Android.SmsSpy.6518

Technical information

Malicious functions:

Sends SMS messages:

106904006189121: myqxt<IMSI>

Executes code of the following detected threats:

Android.DownLoader.441.origin
Android.SmsSend.21305
Android.Spy.398.origin
Android.Triada.235.origin
Android.Triada.236.origin
Android.Triada.243
Android.Triada.248.origin
Android.Triada.351.origin
Android.Triada.373.origin

Sends data on received text messages to remote host.

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) pay.lik####.com:7820
TCP(HTTP/1.1) jx.ha####.com:80
TCP(HTTP/1.1) a####.xctr####.com:12580
TCP(HTTP/1.1) x####.ha####.com:80
TCP(HTTP/1.1) 1####.27.154.102:1234
TCP(HTTP/1.1) pay.lik####.com:7830
TCP(HTTP/1.1) dws.you####.com:8080
TCP(HTTP/1.1) pus####.to####.net:80
TCP(HTTP/1.1) pay.lik####.com:7840
TCP(HTTP/1.1) s####.ha####.com:9999
TCP(HTTP/1.1) wap.n.sh####.com:80
TCP(HTTP/1.1) jx####.ha####.com:9999
TCP(TLS/1.0) ti####.jom####.com:443
TCP(TLS/1.0) hpd.b####.com:443
TCP(TLS/1.0) t.y####.cn.####.com:443
TCP(TLS/1.0) ss0.b####.com:443
TCP(TLS/1.0) i####.y####.cn.####.com:443
TCP(TLS/1.0) t####.y####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) g####.bdst####.com:443
TCP(TLS/1.0) wap.n.sh####.com:443

DNS requests:

a####.xctr####.com
api.lik####.com
do####.abc####.info
dws.you####.com
g####.bdst####.com
hm.b####.com
hpd.b####.com
i####.y####.cn
jx####.ha####.com
jx.ha####.com
m.b####.com
pay.lik####.com
pus####.to####.net
pus####.tou####.cn
s####.ha####.com
ss0.b####.com
ss1.b####.com
ss2.b####.com
t####.y####.com
t.y####.cn
ti####.b####.com
timg####.b####.com
up####.abc####.info
x####.ha####.com

HTTP GET requests:

a####.xctr####.com:12580/log2?c=####
dws.you####.com:8080/upload/plugin/net.tt.plugin.damai_p20180419140117
dws.you####.com:8080/upload/plugin/net.tt.plugin.miwan_p20180419121516
dws.you####.com:8080/upload/plugin/net.tt.plugin.myadv_p20170525153846
dws.you####.com:8080/upload/plugin/net.tt.plugin.mysdk_p20180601142521
dws.you####.com:8080/upload/plugin/net.tt.plugin.qipa_p20180516110806
dws.you####.com:8080/upload/plugin/net.tt.plugin.shangan_p20180419135910
dws.you####.com:8080/upload/plugin/net.tt.plugin.taiku_p20171208142002
dws.you####.com:8080/upload/plugin/net.tt.plugin.utadv_p20170814102220
dws.you####.com:8080/upload/plugin/net.tt.plugin.yufeng_p20171122152409
dws.you####.com:8080/upload/plugin/net.tt.plugin.zhongzhi_p20180516114555
jx####.ha####.com:9999/main/checkAppInfo.do?IMSI=####&V=####&mobile=####...
jx####.ha####.com:9999/main/uploadDeviceInfo.do?IMSI=####&V=####&mobile=...
jx####.ha####.com:9999/page/getPageContent.do?IMSI=####&V=####&imei=####...
jx####.ha####.com:9999/sms/submit.do?imsi=####&feechanid=####&sms=####&f...
jx.ha####.com/SdkNotity.aspx?i=####&v=####&c=####&av=####&dm=####&t=####...
pay.lik####.com:7820/?igtcmd=####&gameid=####
pay.lik####.com:7830/openplg?appid=####&channelid=####
pay.lik####.com:7840/gselfc?iccid=####&price=####&imsi=####&imei=####&ap...
pay.lik####.com:7840/gselfpi?appid=####&channel=####
pus####.to####.net/czfiles/plugindp
s####.ha####.com:9999/log/stat.do?i=####&v=####&c=####&av=####&dm=####&t...
wap.n.sh####.com/
x####.ha####.com/getconfig.aspx
x####.ha####.com/getjar.aspx?pno=####
x####.ha####.com/versioncheck.aspx

HTTP POST requests:

pay.lik####.com:7820/

Modified file system:

Creates the following files:

/data/data/####/57CSXG4AkRf8mBYZ.zip
/data/data/####/67FrdcF4gl2hImERCnpAug==.new
/data/data/####/DATA_DB-journal
/data/data/####/KooVrmclnZxDD3BodBEzDw==.new
/data/data/####/LGXEUljdGWi27Y-ctaxaHg==
/data/data/####/Signature_0.key
/data/data/####/a0c175d0.apk
/data/data/####/appStatus.xml
/data/data/####/b2f11355-31ec-4375-be35-c09cfc1f424a.zip
/data/data/####/base-1.apk
/data/data/####/base-1.dex
/data/data/####/base-1.dex (deleted)
/data/data/####/be3a0631-3bb6-475f-8b0c-aacb2bd47d77.zip
/data/data/####/cb477faf770168939f9c2d02381135c0.apk
/data/data/####/config.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/dbinfo.xml
/data/data/####/done
/data/data/####/dp.apk
/data/data/####/eOaNAKS7ZFL-EL5m7K1DVQ==
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/heajva_f.zip
/data/data/####/index
/data/data/####/libcocos2dcpp.so
/data/data/####/libcrypt_sign.so
/data/data/####/libgoldcoast.so
/data/data/####/libkjOnlinePay.so
/data/data/####/n2-lXTPq9At8Dxrw
/data/data/####/net.tt.plugin.damai (deleted)
/data/data/####/net.tt.plugin.damai.apk
/data/data/####/net.tt.plugin.miwan (deleted)
/data/data/####/net.tt.plugin.miwan.apk
/data/data/####/net.tt.plugin.myadv (deleted)
/data/data/####/net.tt.plugin.myadv.apk
/data/data/####/net.tt.plugin.mysdk (deleted)
/data/data/####/net.tt.plugin.mysdk.apk
/data/data/####/net.tt.plugin.qipa (deleted)
/data/data/####/net.tt.plugin.qipa.apk
/data/data/####/net.tt.plugin.shangan (deleted)
/data/data/####/net.tt.plugin.shangan.apk
/data/data/####/net.tt.plugin.taiku (deleted)
/data/data/####/net.tt.plugin.taiku.apk
/data/data/####/net.tt.plugin.utadv (deleted)
/data/data/####/net.tt.plugin.utadv.apk
/data/data/####/net.tt.plugin.yufeng (deleted)
/data/data/####/net.tt.plugin.yufeng.apk
/data/data/####/net.tt.plugin.zhongzhi (deleted)
/data/data/####/net.tt.plugin.zhongzhi.apk
/data/data/####/plugin.jar
/data/data/####/rdata_comwjkziukz.new
/data/data/####/runtimeConfig.xml
/data/data/####/smsJx_v4_2.xml
/data/data/####/tmp.Sj2070
/data/data/####/tmp.wH2070
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/wochi_v4.db-journal
/data/media/####/.config

Miscellaneous:

Executes next shell scripts:

/system/bin/netcfg
chmod -R 755 <Package Folder>/Plugin
ls -l /system/bin/su

Loads the following dynamic libraries:

gtsxhlvj
taqgemlz

Uses the following algorithms to encrypt data:

DES-ECB-NoPadding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
DESede

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

Parses information from SMS messages.

Gains access to information about sent/received SMS messages.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial