.####.cn/FoIHMXv3FdPw22WA9oR4a6_xCD_r-AvatarMiddle
a####.####.cn/video-app/server/css/style.css
v####.####.cn/o_1b4e0q0v6ebq8skpih1rg419gph.jpg-ListMiddle
v####.####.cn/o_1b4fub3da1g6h9o51kia16i0hquh.jpg-ListMiddle
v####.####.cn/Fok0lhj8qvduvbB9ddEs0sKW4FzE-AvatarMiddle
v####.####.cn/20161150023.jpg-ImageMiddle
v####.####.cn/o_1b4e1guj91jim4iq1r42ob31nqch.jpg-ListMiddle
v####.####.cn/banner201704130001.jpg
v####.####.cn/o_1b4fuch3vnlvloe6qh1uo91l5th.jpg-ListMiddle
v####.####.cn/o_1b4fu9q9f15mi1of8nk614tk1sbbh.jpg-ListMiddle
a####.####.cn/video-app/server/userHelp.html
v####.####.cn/Fl-PQzGyiYJhqmhQjkVcQg_c5GPQ
v####.####.cn/o_1b4dt7pb2pgi1usc15km1q5o72fh.jpg-ListMiddle
v####.####.cn/20161150024.jpg-ImageMiddle
v####.####.cn/FlkkJh0RF0ezrevbKlmQfEIVlkSg-AvatarMiddle
v####.####.cn/o_1b4e0ss991hr7dq2oc217i4e8qh.jpg-ListMiddle
greenxs####.net/active!activeLog.action?provider=####&clickId=####&manu=...
v####.####.cn/FryzQ3aFt-efg6NKBD58DZqnBkC5
v####.####.cn/o_1atnn7ts41d5q10ns1udbm2hjbra.jpg-ImageMiddle
v####.####.cn/o_1b4fupvhk1joj101abgji7h1r2hh.jpg-ListMiddle
v####.####.cn/FjQR70q9LwR42Ym3-mbi0ebR7A1C
v####.####.cn/o_1b4fuhmjv12nkn8017eq113rae5h.jpg-ListMiddle
v####.####.cn/o_1b4e1v69u2n51jp6ns5fqb1qtgh.jpg-ImageMiddle
collec####.####.com/third-package-hand/getHandThirdPackageInfoList.json?...
z####.####.com/m/m72.mp4?end=####
v####.####.cn/o_1b4e25paqjio69hvnho8n6bhh.jpg-ListMiddle

HTTP POST requests:

a####.####.cn/video-app//s_2.service
a####.####.cn/video-app//c_5.service
a####.####.cn/video-app//hk_1.service
a####.####.cn/video-app//cm_2.service
apm-col####.####.com/cpi/crash
a####.####.cn/video-app//u_3.service
a####.####.cn/video-app//c_8.service
a####.####.cn/video-app//pl_1.service
a####.####.cn/video-app//res_1.service
p####.####.cn/index.php/API
a####.####.cn/video-app//rv_1.service
a####.####.cn/video-app//u_1.service
a####.####.cn/video-app//startv2.service
a####.####.cn/video-app//log.service
collec####.####.com/pay-data-collect/collectAppBehavioralData.json
a####.####.cn/video-app//c_3.service
greenxs####.net/shop/shop_upload_log
a####.####.cn/video-app//p_15.service
a####.####.cn/video-app//m_1.service
dynami####.####.com/dynamicpay//syPayInfo.json?
a####.####.cn/video-app//c_7.service
dynami####.####.com/dynamicpay//getSyFormalChannels.json?
greenxs####.net/mobilepay/v2/getPayInfoListX3.do

Modified file system:

Creates the following files:

/data/data/####/shared_prefs/UPDATE_VERSION.xml
/sdcard/Android/data/####/cache/-1232239700.tmp
/data/data/####/shared_prefs/RECORD_INFOS.xml
/sdcard/Android/data/####/cache/-503665385.tmp
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/databases/webviewCookiesChromium.db-journal
/sdcard/Android/data/####/cache/911312921.tmp
/data/data/####/shared_prefs/pretw.xml
/data/data/####/shared_prefs/umeng_general_config.xml
/sdcard/Android/data/####/cache/-812369691.tmp
/data/data/####/shared_prefs/WX_CONFIG_DATAS.xml
/data/data/####/databases/mp.db
/data/data/####/shared_prefs/SAFETIPS.xml
/data/data/####/shared_prefs/CONFIGS.xml
/sdcard/Android/data/####/cache/-1327127593.tmp
/data/data/####/databases/webview.db-journal
/sdcard/Android/data/####/cache/1978821443.tmp
/sdcard/Android/data/####/cache/-1268207648.tmp
/data/data/####/shared_prefs/p_config.xml
/sdcard/Android/data/####/cache/1971445410
/data/data/####/shared_prefs/THIRD_STATUS_UPLOAD.xml
/data/data/####/shared_prefs/USER_OPEN_COUNT.xml
/sdcard/Android/data/####/cache/-786105358.tmp
/data/data/####/cache/webviewCacheChromium/index
/sdcard/Android/data/####/cache/-1486778329.tmp
/data/data/####/shared_prefs/RECORD_INFOS.xml.bak
/data/data/####/files/noend.ini
/sdcard/Android/data/####/cache/-909970033.tmp
/data/data/####/shared_prefs/cpMsg.xml
/data/data/####/shared_prefs/PAY_STATUS.xml
/sdcard/Android/data/####/cache/143246314
/sdcard/Android/data/####/cache/-24037258.tmp
/sdcard/Android/data/####/cache/388363868.tmp
/data/data/####/files/mobclick_agent_cached_####2147483647
/data/data/####/shared_prefs/PROTOCOL_SHOW.xml
/data/data/####/shared_prefs/signUpload.xml
/sdcard/Android/data/####/cache/-857051183.tmp
/sdcard/Android/data/####/cache/1955460194.tmp
/data/data/####/shared_prefs/CHECK_VERSION_TIME.xml
/sdcard/Android/data/####/cache/365245048.tmp
/sdcard/.twservice/qshp_3003_2248/tw
/sdcard/Android/data/####/cache/-965601580.tmp
/data/data/####/databases/mp.db-journal
/sdcard/Android/data/####/cache/1237337700.tmp
/sdcard/Android/data/####/cache/.nomedia
/sdcard/Android/data/####/cache/-818659769.tmp
/data/data/####/databases/xUtils_http_cookie.db
/sdcard/Android/data/####/cache/-1952831884.tmp
/data/data/####/shared_prefs/ZFB_CONFIG_DATAS.xml
/sdcard/Android/data/####/cache/673650126.tmp
/sdcard/Android/data/####/cache/-1433934119.tmp
/sdcard/Android/data/####/cache/-1832186417.tmp
/data/data/####/shared_prefs/USER_EXTRA_INFO.xml
/sdcard/Android/data/####/cache/1898151556.tmp
/sdcard/.tpservice/####/download/jar/qsha_80001_5094.jar
/data/data/####/databases/xUtils_http_cookie.db-journal
/sdcard/Android/data/####/cache/-67389520.tmp
/sdcard/Android/data/####/cache/1470231709.tmp
/sdcard/Android/data/####/cache/-58190579.tmp
/data/data/####/databases/cc/cc.db-journal
/sdcard/Android/data/####/cache/1822901355.tmp
/sdcard/Android/data/####/cache/-516398059.tmp
/sdcard/Android/data/####/cache/-147419963.tmp
/sdcard/Android/data/####/cache/-1521399547.tmp
/sdcard/.twservice/qshp_3003_2248/tw.jar
/data/data/####/shared_prefs/twc.xml.bak
/sdcard/Android/data/####/cache/334446035.tmp
/data/data/####/shared_prefs/umengEnable.xml
/data/data/####/shared_prefs/getFlag.xml
/sdcard/Android/data/####/cache/-2051903448.tmp
/data/data/####/shared_prefs/LOGIN_TIME.xml
/data/data/####/shared_prefs/userInfo.xml
/sdcard/Android/data/####/cache/1505132456.tmp
/data/data/####/shared_prefs/SPEED_UP.xml
/data/data/####/shared_prefs/dispatch_log.xml
/sdcard/Android/data/####/cache/-381324218.tmp
/data/data/####/shared_prefs/device_id.xml.xml
/data/data/####/databases/cc/cc.db
/sdcard/Android/data/####/cache/-478876720.tmp
/sdcard/Android/data/####/cache/-258058010.tmp
/data/data/####/databases/sy_pay_record-journal
/sdcard/Android/data/####/cache/-241204451.tmp
/sdcard/Android/data/####/cache/720090553.tmp
/sdcard/Android/data/####/cache/-2097867904.tmp
/data/data/####/shared_prefs/PLAY_COUNT.xml
/sdcard/.twservice/qshp_3003_2248.zip
/sdcard/Android/data/####/cache/1858636310.tmp
/sdcard/SYPAYFILENAME/CACHE/SMSCACHE/ISDELSMS
/sdcard/Android/data/####/cache/1912123748.tmp
/sdcard/Android/data/####/cache/617565282.tmp
/data/data/####/shared_prefs/twc.xml
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/data/data/####/shared_prefs/FIRST_ENTER_PLAY.xml
/data/data/####/shared_prefs/TestinAgent.xml
/sdcard/Android/data/####/cache/1235034122.tmp

Miscellaneous:

Executes next shell scripts:

cat /sys/block/mmcblk0/device/cid
/system/bin/dexopt --dex 27 77 40 213440 /storage/emulated/0/.tpservice/####/download/jar/qsha_80001_5094.jar 1248298237 -1297833896 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/f
/system/bin/dexopt --dex 27 86 40 274292 /storage/emulated/0/.twservice/qshp_3003_2248/tw.jar 1249605357 1919768635 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
cat /proc/version

Contains functionality to send SMS messages automatically.

Технології

Терміни

Навчання

Міфи

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней