Android.SmsBot.329

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.SmsBot.48

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) rq####.sp####.mig.####.net:80
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) 1####.217.17.74:443
TCP(TLS/1.2) 1####.217.19.195:443
TCP(TLS/1.2) 1####.217.17.110:443

DNS requests:

a####.exc.mob.com
and####.b####.qq.com
and####.google####.com
l####.tbs.qq.com
p####.google####.com

HTTP POST requests:

a####.exc.mob.com/errconf
l####.tbs.qq.com/ajax?c=####&k=####
rq####.sp####.mig.####.net/rqd/async?aid=####

File system changes:

Creates the following files:

/data/data/####/.artc_lock
/data/data/####/.cl
/data/data/####/.dic_lock
/data/data/####/.du_lock
/data/data/####/.duid
/data/data/####/.globalLock
/data/data/####/.gm_lock
/data/data/####/.im_lock
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/.lesd_lock
/data/data/####/.lock
/data/data/####/.pkg_lock
/data/data/####/.pkgs_lock
/data/data/####/.slw
/data/data/####/.ss_lock
/data/data/####/.vpl_lock
/data/data/####/.wkl
/data/data/####/1004
/data/data/####/ThrowalbeLog.db
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.dex;classes6.dex
/data/data/####/cn.jpush.config.xml
/data/data/####/cn.jpush.config.xml.bak
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/domain_1
/data/data/####/download_upload
/data/data/####/goubuli.png
/data/data/####/hianalytics_global_v2_com.android.lexin.model.xml
/data/data/####/jpush_uncaughtexception_file
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/mob_commons_1
/data/data/####/mob_sdk_exception_1
/data/data/####/momo.db3
/data/data/####/momo.db3-journal
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/proc_auxv
/data/data/####/security_info
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes3.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes4.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes5.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes6.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
cat /sys/class/net/wlan0/address
getprop
getprop ro.product.cpu.abi
logcat -d -v threadtime

Uses the following algorithms to encrypt data: