Android.SmsSend.19796

Technical information

Malicious functions:

Sends SMS messages:

12114: HZSY#<IMSI>

Executes code of the following detected threats:

Android.Xiny.122.origin
Android.SmsSend.1848.origin

Sends data on received text messages to remote host.

Network activity:

Connecting to:

s####.####.com
i####.####.com:10003
gaand####.####.net
p####.####.com:9000
mo####.####.com
re####.####.com:10002
p####.####.com
a####.####.top
col####.####.com
sdkup####.####.com:20000
p####.####.cc

HTTP GET requests:

p####.####.com/cityjson?ie=####
p####.####.com/init_product_strategy?app_id=####&source_id=####
a####.####.top/getdata?cpid=####&packagename=####
sdkup####.####.com:20000/version/30/patch/astep_A_J_3.0.0_30.apk_26_patc...
re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...

HTTP POST requests:

s####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
p####.####.com:9000/sdk_pools_pay_version
col####.####.com/pay-data-collect/collectAppStartUserData.json
p####.####.cc/index.php/MC/HB
mo####.####.com/mobile-service/getOpenImsiMobilePhone.json
i####.####.com:10003/v2/chis
gaand####.####.net/g/d?crc=####

Modified file system:

Creates the following files:

<Package Folder>/files/e/plus.jar
<Package Folder>/shared_prefs/nnt_data.xml
<Package Folder>/shared_prefs/b_setting.xml
<Package Folder>/pspace/nexor.jar
<Package Folder>/shared_prefs/pref_file.xml.bak
<Package Folder>/shared_prefs/yunchao_sp.xml.bak
<Package Folder>/shared_prefs/2e63980ac4d6a5d8f4245294b843d374b|account_file.xml
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/files/libyunsvc
<Package Folder>/shared_prefs/sy_pay_config.xml
<Package Folder>/shared_prefs/CYCLE_UNIQUE_ID.xml
<Package Folder>/shared_prefs/ma_data.xml.bak
<Package Folder>/shared_prefs/ma_epay_share.xml.bak
<Package Folder>/databases/sy_pay_record-journal
<Package Folder>/shared_prefs/share_ecd.xml
<Package Folder>/shared_prefs/shareyuanlangfirst.xml
<Package Folder>/shared_prefs/ma_phone.xml.bak
<Package Folder>/databases/TDGAtcagentgame.db
<Package Folder>/shared_prefs/share_data.xml
<Package Folder>/shared_prefs/b_share.xml.bak
<Package Folder>/shared_prefs/ma_epay_share.xml
<Package Folder>/shared_prefs/share_data.xml.bak
<Package Folder>/shared_prefs/p_config.xml
<Package Folder>/databases/TDGAtcagentgame.db-journal
<Package Folder>/shared_prefs/ma_phone.xml
<Package Folder>/shared_prefs/pref_file.xml
<Package Folder>/shared_prefs/ma_call.xml
<Package Folder>/shared_prefs/nnt_data.xml.bak
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/sy_pay_config.xml.bak
<Package Folder>/shared_prefs/b_share.xml
<Package Folder>/shared_prefs/ma_data.xml
<Package Folder>/pspace/prim.jar
<Package Folder>/files/plugin.dex
<Package Folder>/shared_prefs/zzconfig.xml
<Package Folder>/files/plugin.apk
<Package Folder>/databases/webview.db-journal
<Package Folder>/shared_prefs/share_version.xml
<Package Folder>/shared_prefs/CYCLE_PAY_PREF_NAME.xml
<Package Folder>/databases/MaiStore.db-journal
<Package Folder>/shared_prefs/yunchao_sp.xml
<Package Folder>/shared_prefs/LANG_SDK_PREF.xml
<Package Folder>/app_dex_path/lang_encrypt_dex.dex
<Package Folder>/databases/recordInfo-journal