Technical information
Malicious functions:
Sends SMS messages:
- 15121150845: #2016#40041&99770&<IMSI>&<IMEI>&<ICCID>
Executes code of the following detected threats:
- Android.SkyMobi.6.origin
- Android.SkyMobi.6.origin
Downloads the following detected threats from the Web:
- Android.SkyMobi.6.origin
- Android.SkyMobi.6.origin
Network activity:
Connecting to:
- 1####.####.181
- 1####.####.181:83
- and####.####.com
- c####.####.com
- l####.####.com
- l####.####.com:9820
HTTP GET requests:
- 1####.####.181/Interface/SdkUserInterface.aspx?imsi=####&imei=####&iccid...
- 1####.####.181:83/InterFace/GatherSdkInterface.aspx?code=####
- and####.####.com/3rd-access-android/image/show.do?imageName=####
HTTP POST requests:
- c####.####.com/uploadCrashLogInfo.do
- l####.####.com/chnlt/ltpay/pytstart.do
- l####.####.com:9820/chnlt/ltpay/pytstart.do
Modified file system:
Creates the following files:
- <Package Folder>/.cache/version
- <Package Folder>/app_workbench04282/apk.zip
- <Package Folder>/app_workbench09808/apk.zip
- <Package Folder>/app_workbench76426/apk.zip
- <Package Folder>/databases/Data_sync.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/classes.dex
- <Package Folder>/files/libnesec.so
- <Package Folder>/files/sec.lck
- <Package Folder>/shared_prefs/CrashTimes.xml
- <Package Folder>/shared_prefs/InitTag.xml
- <Package Folder>/shared_prefs/IsSecondEx.xml
- <Package Folder>/shared_prefs/IsSecondEx.xml.bak
- <Package Folder>/shared_prefs/appstartone.xml
- <Package Folder>/shared_prefs/appstarttwo.xml
- <Package Folder>/shared_prefs/out.xml
- <Package Folder>/shared_prefs/plugin_record_app_info.xml
- <Package Folder>/shared_prefs/pref_recomm.xml
- <Package Folder>/shared_prefs/sdktype.xml
- <Package Folder>/shared_prefs/uuid.xml
- <Package Folder>/shared_prefs/ysec.xml
- <Package Folder>/zyfadv/ad4083923264a6583a716b0724d0b789.img
- <Package Folder>/zyfadv/c7a44900a7f1959b3eaf5a573371e8d3.img
- <Package Folder>/zyfadv/response.data
- <SD-Card>/Android/####/ad4083923264a6583a716b0724d0b789.img
- <SD-Card>/Android/####/c7a44900a7f1959b3eaf5a573371e8d3.img
- <SD-Card>/Android/####/com.lyhtgh.pay.ltplugin.apk
- <SD-Card>/Android/####/com.skymobi.pay.plugin.main.data
- <SD-Card>/Android/####/com.skymobi.pay.plugin.recordupload.data
- <SD-Card>/Android/####/com.skymobi.pay.plugin.smspay.data
- <SD-Card>/Android/####/response.data
- <SD-Card>/check/check
- <SD-Card>/com/####/uid.sys
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.data
- logcat -d -v threadtime
Uses special library to hide executable bytecode.
