Android.DownLoader.3553

Technical information

Malicious functions:

Sends SMS messages:

10658077696615: YX,264340,10,fe5a,1807926,615004,H7F820230052
10658423: mvwlan,7cabe3758d7602a2c1c07952729b6b9f,ojez
10660408: GA34A
1066510600: 212

Executes code of the following detected threats:

Android.SmsSpy.677.origin

Downloads the following detected threats from the Web:

Android.SmsSpy.677.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sdk.qi1####.com:80
TCP(HTTP/1.1) vb####.wann####.com:9700
TCP(HTTP/1.1) q####.qi1####.com:14302
TCP(HTTP/1.1) 1####.55.17.147:8080
TCP(HTTP/1.1) prelo####.hishen####.com:80
TCP(HTTP/1.1) qyc####.qi1####.com:8200
TCP(HTTP/1.1) q####.qi1####.com:15302
TCP(HTTP/1.1) zxc####.wann####.com:8200
TCP(HTTP/1.1) z####.wann####.com:9500
TCP(HTTP/1.1) 1####.55.16.91:8080
TCP(HTTP/1.1) p####.nj####.com.####.com:8080
TCP(HTTP/1.1) 1####.149.136.219:80
TCP(HTTP/1.1) f####.disp####.spcd####.com:80
TCP(HTTP/1.1) www.y####.com.####.com:80
TCP(HTTP/1.1) hangzho####.oss-cn-####.aliy####.com:80
TCP(HTTP/1.1) z####.wann####.com:9600

DNS requests:

a####.u####.com
hangzho####.oss-cn-####.aliy####.com
p####.nj####.com
prelo####.hishen####.com
q####.qi1####.com
qyc####.qi1####.com
sdk.qi1####.com
smm-100####.f####.myqc####.com
vb####.wann####.com
www.y####.com
z####.wann####.com
zxc####.wann####.com

HTTP GET requests:

f####.disp####.spcd####.com/as.txt
hangzho####.oss-cn-####.aliy####.com/qiyi/client/sdk/so/libzxvps.so
p####.nj####.com.####.com:8080/png/ic51ckb.png
p####.nj####.com.####.com:8080/res/novel/app/content/1.txt
p####.nj####.com.####.com:8080/res/novel/app/content/10.txt
p####.nj####.com.####.com:8080/res/novel/app/content/11.txt
p####.nj####.com.####.com:8080/res/novel/app/content/12.txt
p####.nj####.com.####.com:8080/res/novel/app/content/13.txt
p####.nj####.com.####.com:8080/res/novel/app/content/14.txt
p####.nj####.com.####.com:8080/res/novel/app/content/15.txt
p####.nj####.com.####.com:8080/res/novel/app/content/16.txt
p####.nj####.com.####.com:8080/res/novel/app/content/2.txt
p####.nj####.com.####.com:8080/res/novel/app/content/3.txt
p####.nj####.com.####.com:8080/res/novel/app/content/4.txt
p####.nj####.com.####.com:8080/res/novel/app/content/5.txt
p####.nj####.com.####.com:8080/res/novel/app/content/6.txt
p####.nj####.com.####.com:8080/res/novel/app/content/7.txt
p####.nj####.com.####.com:8080/res/novel/app/content/8.txt
p####.nj####.com.####.com:8080/res/novel/app/content/9.txt
p####.nj####.com.####.com:8080/res/novel/app/icon/1.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/2.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/3.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/4.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/5.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/6.jpg
p####.nj####.com.####.com:8080/res/novel/app/icon/7.jpg
p####.nj####.com.####.com:8080/sdk/dp_1.6.2.jar
p####.nj####.com.####.com:8080/sdk/spaycoredex_so_2050.jar
prelo####.hishen####.com/project_preloaded/36dd4e9586a7461ab707925c0ac78...
prelo####.hishen####.com/project_preloaded/4cb6e199a3c546b29bd508100c87e...
prelo####.hishen####.com/project_preloaded/5bd71d4d0402493981f6729675e99...
prelo####.hishen####.com/project_preloaded/69a5abb02d194050a4995a7fbafd6...
prelo####.hishen####.com/project_preloaded/b0a7a2a12f4f49168816270ec4419...
qyc####.qi1####.com:8200/sdk/file?eT1Bt3y####
qyc####.qi1####.com:8200/sdk/file?p8LPd5G####
sdk.qi1####.com/qiyi/client/sdk/PaySDK-1.2.16.8-UR_yx.jar
sdk.qi1####.com/vpssdk/andrcool_1.0.1.jar
www.y####.com.####.com/apka/h820215.apk

HTTP POST requests:

a####.u####.com/app_logs
q####.qi1####.com:14302/sdk_login?t=####
q####.qi1####.com:15302/sdk_login?t=####
qyc####.qi1####.com:8200/sdk/log
vb####.wann####.com:9700/video/init/hello
vb####.wann####.com:9700/video/log/iqiyiLog
z####.wann####.com:9500/
z####.wann####.com:9600/
zxc####.wann####.com:8200/qy/acceptSdkFileReq
zxc####.wann####.com:8200/qy/getOnlineLoginHttpReq

Modified file system:

Creates the following files:

/data/data/####/._logo_img_0.jpg
/data/data/####/._mm_show_0_0.jpg
/data/data/####/._mm_show_0_1.jpg
/data/data/####/._mm_show_0_2.jpg
/data/data/####/._mm_show_0_3.jpg
/data/data/####/._mm_show_1_0.jpg
/data/data/####/._mm_show_1_1.jpg
/data/data/####/._mm_show_1_2.jpg
/data/data/####/._mm_show_1_3.jpg
/data/data/####/._mm_show_2_0.jpg
/data/data/####/._mm_show_2_1.jpg
/data/data/####/._mm_show_2_2.jpg
/data/data/####/._mm_show_2_3.jpg
/data/data/####/._mm_show_3_0.jpg
/data/data/####/._mm_show_3_1.jpg
/data/data/####/._mm_show_3_2.jpg
/data/data/####/._mm_show_4_0.jpg
/data/data/####/._mm_show_4_1.jpg
/data/data/####/._mm_show_4_2.jpg
/data/data/####/._mm_show_5_0.jpg
/data/data/####/._mm_show_5_1.jpg
/data/data/####/._mm_show_5_2.jpg
/data/data/####/._mm_show_6_0.jpg
/data/data/####/._mm_show_6_1.jpg
/data/data/####/._mm_show_6_2.jpg
/data/data/####/._pg_1.png
/data/data/####/._pg_2.png
/data/data/####/._pg_3.png
/data/data/####/._pic_bg.png
/data/data/####/._pic_mm_0.jpg
/data/data/####/._pic_mm_1.jpg
/data/data/####/._pic_mm_2.jpg
/data/data/####/._pic_mm_3.jpg
/data/data/####/._pic_mm_4.jpg
/data/data/####/._pic_mm_5.jpg
/data/data/####/._pic_mm_6.jpg
/data/data/####/._pic_mm_7.jpg
/data/data/####/._price1.jpg
/data/data/####/._price3.png
/data/data/####/.imprint
/data/data/####/1122158615522.89
/data/data/####/1122158615522.89 (deleted)
/data/data/####/1122158615576.87
/data/data/####/1122158615576.87 (deleted)
/data/data/####/1122158615605.8
/data/data/####/1122158615605.8 (deleted)
/data/data/####/1122158615751.61
/data/data/####/1122158615751.61 (deleted)
/data/data/####/1122158615759.36
/data/data/####/1122158615759.36 (deleted)
/data/data/####/1122158615772.3
/data/data/####/1122158615772.3 (deleted)
/data/data/####/1122158615811.52
/data/data/####/1122158615811.52 (deleted)
/data/data/####/1122158615856.21
/data/data/####/1122158615856.21 (deleted)
/data/data/####/1122158615973.61
/data/data/####/1122158615973.61 (deleted)
/data/data/####/1122158615977.88
/data/data/####/1122158615977.88 (deleted)
/data/data/####/1122158616011.47
/data/data/####/1122158616011.47 (deleted)
/data/data/####/1122158616057.16
/data/data/####/1122158616057.16 (deleted)
/data/data/####/1122158616074.35
/data/data/####/1122158616074.35 (deleted)
/data/data/####/1122158616187.14
/data/data/####/1122158616187.14 (deleted)
/data/data/####/1122158616217.01
/data/data/####/1122158616217.01 (deleted)
/data/data/####/1122158616256.28
/data/data/####/1122158616256.28 (deleted)
/data/data/####/1122158616284.43
/data/data/####/1122158616284.43 (deleted)
/data/data/####/1122158616425.61
/data/data/####/1122158616425.61 (deleted)
/data/data/####/1122158616431.89
/data/data/####/1122158616431.89 (deleted)
/data/data/####/1122158616739.05
/data/data/####/1122158616739.05 (deleted)
/data/data/####/1122158616799.38
/data/data/####/1122158616799.38 (deleted)
/data/data/####/1132.30089999093
/data/data/####/1132.30089999093 (deleted)
/data/data/####/1132.34542065845
/data/data/####/1132.34542065845 (deleted)
/data/data/####/1132.38994132597
/data/data/####/1132.38994132597 (deleted)
/data/data/####/1132.43446199348
/data/data/####/1132.43446199348 (deleted)
/data/data/####/1132.478982661
/data/data/####/1132.478982661 (deleted)
/data/data/####/1132.52350332852
/data/data/####/1132.52350332852 (deleted)
/data/data/####/1132.56802399603
/data/data/####/1132.56802399603 (deleted)
/data/data/####/161.918512514603
/data/data/####/161.918512514603 (deleted)
/data/data/####/2251659.32225628
/data/data/####/2251659.62271085
/data/data/####/2251659.62271085 (deleted)
/data/data/####/2325866583008.71
/data/data/####/2325866583008.71 (deleted)
/data/data/####/2325866583893.68
/data/data/####/2325866583893.68 (deleted)
/data/data/####/2325866584375.18
/data/data/####/2325866584375.18 (deleted)
/data/data/####/2325866584893.79
/data/data/####/2325866584893.79 (deleted)
/data/data/####/2325866585069.95
/data/data/####/2325866585069.95 (deleted)
/data/data/####/2325866585500.17
/data/data/####/2325866585500.17 (deleted)
/data/data/####/2325866589619.87
/data/data/####/2325866589619.87 (deleted)
/data/data/####/261212007000.106
/data/data/####/261212007000.106 (deleted)
/data/data/####/261212007099.496
/data/data/####/261212007099.496 (deleted)
/data/data/####/261212007153.572
/data/data/####/261212007153.572 (deleted)
/data/data/####/261212007211.816
/data/data/####/261212007211.816 (deleted)
/data/data/####/261212007231.599
/data/data/####/261212007231.599 (deleted)
/data/data/####/261212007279.916
/data/data/####/261212007279.916 (deleted)
/data/data/####/261212007742.589
/data/data/####/261212007742.589 (deleted)
/data/data/####/2965479917148.81
/data/data/####/2965479917148.81 (deleted)
/data/data/####/2965479917291.44
/data/data/####/2965479917291.44 (deleted)
/data/data/####/2965479917367.89
/data/data/####/2965479917367.89 (deleted)
/data/data/####/2965479917753.21
/data/data/####/2965479917753.21 (deleted)
/data/data/####/2965479917773.72
/data/data/####/2965479917773.72 (deleted)
/data/data/####/2965479917807.9
/data/data/####/2965479917807.9 (deleted)
/data/data/####/2965479917911.56
/data/data/####/2965479917911.56 (deleted)
/data/data/####/2965479918029.66
/data/data/####/2965479918029.66 (deleted)
/data/data/####/2965479918339.91
/data/data/####/2965479918339.91 (deleted)
/data/data/####/2965479918351.19
/data/data/####/2965479918351.19 (deleted)
/data/data/####/2965479918439.94
/data/data/####/2965479918439.94 (deleted)
/data/data/####/2965479918560.7
/data/data/####/2965479918560.7 (deleted)
/data/data/####/2965479918606.12
/data/data/####/2965479918606.12 (deleted)
/data/data/####/2965479918904.18
/data/data/####/2965479918904.18 (deleted)
/data/data/####/2965479918983.12
/data/data/####/2965479918983.12 (deleted)
/data/data/####/2965479919086.9
/data/data/####/2965479919086.9 (deleted)
/data/data/####/2965479919161.28
/data/data/####/2965479919161.28 (deleted)
/data/data/####/2965479919534.38
/data/data/####/2965479919534.38 (deleted)
/data/data/####/2965479919550.97
/data/data/####/2965479919550.97 (deleted)
/data/data/####/2965479920362.69
/data/data/####/2965479920362.69 (deleted)
/data/data/####/2965479920522.13
/data/data/####/2965479920522.13 (deleted)
/data/data/####/3660380.34145408
/data/data/####/3660380.34145408 (deleted)
/data/data/####/690293644912.49
/data/data/####/690293644912.49 (deleted)
/data/data/####/690293645175.142
/data/data/####/690293645175.142 (deleted)
/data/data/####/690293645318.046
/data/data/####/690293645318.046 (deleted)
/data/data/####/690293645471.965
/data/data/####/690293645471.965 (deleted)
/data/data/####/690293645524.245
/data/data/####/690293645524.245 (deleted)
/data/data/####/690293645651.929
/data/data/####/690293645651.929 (deleted)
/data/data/####/690293646874.615
/data/data/####/690293646874.615 (deleted)
/data/data/####/889.37042982576
/data/data/####/889.37042982576 (deleted)
/data/data/####/889.414950493276
/data/data/####/889.414950493276 (deleted)
/data/data/####/889.459471160793
/data/data/####/889.459471160793 (deleted)
/data/data/####/889.503991828309
/data/data/####/889.503991828309 (deleted)
/data/data/####/889.548512495826
/data/data/####/889.548512495826 (deleted)
/data/data/####/889.593033163343
/data/data/####/889.593033163343 (deleted)
/data/data/####/889.637553830859
/data/data/####/889.637553830859 (deleted)
/data/data/####/889.682074498376
/data/data/####/889.682074498376 (deleted)
/data/data/####/889.726595165892
/data/data/####/889.726595165892 (deleted)
/data/data/####/FrameCore.dex
/data/data/####/PaySDK-1.2.16.8-UR_yx.dex
/data/data/####/__gather_impl-35037019561516707141.dex (deleted)
/data/data/####/__gather_impl-35037019561516707141.jar
/data/data/####/__gather_impl.jar
/data/data/####/a.db
/data/data/####/a.db-journal
/data/data/####/andrcool.dex
/data/data/####/andrcool.jar
/data/data/####/cache-59501648561516321949
/data/data/####/cache97008240461516562456
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/dp.dex
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/getprop
/data/data/####/libgather.xml
/data/data/####/libzxsessionsafe.so
/data/data/####/logo_img_0.jpg
/data/data/####/maan.so
/data/data/####/mm_show_0_0.jpg
/data/data/####/mm_show_0_1.jpg
/data/data/####/mm_show_0_2.jpg
/data/data/####/mm_show_0_3.jpg
/data/data/####/mm_show_1_0.jpg
/data/data/####/mm_show_1_1.jpg
/data/data/####/mm_show_1_2.jpg
/data/data/####/mm_show_1_3.jpg
/data/data/####/mm_show_2_0.jpg
/data/data/####/mm_show_2_1.jpg
/data/data/####/mm_show_2_2.jpg
/data/data/####/mm_show_2_3.jpg
/data/data/####/mm_show_3_0.jpg
/data/data/####/mm_show_3_1.jpg
/data/data/####/mm_show_3_2.jpg
/data/data/####/mm_show_4_0.jpg
/data/data/####/mm_show_4_1.jpg
/data/data/####/mm_show_4_2.jpg
/data/data/####/mm_show_5_0.jpg
/data/data/####/mm_show_5_1.jpg
/data/data/####/mm_show_5_2.jpg
/data/data/####/mm_show_6_0.jpg
/data/data/####/mm_show_6_1.jpg
/data/data/####/mm_show_6_2.jpg
/data/data/####/pg_1.png
/data/data/####/pg_2.png
/data/data/####/pg_3.png
/data/data/####/pic_bg.png
/data/data/####/pic_mm_0.jpg
/data/data/####/pic_mm_1.jpg
/data/data/####/pic_mm_2.jpg
/data/data/####/pic_mm_3.jpg
/data/data/####/pic_mm_4.jpg
/data/data/####/pic_mm_5.jpg
/data/data/####/pic_mm_6.jpg
/data/data/####/pic_mm_7.jpg
/data/data/####/pid
/data/data/####/price1.jpg
/data/data/####/price3.png
/data/data/####/qy_db_pay
/data/data/####/qy_db_pay-journal
/data/data/####/qy_device_info_sdk_update.dex
/data/data/####/qy_device_info_sdk_update.jar
/data/data/####/qy_video_ad_sdk_update.dex
/data/data/####/qy_video_ad_sdk_update.jar
/data/data/####/story_btn_read.png
/data/data/####/tab1_0.png
/data/data/####/tab1_1.png
/data/data/####/tab2_0.png
/data/data/####/tab2_1.png
/data/data/####/tmp_jar
/data/data/####/tmp_so
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/unknown.xml
/data/data/####/video_brush_update.dex
/data/data/####/video_brush_update.jar
/data/data/####/web_page_sdk_update.dex
/data/data/####/web_page_sdk_update.jar
/data/data/####/webview.db
/data/data/####/webview.db-journal
/data/data/####/wzhge.vaqxo.ujpzf.fqcfb.dex
/data/data/####/wzhge.vaqxo.ujpzf.fqcfb.dex (deleted)
/data/data/####/wzhge.vaqxo.ujpzf.fqcfb.jar
/data/data/####/xUtils_http_cache.db
/data/data/####/xUtils_http_cache.db-journal
/data/data/####/xUtils_http_cache.db-shm
/data/data/####/xUtils_http_cache.db-shm (deleted)
/data/data/####/xUtils_http_cache.db-wal
/data/data/####/xUtils_http_cookie.db
/data/data/####/xUtils_http_cookie.db-journal
/data/data/####/xUtils_http_cookie.db-shm
/data/data/####/xUtils_http_cookie.db-shm (deleted)
/data/data/####/xUtils_http_cookie.db-wal
/data/data/####/zxsessionsafe.so
/data/data/####/zxsessionsafe_stub
/data/media/####/.cfg
/data/media/####/0077b0b9d3a9e760e044ae5e70eb82af
/data/media/####/031f04ef44c86d37888b9206208ab7ff
/data/media/####/06446245e593f9d9bc89fec5a192bedb
/data/media/####/0da23ff645f2e053320ac317d0c3ea03
/data/media/####/1.txt.tmp
/data/media/####/10.txt.tmp
/data/media/####/11.txt.tmp
/data/media/####/110b6dcd7a403d3581b21c2d9d50f95c
/data/media/####/12.txt.tmp
/data/media/####/13.txt.tmp
/data/media/####/14.txt.tmp
/data/media/####/15.txt.tmp
/data/media/####/16.txt.tmp
/data/media/####/2.txt.tmp
/data/media/####/290c214b5f03667c8bf170d2f2774a35
/data/media/####/2af4ff65c2017cf6ec89704b95bf271e
/data/media/####/3.txt.tmp
/data/media/####/300f50dfb16e035d7ba2ebd4753b36b8
/data/media/####/352e1c2a860c012c143eafd844aaa51c
/data/media/####/4.txt.tmp
/data/media/####/473b48f53f7038405c018abda27a3180
/data/media/####/4e4083c6fb2bf0bce04ddda381ea9ae9
/data/media/####/5.txt.tmp
/data/media/####/595f809607f0a19163a4112716797b83
/data/media/####/6.txt.tmp
/data/media/####/614b01e4628d6b78f36743a3105948fe
/data/media/####/63029866ee40aec55f3e866cde66d0bf
/data/media/####/63029866ee40aec55f3e866cde66d0bf.tmp
/data/media/####/641396e85bf54468fe7cee3296fab1be
/data/media/####/7.txt.tmp
/data/media/####/716cfa58720efdfaf2589aa0c112698f
/data/media/####/8.txt.tmp
/data/media/####/806558c13876996c6f5e54b1e41a3e4c
/data/media/####/848ed7751aff0d5238f40b664d204db7
/data/media/####/85f430e3be446d87a3c5e331d5b8ab28
/data/media/####/87d14b378e828bdd35c3ccda8562333f
/data/media/####/897f47697ee1e6f740a2bff65a9d1b9e
/data/media/####/8acf08558ad9a62966ddb70b9a7b29a0
/data/media/####/8dbc4960b2e51ae3d2d4175f8d102d17
/data/media/####/8f2b2c56c46d8e425f913e023353dde7
/data/media/####/9.txt.tmp
/data/media/####/98ea1c8943e60c77d0ffecdc4c902aeb
/data/media/####/FrameCore.jar
/data/media/####/com.gzlok.papa.showyc.png.tmp
/data/media/####/d40e439f27b40b77a6b95fd00d9a3801
/data/media/####/device
/data/media/####/df7c3d0df89d1ca6b71f972428fc93fa
/data/media/####/dp.jar.tmp
/data/media/####/edad1633b901054153874e76428d3ddc
/data/media/####/sysid.dat

Miscellaneous:

Executes next shell scripts:

app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.google.android.gms.analytics.CampaignTrackingService
cat /sys/block/mmcblk0/device/cid
chmod 777 <Package Folder>/lib/helper
dd if=<Package Folder>/lib/libhelper.so of=<Package Folder>/lib/helper
df
getprop
ls -l /system/bin/su
ps | grep <Package>
sh

Loads the following dynamic libraries:

libhelper
libsmsmanager
libzxsessionsafe
libzxvps

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES-ECB-NoPadding

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Gains access to information about running applications.

Displays its own windows over windows of other applications.

Parses information from SMS messages.

Gains access to information about sent/received SMS messages.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial