Android.SmsSend.20431

Technical information

Malicious functions:

Sends SMS messages:

13138613847: *应该好好学习会员卡:<IMEI> *:<System Property> *:<System Property> *:4.3.1
13138613847: <SMS Content> 来自900
13138613847: <SMS Content> 来自<SMS Address>
13138613847: 已选择

Executes code of the following detected threats:

Android.SmsSpy.572.origin

Downloads the following detected threats from the Web:

Android.SmsSpy.572.origin

Removes its shortcut from the home screen.

Network activity:

Connecting to:

aexcep####.####.com:8012
and####.####.com

HTTP POST requests:

aexcep####.####.com:8012/rqd/async
and####.####.com/rqd/async

Modified file system:

Creates the following files:

<Package Folder>/databases/bugly_db_legu
<Package Folder>/databases/bugly_db_legu-journal
<Package Folder>/files/local_crash_lock
<Package Folder>/files/local_crash_lock (deleted)
<Package Folder>/files/native_record_lock (deleted)
<Package Folder>/files/security_info
<Package Folder>/mix.dex
<Package Folder>/shared_prefs/jjyy.xml
<Package Folder>/tx_shell/libnfix.so
<Package Folder>/tx_shell/libshella-2.10.4.1.so
<Package Folder>/tx_shell/libufix.so

Miscellaneous:

Executes next shell scripts:

/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<dexopt>
chmod 700 /data/data/g1r1f1t1hh.t3df3we2ew3er.xe1wq1we1sd1sw.gh2as2a2w1w1r.view/tx_shell/libnfix.so
chmod 700 /data/data/g1r1f1t1hh.t3df3we2ew3er.xe1wq1we1sd1sw.gh2as2a2w1w1r.view/tx_shell/libshella-2.10.4.1.so
chmod 700 /data/data/g1r1f1t1hh.t3df3we2ew3er.xe1wq1we1sd1sw.gh2as2a2w1w1r.view/tx_shell/libufix.so
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.4.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime