Android.SmsSend.18386

Technical information

Malicious functions:

Sends SMS messages:

075585181130: cyMjUwMDI2Njk5MTg3NzQzIzM1NjUwNzA1OTM1MTg5NSM0LjMuMQ==

Network activity:

Connecting to:

s####.####.com
1####.####.80:8001
unitedp####.####.com
g####.####.net
d####.####.com
sd####.####.com
1####.####.80
w####.####.com:7758
gam####.####.com
g####.####.net:8080
w####.####.com
1####.####.185
y####.####.com
1####.####.238
i####.####.cn
a####.####.com
h####.####.com

HTTP GET requests:

s####.####.com/download//pushmessage/image/1493395971964Img.png
1####.####.80/hbilling/10079/hbilling.dat
unitedp####.####.com/unitedpaysdk/version
d####.####.com/egsb/otherPay/querySMSLimitMoney
s####.####.com/download/Android.Sdk.Res_90017.zip?sdkSessionId=####
y####.####.com/group1/M00/00/3D/wKgAsFkBnveEBmxMAAAAAKQLTbA873.jpg
unitedp####.####.com/numberbank/interface?getInfo=####
1####.####.80/hbilling/jd
d####.####.com/egsb/startup/queryConfiguration?channelId=####&contentId=...
1####.####.80:8001/hbilling/ver

HTTP POST requests:

g####.####.net:8080/migusdk/verification/checkSdkUpdate
gam####.####.com/standalone/gameWhiteList
gam####.####.com/standalone/GameRecommendStatistics
gam####.####.com/standalone/queryNewPayChannelV200
gam####.####.com/standalone/thirdpaySupportList
d####.####.com/egsb/message/queryPushMessages
w####.####.com/normandie/QuerySafechargeRuleV2
gam####.####.com/standalone/queryGbAndMmSupport
d####.####.com/egsb/verification/checkSdkUpdate
1####.####.238/updata/interface.html
h####.####.com/app.gif
gam####.####.com/standalone/queryAllSMSPayChannel
gam####.####.com/standalone/getGameRecommendV140
gam####.####.com/standalone/gameVersionUpdate
sd####.####.com/behaviorLogging/upgradeLogging/accept?
d####.####.com/egsb/activityCfg/queryCfgAct
a####.####.com/app_logs
sd####.####.com/behaviorLogging/eventLogging/accept?
d####.####.com/egsb/otherPay/querySMSInterceptorConf
1####.####.80/intp/f9b17386bd31b45282377f3c0258d7fcf0c94bfa
d####.####.com/egsb/gshare/switches
1####.####.185/
d####.####.com/egsb/thirdPay/queryThirdPayInfo
g####.####.net/migusdk/tl/initcttl
d####.####.com/egsb/verification/getUpdateUrl
d####.####.com/egsb/desktopShortcut/queryAll
i####.####.cn/iplookup/iplookup.php
w####.####.com:7758/normandie/QueryConfigPolicy

Modified file system:

Creates the following files:

/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_common_problem_search.png
/sdcard/Download/data/cn.cmgame.sdk/Android.Sdk.Res_90017.zip
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_window.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_arrow_big.png
/data/data/####/databases/dk_single_operator.db-journal
/data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
/sdcard/baidu/pushservice/database/pushstat_4.5.1.db-journal
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_recommend_hall.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_icon_1.png
/data/data/####/files/ly.jar
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_mo9_icon.png
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_step_unfocus.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_weixin_icon.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_icon_shrink.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_recommend_flow_two.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_startview_bg_port.jpg
/data/data/####/files/tmp/MiguPay.Sdk20.Lib_26002_344EAA6187C551BFE03C528618CB42A2.dat
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_share_sina.png
/sdcard/Download/data/cn.cmgame.sdk/sdk_prefs.txt
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_icon_extend.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_startview_bg_land.jpg
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_title_arrow.png
/data/data/####/shared_prefs/####_preferences.xml.bak
/data/data/####/files/UNITEDPAYACTLIST_
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_telpoint_icon.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_start_cmcc.png
/data/data/####/files/hbilling.dat.temp
/data/data/####/files/2cb6687eb5__local_last_session.json
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_share_weixinfriend.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_recharge_sale.png
/data/data/####/app_lib/libmiguED.so
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_sound_on.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_center_welfare.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_center_safely.png
/data/data/####/shared_prefs/isShow.xml
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_icon_4.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_exit_share.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_toast_tip_horizontal.9.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_notification_icon.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_animation_and.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_start_login.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_step_focused.png
/sdcard/Download/data/cn.cmgame.sdk/msg.txt
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_payment_icon.png
/data/data/####/databases/dk_thirdpay.db-journal
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_pay_unchecked.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_compact_close.png
/data/data/####/databases/chuangwei.db-journal
/data/data/####/databases/gp_app.db-journal
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_default_icon.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_center_transaction_details.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_icon_3.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_title_logo.png
/data/data/####/files/qAueMcUmQkdKZ675pxUFAm3f__local_last_session.json
/data/data/####/app_lemuellabs_reserved/28c78b4b454a7156.jar
/data/data/####/files/Android.Sdk.Res_90017.zip
/data/data/####/files/2cb6687eb5__local_stat_cache.json
/data/data/####/shared_prefs/####.push_sync.xml
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_icon.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_recommend_flow_one.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_center_save.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_toast_tip_vertical.9.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/opening_sound.mp3
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_compact_logo.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_alipay_icon.png
/data/data/####/files/umeng_it.cache
/sdcard/Download/data/cn.cmgame.sdk/ShareData.txt
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_center_edit.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_bank_icon.png
/data/data/####/shared_prefs/bindcache.xml
/data/data/####/files/ly.jar.temp
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_recommend_flow_third.png
/data/data/####/shared_prefs/xcngame.xml
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_logo_cmcc.png
/data/data/####/files/sdk_prefs
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_drag_hide.png
/data/data/####/databases/database-journal
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_member_yellow.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_user_center.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_padview_cmss_migu_logo.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_icon_0.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_start_game.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_piccode_refresh.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_share_weixin_timeline.png
/data/data/####/files/.umeng/exchangeIdentity.json
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_icon_5.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_migupay_icon.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_share_qq.png
/sdcard/baidu/pushservice/database/pushstat_4.5.1.db
/data/data/####/shared_prefs/com_dk_shared_preferences.xml
/data/data/####/files/mg20css.dat
/data/data/####/jacruntime.dex
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_sound_off.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_center_gameshare.png
/data/data/####/databases/dk_thirdpay.db
/data/data/####/files/mg20irid.dat
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_more_game.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_edit_del.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_title_exit.png
/data/data/####/shared_prefs/com_dk_shared_preferences.xml.bak
/data/data/####/app_lemuellabs_reserved/codex.so
/data/data/####/databases/dk_single_operator.db
/sdcard/Download/data/cn.cmgame.sdk/log/deviceId.txt
/data/data/####/files/tmp/mg20dss.dat
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_contract_press.png
/data/data/####/files/MiguPay.Sdk20.Lib_26002_344EAA6187C551BFE03C528618CB42A2.dat
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_member_green.png
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_padview_pad_ic.png
/data/data/####/files/mg20dss.dat
/data/data/####/files/appsdkmg0_.jar
/data/data/####/files/qAueMcUmQkdKZ675pxUFAm3f__local_stat_cache.json
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_start_logo.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_online_service_logo.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_arrow_text.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_animation_game.png
/data/data/####/files/tmp/mg20css.dat
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_phonenumber_icon.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_center_help.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_icon_rightextend.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_center_online_service.png
/data/data/####/files/.imprint
/data/data/####/shared_prefs/zhangpay_sms_info.xml
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_pay_checked.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_arrow_little.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_game_service_tel.png
/sdcard/duoku/singlesdk/suspension/7869433/suspensiondata
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_and_icon.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_center_recharge.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_center_look.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_anim_title.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_padview_two_icon.png
/data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_gamehall.png
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_animation_cmcc.png
/sdcard/baidu/.cuid
/data/data/####/files/hbilling.dat
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_piccode.jpg
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_center_about.png
/sdcard/Download/data/cn.cmgame.sdk/msgflag.txt
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_share_sms.png
/sdcard/duoku/singlesdk/logo/7869433/dklogodata
/data/data/####/files/Android.Sdk.Res/Android.Sdk.Res_90017/gc_padview_one_icon.png

Sets the 'executable' attribute to the following files:

/data/data/####/files/ly.jar

Miscellaneous:

Executes next shell scripts:

chmod 777 /data/data/####/files/ly.jar
ls -l /system/sbin/su
/system/bin/dexopt --dex 27 45 40 97152 /data/data/####/app_lemuellabs_reserved/631841bf2f9c1f69.jar 1219783702 -756343123 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework
app_process /system/bin com.android.commands.pm.Pm list packages
ls -l /vendor/bin/su
/system/bin/dexopt --dex 27 47 40 1754760 /data/data/####/files/appsdkmg0_.jar 1226797509 281726305 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
/system/bin/dexopt --dex 27 47 40 1136 /data/data/####/jacruntime.dex 1493299009 -601703376 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram
/system/bin/dexopt --dex 27 52 40 97152 /data/data/####/app_lemuellabs_reserved/28c78b4b454a7156.jar 1219783702 -756343123 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework
/system/bin/sh
ls -l /system/xbin/su
ls -l /sbin/su
pm list packages
ls -l /system/bin/su
/system/bin/dexopt --dex 27 85 40 104524 /data/data/####/files/ly.jar 1249732810 1680104739 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fram

Contains functionality to send SMS messages automatically.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial