Android.SmsSend.20231

Technical information

Malicious functions:

Sends SMS messages:

1069040674844: 3:z00|eGpwYXkCMzZPMmnFd8HfKbM6dVb6gnnk0cquBeAHfXggxOhVpjGoRAMfE/hZrS5J

Network activity:

Connecting to:

1####.####.10
1####.####.10:8081
1####.####.150
1####.####.150:8087
a####.####.cn
appsup####.####.com
c####.####.com
openmo####.####.com
p####.####.com
pi####.####.com
q####.####.com
sup####.####.com
ws####.####.com

HTTP GET requests:

a####.####.cn/2/client/common_config?appkey=####&packagename=####&key_ha...
appsup####.####.com/cgi-bin/appstage/mstats_report?report_type=####&plat...
c####.####.com/code.cgi?domain=####&cgi=####&type=####&code=####&time=##...
c####.####.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=####&st...
openmo####.####.com/oauth2.0/m_authorize?status_userip=####&scope=####&r...
p####.####.com/qconn/widget/mobile/login/images/loading.gif?max_age=####...
q####.####.com/open_proj/qqconnect/h5login/css/sprite/jump2.png?max_age=...
sup####.####.com/include/style/comm2010.css

HTTP POST requests:

1####.####.10/behavior/add
1####.####.10:8081/behavior/add
1####.####.150/dataupgrade/check/
1####.####.150:8087/config/getconfigfile
pi####.####.com/mstat/report
ws####.####.com/w.cgi

Modified file system:

Creates the following files:

<Package Folder>/app_libs/libcryto_zywx.so
<Package Folder>/app_temp/libcryto_zywx.so
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/index
<Package Folder>/databases/sdk_report.db
<Package Folder>/databases/sdk_report.db-journal
<Package Folder>/databases/tencent_analysis.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal (deleted)
<Package Folder>/files/####/100400052740-170531
<Package Folder>/files/####/3.1.0.5-170531
<Package Folder>/files/DownloadBillingList_100400052740_00000329_000000003465_<IMSI>unanaly
<Package Folder>/files/com.tencent.open.config.json.1104763947
<Package Folder>/files/defrayPriority100400052740<IMSI>.dat
<Package Folder>/files/libwbsafeedit_x86.so
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/com_sina_weibo_sdk.xml
<Package Folder>/shared_prefs/gameserver.xml
<Package Folder>/shared_prefs/myepay.xml
<Package Folder>/shared_prefs/secure_lib.xml
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/journal.tmp
<SD-Card>/Tencent/####/.mid.txt
<SD-Card>/Tencent/####/com.tencent.mobileqq_connectSdk.17.05.31.07.log
<SD-Card>/lgsp/imei
<SD-Card>/zywx/####/myepay_data.jar