Android.SmsSend.20605

Technical information

Malicious functions:

Sends SMS messages:

1069028900588: 1#<IMSI>#njjy

Network activity:

Connecting to:

1####.####.com
2####.####.140
2####.####.140:8080
a####.####.com
auto####.com
auto####.com:9000
bwse####.####.com
bwse####.####.com:8220
d####.####.com
g####.####.net
g####.####.net:8080
ojtgd####.####.com
s####.####.com
sd####.####.com
small####.####.cn
t####.cn
tcpse####.####.com
tcpse####.####.com:28000
w####.####.com:7758

HTTP GET requests:

1####.####.com/ic.asp
a####.####.com/loc/?cl=####&wl=####&output=####
auto####.com/spfee/images/confignanjing.txt
auto####.com:9000/spfee/images/confignanjing.txt
bwse####.####.com/qianya/sdk/confignanjing.txt
bwse####.####.com:8220/qianya/sdk/confignanjing.txt
d####.####.com/egsb/game/getclientProvince?tel=####&iccid=####&imsi=####
s####.####.com/download//moduleVersion/marketing100_20170707185955886.jar
t####.cn/ajax/imsi.ashx?imsi=####
tcpse####.####.com/server_info
tcpse####.####.com:28000/server_info

HTTP POST requests:

2####.####.140/migusdk/tl/enclog
2####.####.140:8080/migusdk/tl/enclog
a####.####.com/app_logs
d####.####.com/box_v4.php
g####.####.net/migusdk/verification/checkSdkUpdate
g####.####.net:8080/migusdk/tl/tcttl
ojtgd####.####.com/guard1_arm32
sd####.####.com/behaviorLogging/eventLogging/accept?
small####.####.cn/twentyfourhours/webroot/?act=####
w####.####.com:7758/normandie/QueryConfigPolicy

Modified file system:

Creates the following files:

<Package Folder>/2093.dex
<Package Folder>/2223.dex
<Package Folder>/cache/####/classes.dex
<Package Folder>/cache/2093.dex (deleted)
<Package Folder>/cacheclasses.jar
<Package Folder>/cacheguard1
<Package Folder>/cacheguard2
<Package Folder>/cachelibJniManager.so
<Package Folder>/databases/webview.db
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/1eca20b9035bf22fd3cb7e2a0ad8ce1d.zip
<Package Folder>/files/####/classes.jar
<Package Folder>/files/####/config.json
<Package Folder>/files/####/e5c580ea7acf956c1b5792d9d872e8c5.zip
<Package Folder>/files/####/guard1
<Package Folder>/files/####/guard2
<Package Folder>/files/####/libJniManager.so
<Package Folder>/files/####/libmiguED.so
<Package Folder>/files/####/plugin.xml
<Package Folder>/files/.imprint
<Package Folder>/files/ED.ini
<Package Folder>/files/MiguPay.Sdk30.Lib_12003033_2ef7e474df9346e4b808e3b0179c72c7_BN202.cod
<Package Folder>/files/MiguPay.Sdk30.Lib_12003033_2ef7e474df9346e4b808e3b0179c72c7_BN202.dat
<Package Folder>/files/libmgRun_04.22.09_01.so
<Package Folder>/files/mgAS.dat
<Package Folder>/files/mgSS.dat
<Package Folder>/files/mgid.dat
<Package Folder>/files/playerData
<Package Folder>/files/sdk_prefs
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/cache.xml
<Package Folder>/shared_prefs/global.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<SD-Card>/Download/####/ShareData.txt
<SD-Card>/Download/####/deviceId
<SD-Card>/Download/####/miguLog_1496232154019
<SD-Card>/Download/####/miguLog_1496232154020
<SD-Card>/Download/####/miguLog_1496232181996
<SD-Card>/Download/####/miguLog_1496232182012
<SD-Card>/Download/####/sdk_prefs.txt
<SD-Card>/cmgame/####/marketing_104.jar
<SD-Card>/cmgame/####/pushDB.txt
<SD-Card>/cmgame/####/pushTime.txt
<SD-Card>/cmgame/####/pushTotal.txt