Android.SmsSpy.6088

Technical information

Malicious functions:

Sends SMS messages:

12114516412: systemcGx1dG8yNTAwMjY2OTkxODc3NDM=
12114: HZSY#####
12114: dyl#####,####,6000098-1-8-tcyhb_00476-0
106575206321505460: dyl#####,####,6000098-1-8-tcyhb_00476-0

Executes code of the following detected threats:

Android.Spy.205.origin

Sends data on received text messages to remote host.

Network activity:

Connecting to:

s####.####.com
v####.####.com
mo####.####.com
d####.####.cn
r####.####.com
1####.####.193
apm-col####.####.com
col####.####.com
p####.####.cn
1####.####.225
greenxs####.net
i####.####.cn
1####.####.214

HTTP GET requests:

greenxs####.net/resource!chargeUpdate?resTypes=####&dexId=####&dexVer=##...
greenxs####.net/resource!resource?resTypes=####&appid=####&channel=####&...
v####.####.com/pic/tcmn/banner/rule_20160108.jpg
1####.####.193/mengxia/socalapp/users/6ea9013e344c43d9b0f26794b1340ed3/j...
v####.####.com/pic/tcmn/avatar/2017/04/18/1205695140192.jpg
d####.####.cn/date-app/server/css/style.css
v####.####.com/pic/tcmn/avatar/2016/01/22/5573050249879.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5578605087013.jpg
v####.####.com/pic/tcmn/mnfw/avatar/2015/09/26/7001143777590.jpg
v####.####.com/pic/tcmn/banner/banner_20160919.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5579430489636.jpg
d####.####.cn/date-app/server/userHelp.html
v####.####.com/pic/tcmn/avatar/2016/01/22/5575041908039.jpg
i####.####.cn/iplookup/iplookup.php?format=####
v####.####.com/pic/tcmn/avatar/2017/04/18/1206561517614.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5576351586278.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5577931077881.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5576127068737.jpg
v####.####.com/pic/tcmn/mnfw/avatar/2015/09/26/7000234545068.jpg
d####.####.cn/date_video_banner.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5575963074577.jpg
1####.####.225/easemob/server.json?sdk_version=####&app_key=####&file_ve...
v####.####.com/pic/tcmn/avatar/2016/01/22/5577427176371.jpg
greenxs####.net/active!activeLog.action?provider=####&clickId=####&manu=...
v####.####.com/pic/tcmn/avatar/2016/01/22/5573670417191.jpg
v####.####.com/pic/tcmn/avatar/2016/01/04/384009373325.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5572675210782.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5573197686854.jpg
greenxs####.net/doking/smsd!hiGo.action?t=####&dexId=####&dexVer=####&ap...
v####.####.com/pic/tcmn/avatar/2016/01/04/3839423709196.jpg
v####.####.com/pic/tcmn/avatar/2017/04/06/5625956161270.jpg
v####.####.com/pic/tcmn/avatar/2017/04/18/1205595412689.jpg
1####.####.193/mengxia/socalapp/users/6ea9013e344c43d9b0f26794b1340ed3/r...
v####.####.com/pic/tcmn/avatar/2017/04/12/5994366233889.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5574837243589.jpg
v####.####.com/pic/tcmn/avatar/2017/04/07/3558695223366.jpg
v####.####.com/pic/tcmn/avatar/2017/04/18/1206231987561.jpg
r####.####.com/easemob/server.json?sdk_version=####&app_key=####&file_ve...
v####.####.com/pic/tcmn/avatar/2016/01/04/3836905541058.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5576107827345.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5573909864447.jpg
v####.####.com/pic/tcmn/mnfw/avatar/2015/09/26/7000615626489.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5573793341763.jpg
v####.####.com/pic/tcmn/avatar/2016/01/04/3841173856013.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5570962637710.jpg
v####.####.com/pic/tcmn/avatar/2016/01/22/5579172587311.jpg
v####.####.com/pic/tcmn/avatar/2016/01/04/3836652093847.jpg
1####.####.193/mengxia/socalapp/users/6ea9013e344c43d9b0f26794b1340ed3/b...

HTTP POST requests:

s####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
d####.####.cn/date-app//log.service
d####.####.cn/date-app//u_1.service
d####.####.cn/date-app//o_1.service
p####.####.cn/index.php/API
greenxs####.net/shop/shop_upload_log
d####.####.cn/date-app//o_3.service
col####.####.com/pay-data-collect/uploadChannelNormalData.json
d####.####.cn/date-app//app.service
1####.####.193/mengxia/socalapp/token
d####.####.cn/date-app/v_1.service
apm-col####.####.com/cpi/crash
d####.####.cn/date-app//u_13.service
s####.####.com/pay-sms-access//getAccessPayChannel.json
mo####.####.com/mobile-service/getOpenImsiMobilePhone.json
1####.####.214/mengxia/socalapp/devices
col####.####.com/pay-data-collect/collectAppStartUserData.json
d####.####.cn/date-app//u_12.service
d####.####.cn/date-app//a_1.service

Modified file system:

Creates the following files:

/data/data/####/databases/null_demo.db
/data/data/####/databases/6ea9013e344c43d9b0f26794b1340ed3_emmsg.db
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/shared_prefs/cpMsg.xml
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/shared_prefs/saveInfo.xml
/data/data/####/shared_prefs/pretw.xml
/data/data/####/shared_prefs/umeng_general_config.xml
/sdcard/Android/data/####/cache/-2101024985.tmp
/data/data/####/shared_prefs/CONFIGS.xml
/sdcard/Android/data/####/cache/1575630296.tmp
/data/data/####/app_apCoreplugn/smap.apk
/data/data/####/shared_prefs/com.core.main.pay.plugmain_p_config.xml
/sdcard/Android/data/####/cache/575895503.tmp
/data/data/####/databases/webview.db-journal
/sdcard/Android/data/####/cache/2117172223.tmp
/sdcard/Android/data/####/cache/-30324519
/data/data/####/databases/mp.db
/sdcard/Android/data/####/cache/-1762545265.tmp
/data/data/####/app_plugin_dir/com.core.main.pay.plugmain/1.0_100/dalvik-cache/base-1.dex
/data/data/####/app_plugin_dir/com.yfbb.wqb/1.0_1/base-1.apk
/data/data/####/cache/webviewCacheChromium/index
/sdcard/Android/data/####/cache/1776523605.tmp
/data/data/####/cache/sms.apk.apk
/sdcard/Android/data/####/cache/-76686845.tmp
/sdcard/Android/data/####/cache/-1999129030.tmp
/sdcard/Android/data/####/cache/-658162281.tmp
/data/data/####/files/noend.ini
/sdcard/Android/data/####/cache/-1341917501.tmp
/data/data/####/databases/null_demo.db-journal
/sdcard/Android/data/####/cache/477788426.tmp
/data/data/####/cache/webviewCacheChromium/data_1
/sdcard/Android/data/####/cache/1668630257.tmp
/sdcard/Android/data/####/cache/1623815437.tmp
/sdcard/emlibs/libs/monitor.db-journal
/sdcard/Android/data/####/cache/-1171194273
/data/data/####/cache/smap.apk.apk
/sdcard/Android/data/####/cache/1039433858.tmp
/sdcard/.tpservice/####/download/jar/qsha_80001_5094.jar
/data/data/####/databases/6ea9013e344c43d9b0f26794b1340ed3_demo.db-journal
/sdcard/Android/data/####/cache/-157594975.tmp
/sdcard/.twservice/qshp_3003_2248/tw
/data/data/####/shared_prefs/com.souying.pay.xml
/sdcard/Android/data/####/cache/-1613741019.tmp
/data/data/####/databases/mp.db-journal
/sdcard/Android/data/####/cache/.nomedia
/data/data/####/databases/recordInfo-journal
/data/data/####/databases/xUtils_http_cookie.db
/data/data/####/databases/FriendMemberDB-journal
/data/data/####/app_plugin_dir/com.yfbb.web/1.0_1/base-1.apk
/data/data/####/databases/6ea9013e344c43d9b0f26794b1340ed3_emmsg.db-journal
/data/data/####/databases/6ea9013e344c43d9b0f26794b1340ed3_demo.db
/sdcard/Android/data/####/cache/-1614986381.tmp
/data/data/####/shared_prefs/plugins.serviceMapping.xml
/data/data/####/files/config.json
/sdcard/Android/data/####/cache/1766114001.tmp
/sdcard/Android/data/.nomedia
/data/data/####/databases/xUtils_http_cookie.db-journal
/data/data/####/app_apCoreplugn/sms.apk
/data/data/####/databases/cc/cc.db-journal
/data/data/####/shared_prefs/plugins.installed.xml
/sdcard/Android/data/####/cache/573263538.tmp
/data/data/####/app_plugin_dir/com.yfbb.wqb/1.0_1/dalvik-cache/base-1.dex
/data/data/####/files/mobclick_agent_cached_####8
/sdcard/Android/data/####/cache/672459669.tmp
/sdcard/Android/data/####/cache/2137983159.tmp
/sdcard/Android/data/####/cache/-1061984495.tmp
/sdcard/Android/data/####/cache/-1896046689.tmp
/data/data/####/shared_prefs/sy_pay_config.xml.bak
/sdcard/Android/data/####/cache/-806240021.tmp
/data/data/####/app_plugin_dir/com.core.main.pay.plugmain/1.0_100/base-1.apk
/data/data/####/shared_prefs/twc.xml.bak
/sdcard/Android/data/####/cache/1154452344.tmp
/sdcard/Android/data/####/cache/2107888571
/data/data/####/app_apCoreplugn/ZIP/23uiusfjc.bin
/data/data/####/shared_prefs/sy_pay_config.xml
/sdcard/Android/data/####/cache/1434274733.tmp
/data/data/####/cache/sweb.apk.apk
/data/data/####/shared_prefs/userInfo.xml
/sdcard/Android/data/####/cache/-268442156.tmp
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/shared_prefs/dispatch_log.xml
/data/data/####/shared_prefs/device_id.xml.xml
/data/data/####/databases/cc/cc.db
/sdcard/Android/data/####/cache/2033747160.tmp
/data/data/####/app_plugin_dir/com.core.sms/1.0_1/dalvik-cache/base-1.dex
/sdcard/Android/data/####/cache/-576025114.tmp
/data/data/####/files/server.json
/sdcard/Android/data/####/cache/215262780.tmp
/data/data/####/app_apCoreplugn/swqb.apk
/data/data/####/databases/com.core.main.pay.plugmain_sy_pay_record-journal
/sdcard/Android/data/####/cache/1875395676.tmp
/data/data/####/files/easemobDB/6ea9013e344c43d9b0f26794b1340ed3.db-journal
/sdcard/.twservice/qshp_3003_2248.zip
/sdcard/Android/data/####/cache/559314184.tmp
/data/data/####/cache/swqb.apk.apk
/data/data/####/app_plugin_dir/com.core.sms/1.0_1/base-1.apk
/sdcard/Android/data/####/cache/-434164812.tmp
/data/data/####/shared_prefs/twc.xml
/data/data/####/app_plugin_dir/com.yfbb.web/1.0_1/dalvik-cache/base-1.dex
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/data/data/####/app_apCoreplugn/sweb.apk
/data/data/####/shared_prefs/TestinAgent.xml

Miscellaneous:

Executes next shell scripts:

/system/bin/dexopt --dex 27 71 40 60768 /data/data/####/app_plugin_dir/com.yfbb.web/1.0_1/base-1.apk 1252560266 1230579592 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ex
/system/bin/dexopt --dex 27 63 40 301712 /data/data/####/app_plugin_dir/com.core.main.pay.plugmain/1.0_100/base-1.apk 1252565114 -563797351 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /sy
cat /sys/block/mmcblk0/device/cid
/system/bin/dexopt --dex 27 63 40 22548 /data/data/####/app_plugin_dir/com.yfbb.wqb/1.0_1/base-1.apk 1252560289 -1176545444 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/e
cat /proc/version
/system/bin/dexopt --dex 27 63 40 54852 /data/data/####/app_plugin_dir/com.core.sms/1.0_1/base-1.apk 1252565269 -32274133 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext
/system/bin/dexopt --dex 27 79 40 213440 /storage/emulated/0/.tpservice/####/download/jar/qsha_80001_5094.jar 1248298237 -1297833896 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/fr
/system/bin/dexopt --dex 27 105 40 274292 /storage/emulated/0/.twservice/qshp_3003_2248/tw.jar 1249605357 1919768635 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew

Contains functionality to send SMS messages automatically.

Технології

Терміни

Навчання

Міфи

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней