Android.SmsSend.22368

Technical information

Malicious functions:

Sends SMS messages:

4446: SHRK BSKRSMGFNFHSDCPBSPAY1 nf14@4436278410809230
4446: SHRK BSKRSMGFNFHSDCPBSPAY1 nf14@4436282082730108
4446: SHRK BSKRSMGFNFHSDCPBSPAY1 nf14@4436309752565927
4446: SHRK BSKRSMGFNFHSDCPBSPAY1 nf14@4436339747725628

Executes code of the following detected threats:

Android.Mixi.16.origin
Android.Mixi.21.origin
Android.Xiny.164.origin
Android.Xiny.166.origin
Android.Xiny.202.origin
Android.Xiny.72.origin
Android.Xiny.73.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(GCM) <Google Host>
TCP(HTTP/1.1) 4####.79.77.161:80
TCP(HTTP/1.1) gp.lik####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) pus####.bshark####.com:8888
TCP(HTTP/1.1) gpup####.b0.a####.com:80
TCP(HTTP/1.1) 45.79.1####.160:80
TCP(HTTP/1.1) pus####.bshark####.com:9898
TCP(HTTP/1.1) gp.miaoxi####.com:80
TCP(HTTP/1.1) 45.79.1####.48:80
TCP(HTTP/1.1) 4####.33.0.176:80
TCP(HTTP/1.1) 4####.33.0.123:80
TCP(HTTP/1.1) 45.33.1####.75:80
TCP(HTTP/1.1) www.okyes####.com:8081
TCP(HTTP/1.1) 45.79.1####.241:80
TCP(HTTP/1.1) www.koapk####.com:8081

DNS requests:

a####.u####.com
gp.lik####.com
gp.miaoxi####.com
pus####.bshark####.com
s####.bshark####.com
sh.penc####.com
www.koapk####.com
www.okyes####.com

HTTP GET requests:

gp.lik####.com/cr/sv/getRltNew?eid=####&estatus=####&appkey=####&pid=###...
gpup####.b0.a####.com/cr/sdk/170417/des_V17041703Aj1so32.zip
gpup####.b0.a####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
gpup####.b0.a####.com/rtf/180562885f3e4c613c5e9844caef22755.slze
gpup####.b0.a####.com/rtf/408c223fa967dc4d9933c57041b7f49f.slze
gpup####.b0.a####.com/rtf/421d8d61ecc491beaa0499837e702272.slze
gpup####.b0.a####.com/rtf/4303e8e0c1feae973da3a9e9f6774365.slze
gpup####.b0.a####.com/rtf/6106c835e4d5906917109492ee4c4578.slze
gpup####.b0.a####.com/rtf/6115c9af6b1c30917b41f5c378956f40.slze
gpup####.b0.a####.com/rtf/617d41e9630fe337ac7a57c083c1c068.slze
gpup####.b0.a####.com/rtf/6408c259f823e8db8ced83ef353a06b4.slze
gpup####.b0.a####.com/rtf/806a6b70c891c315e00b5dfd26af42ed.slze

HTTP POST requests:

gp.lik####.com/cr/sv/getEPList
pus####.bshark####.com:8888/api_2_2/bs-pay-api/APPLIMIT.shtml
pus####.bshark####.com:8888/api_2_2/bs-pay-api/GBSPIF.shtml
pus####.bshark####.com:8888/api_2_2/count/TSS.shtml
pus####.bshark####.com:8888/api_2_2/count/TSSS.shtml
pus####.bshark####.com:9898/bsph/api/getTime.shtml
www.koapk####.com:8081/sm/sr/rt/ry
www.koapk####.com:8081/sm/sr/run/hy
www.koapk####.com:8081/sm/sr/sp/py
www.okyes####.com:8081/sdk/nsd.action?b=####

Modified file system:

Creates the following files:

<Package Folder>/app_DEX_OPT/02031562.dex
<Package Folder>/app_DEX_OPT/06943114.dex
<Package Folder>/app_DEX_OPT/12976887.dex
<Package Folder>/app_DEX_OPT/17486177.dex
<Package Folder>/app_DEX_OPT/18357250.dex
<Package Folder>/app_DEX_OPT/23814145.dex
<Package Folder>/app_DEX_OPT/55956846.dex
<Package Folder>/app_DEX_OPT/57111817.dex
<Package Folder>/app_DEX_OPT/59189954.dex
<Package Folder>/app_DEX_OPT/60969942.dex
<Package Folder>/app_DEX_OPT/64079400.dex
<Package Folder>/app_DEX_OPT/69307979.dex
<Package Folder>/app_DEX_OPT/73612800.dex
<Package Folder>/app_DEX_OPT/78799159.dex
<Package Folder>/app_DEX_OPT/91072402.dex
<Package Folder>/app_DEX_OPT/96044833.dex
<Package Folder>/app_DEX_OPT/98884236.dex
<Package Folder>/app_DEX_OPT/99801613.dex
<Package Folder>/cache/####/3336783731576458637
<Package Folder>/com.init.env/####/bugreport_ig4n_radish
<Package Folder>/com.init.env/####/debuggerd_hulu
<Package Folder>/com.init.env/####/elfm
<Package Folder>/com.init.env/####/elfm1501850079028.zip
<Package Folder>/com.init.env/####/forever.sh
<Package Folder>/com.init.env/####/install-recovery.sh
<Package Folder>/com.init.env/####/kcol_ysy
<Package Folder>/com.init.env/####/rmmod_ni4g_hd
<Package Folder>/com.init.env/####/supolicy
<Package Folder>/com.init.env/####/toolbox
<Package Folder>/com.init.env/####/toolbox1501850079183.zip
<Package Folder>/databases/bdownloaders.db-journal
<Package Folder>/databases/bpay.db-journal
<Package Folder>/databases/cc.db
<Package Folder>/databases/cc.db-journal
<Package Folder>/databases/rtr.db
<Package Folder>/databases/rtr.db-journal
<Package Folder>/databases/swith1014.db-journal
<Package Folder>/databases/ua.db
<Package Folder>/databases/ua.db-journal
<Package Folder>/files/####/.md
<Package Folder>/files/####/02031562.apk
<Package Folder>/files/####/06943114.apk
<Package Folder>/files/####/12976887.apk
<Package Folder>/files/####/15926630.apk
<Package Folder>/files/####/17486177.apk
<Package Folder>/files/####/18357250.apk
<Package Folder>/files/####/2192788C7F22153381BE36CCE199F667
<Package Folder>/files/####/23814145.apk
<Package Folder>/files/####/321F461C84A76551E0F13DEE2DE25B48
<Package Folder>/files/####/4C18CF4CECB2C6C41AEE107E445DD6AF
<Package Folder>/files/####/55956846.apk
<Package Folder>/files/####/57111817.apk
<Package Folder>/files/####/59189954.apk
<Package Folder>/files/####/5EB02114F4C9E44DC9057ED9DAB542A8
<Package Folder>/files/####/5zi2<System Property>46
<Package Folder>/files/####/60969942.apk
<Package Folder>/files/####/64079400.apk
<Package Folder>/files/####/687CE4BBE73700C83F10D8B771632113
<Package Folder>/files/####/69307979.apk
<Package Folder>/files/####/73612800.apk
<Package Folder>/files/####/78799159.apk
<Package Folder>/files/####/91072402.apk
<Package Folder>/files/####/96044833.apk
<Package Folder>/files/####/98884236.apk
<Package Folder>/files/####/99801613.apk
<Package Folder>/files/####/<Package>12<System Property>2
<Package Folder>/files/####/A6946EF004E66837416FE0C0B887C92C
<Package Folder>/files/####/CA7101E4D22B997D387F0C4AA1B4DC41
<Package Folder>/files/####/D7832211AD653C42CF4694E5CC54542E
<Package Folder>/files/####/E61E5FDAB01BE6048B284538C8CAE25D
<Package Folder>/files/####/N2025.data
<Package Folder>/files/####/N2026.data
<Package Folder>/files/####/N2029.data
<Package Folder>/files/####/N2030.data
<Package Folder>/files/####/N2040.data
<Package Folder>/files/####/N2043.data
<Package Folder>/files/####/N2045.data
<Package Folder>/files/####/N2046.data
<Package Folder>/files/####/N2048.data
<Package Folder>/files/####/N2050.data
<Package Folder>/files/####/N2051.data
<Package Folder>/files/####/N2058.data
<Package Folder>/files/####/dz_p866.data
<Package Folder>/files/####/env201708291050.data
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/gpdu
<Package Folder>/files/####/p_dzpg48.data
<Package Folder>/files/####/p_dzwk44.data
<Package Folder>/files/####/rs23.data
<Package Folder>/files/####/rs40.data
<Package Folder>/files/####/test
<Package Folder>/files/####/ym43.data
<Package Folder>/files/.imprint
<Package Folder>/files/1501850078505_V17041703Aj1so32.so
<Package Folder>/files/1501850078641_V17041703Aj1so32.so
<Package Folder>/files/1501850078795_V17041703Aj1so32.so
<Package Folder>/files/1805.jar
<Package Folder>/files/201708151050.apk
<Package Folder>/files/408.jar
<Package Folder>/files/421.jar
<Package Folder>/files/430.jar
<Package Folder>/files/610.jar
<Package Folder>/files/611.jar
<Package Folder>/files/617.jar
<Package Folder>/files/640.jar
<Package Folder>/files/806.jar
<Package Folder>/files/908GhK3z1.jar
<Package Folder>/files/<System Property>112.jar
<Package Folder>/files/c201708151050.apk
<Package Folder>/files/exid.dat
<Package Folder>/files/hftJcw46N.jar
<Package Folder>/files/j5aYJgGT3.jar
<Package Folder>/files/umeng_it.cache
<Package Folder>/files/us.XIE6J7u3B4nRKlfEI88s1St68gT2d
<Package Folder>/p.dz866/####/ODY2ZXhl
<Package Folder>/p.dz866/####/ODY2ZXhl1501850093645.zip
<Package Folder>/p.dz866/####/ZGV4ZXoy
<Package Folder>/p.dz866/####/ZGV4ZXoy1501850092246.zip
<Package Folder>/p.dz866/####/error
<Package Folder>/p.dzpg48/####/ZDExMDN6
<Package Folder>/p.dzpg48/####/ZDExMDN61501850118934.zip
<Package Folder>/p.dzpg48/####/error
<Package Folder>/p.dzwk44/####/ZDJsdWEyeGxNekk9
<Package Folder>/p.dzwk44/####/ZDJsdWEyeGxNekk91501850111682.zip
<Package Folder>/p.dzwk44/####/error
<Package Folder>/p.rl23/####/forever.sh
<Package Folder>/p.sr40/####/cnVuc2hlbGwy
<Package Folder>/p.sr40/####/cnVuc2hlbGwy1501850079649.zip
<Package Folder>/p.sr40/####/forever.sh
<Package Folder>/p.ym43/####/Wlhod1gzbDFiVjh5
<Package Folder>/p.ym43/####/Wlhod1gzbDFiVjh51501850130188.zip
<Package Folder>/p.ym43/####/forever.sh
<Package Folder>/shared_prefs/20160121.xml
<Package Folder>/shared_prefs/20160121.xml.bak
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/PSSDK.xml
<Package Folder>/shared_prefs/PSSDK.xml (deleted)
<Package Folder>/shared_prefs/PSSDK.xml.bak
<Package Folder>/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
<Package Folder>/shared_prefs/QURfUk9PVF9TREtfMjAxNzAyMDgxMA.xml
<Package Folder>/shared_prefs/ae.xml
<Package Folder>/shared_prefs/game_number.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<SD-Card>/APPMarket/####/360092909.jpg.tmp
<SD-Card>/error_log/2017-08-04root_log.txt
<SD-Card>/test1501850077864

Miscellaneous:

Executes next shell scripts:

.kugua
.kugua -c id
<Package Folder>/files/.play/test <Package Folder>/files/.play/ 72a46626b31344f195cfc5acdda0c779
<Package Folder>/files/us.XIE6J7u3B4nRKlfEI88s1St68gT2d -h 72a46626b31344f195cfc5acdda0c779 <Package Folder>/.syslib-
c201708151050.apk -p <Package> -c <Package>:railer
chmod 0755 <Package Folder>/com.init.env
chmod 0771 <Package Folder>/.syslib-
chmod 0777 <Package Folder>/com.init.env/files/elfm
chmod 0777 <Package Folder>/com.init.env/files/forever.sh
chmod 0777 <Package Folder>/com.init.env/files/toolbox
chmod 0777 <Package Folder>/p.dz866/files/ODY2ZXhl
chmod 0777 <Package Folder>/p.dz866/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dz866/files/error
chmod 0777 <Package Folder>/p.dz868/files/ODY4X2V4
chmod 0777 <Package Folder>/p.dz868/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dz868/files/error
chmod 0777 <Package Folder>/p.dzpg48/files/ZDExMDN6
chmod 0777 <Package Folder>/p.dzpg48/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dzpg48/files/error
chmod 0777 <Package Folder>/p.dzsd45/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dzsd45/files/ZVhWdGFXVXpNZz09
chmod 0777 <Package Folder>/p.dzsd45/files/error
chmod 0777 <Package Folder>/p.dzwk44/files/ZDJsdWEyeGxNekk9
chmod 0777 <Package Folder>/p.dzwk44/files/ZGV4ZXoy
chmod 0777 <Package Folder>/p.dzwk44/files/error
chmod 0777 <Package Folder>/p.rl23/files/cnVuc2hlbGwy
chmod 0777 <Package Folder>/p.rl23/files/forever.sh
chmod 0777 <Package Folder>/p.sr40/files/cnVuc2hlbGwy
chmod 0777 <Package Folder>/p.sr40/files/forever.sh
chmod 0777 <Package Folder>/p.ym43/files/Wlhod1gzbDFiVjh5
chmod 0777 <Package Folder>/p.ym43/files/forever.sh
chmod 6777 <Package Folder>/files/c201708151050.apk
chmod 770 <Package Folder>/files/.play/test
getenforce
logcat -d -v time
ls -l /system/bin/su
ps
rm -f <Package Folder>/files/908GhK3z1.dex
rm -f <Package Folder>/files/908GhK3z1.jar
rm -f <Package Folder>/files/hftJcw46N.dex
rm -f <Package Folder>/files/hftJcw46N.jar
rm -f <Package Folder>/files/j5aYJgGT3.dex
rm -f <Package Folder>/files/j5aYJgGT3.jar
rm -f <Package Folder>/files/us.XIE6J7u3B4nRKlfEI88s1St68gT2d
rm <Package Folder>/files/908GhK3z1.dex
rm <Package Folder>/files/908GhK3z1.jar
rm <Package Folder>/files/hftJcw46N.dex
rm <Package Folder>/files/hftJcw46N.jar
rm <Package Folder>/files/j5aYJgGT3.dex
rm <Package Folder>/files/j5aYJgGT3.jar
rm <Package Folder>/files/us.XIE6J7u3B4nRKlfEI88s1St68gT2d
rmmod_ni4g_hd
rmmod_ni4g_hd -c id
sh
sh -c /system/usr/toolbox rm -f <Package Folder>/files/908GhK3z1.dex > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/908GhK3z1.jar > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/j5aYJgGT3.dex > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/j5aYJgGT3.jar > /dev/null 2>&1
sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.XIE6J7u3B4nRKlfEI88s1St68gT2d > /dev/null 2>&1
sh -c rm <Package Folder>/files/908GhK3z1.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/908GhK3z1.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/j5aYJgGT3.dex > /dev/null 2>&1
sh -c rm <Package Folder>/files/j5aYJgGT3.jar > /dev/null 2>&1
sh -c rm <Package Folder>/files/us.XIE6J7u3B4nRKlfEI88s1St68gT2d > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/908GhK3z1.dex > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/908GhK3z1.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.dex > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/hftJcw46N.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/j5aYJgGT3.dex > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/j5aYJgGT3.jar > /dev/null 2>&1
sh -c rm -f <Package Folder>/files/us.XIE6J7u3B4nRKlfEI88s1St68gT2d > /dev/null 2>&1
sh <Package Folder>/files/.play/test <Package Folder>/files/.play/ 72a46626b31344f195cfc5acdda0c779
sh <Package Folder>/files/us.XIE6J7u3B4nRKlfEI88s1St68gT2d -h 72a46626b31344f195cfc5acdda0c779 <Package Folder>/.syslib-

Loads the following dynamic libraries:

1501850078505_V17041703Aj1so32
com.refprc
lplus

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial