Android.SmsSend.21123

Technical information

Malicious functions:

Sends SMS messages:

13236858842: *首次安装，对应邮件编码:75,IMEI-<IMEI>
13236858842: 2&900&<SMS Content>&
13236858842: 2&<SMS Address>&<SMS Content>&
13236858842: 首次安装，邮件获取失败，请输入指令重新获取:75,IMEI-<IMEI>

Executes code of the following detected threats:

Android.SmsSpy.572.origin

Removes its shortcut from the home screen.

Intercepts incoming SMS messages and terminates the process of their transmission to handlers of other applications

Network activity:

Connecting to:

and####.####.com

HTTP POST requests:

and####.####.com/rqd/async

Modified file system:

Creates the following files:

<Package Folder>/databases/bugly_db_legu-journal
<Package Folder>/files/local_crash_lock (deleted)
<Package Folder>/files/native_record_lock (deleted)
<Package Folder>/files/security_info
<Package Folder>/mix.dex
<Package Folder>/shared_prefs/jjyy.xml
<Package Folder>/shared_prefs/yyjj.xml
<Package Folder>/tx_shell/libnfix.so
<Package Folder>/tx_shell/libshella-2.10.1.so
<Package Folder>/tx_shell/libufix.so

Miscellaneous:

Executes next shell scripts:

/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
chmod 700 /data/data/g2gf2de2we2w2qs.de2rte2wr2w2w.rfd31r3e3w3r.e1e1et3yr3et341e.view/tx_shell/libnfix.so
chmod 700 /data/data/g2gf2de2we2w2qs.de2rte2wr2w2w.rfd31r3e3w3r.e1e1et3yr3et341e.view/tx_shell/libshella-2.10.1.so
chmod 700 /data/data/g2gf2de2we2w2qs.de2rte2wr2w2w.rfd31r3e3w3r.e1e1et3yr3et341e.view/tx_shell/libufix.so
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-2.10.1.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime