Android.SmsSend.16672

Malicious functions:

Sends SMS messages:

12114516412: maimobbxWWG2FbIpoTbyNWhB93rifpMCRj!YUw4wGcMttDx0IOq2gcNuqjCkkww51EMqVTIugn33FqNBDz2RQ!HzMv0UD
12114516412: maimobbvrWwDFuSpYDbXSW8l9dpibeMKJjLkUJRwE7MzZDUfIwb2dmNm6jwskFr55nMfwTwggKI3mPNVHzNgQMiz1E0NQ
12114516412: maimobb36WgMFFqpDzbhCWyE9PliVgMvXjZyUDLw1CM4!DK!Iqq2tmNurj1RkbM5gzM3rT0qgxi3trNIkznUQUyzdH0Gl

Network activity:

Connecting to:

HTTP GET requests:

w####.####.com/r/408109873/index.htm?ln=####&t1=####&srsc=####&cm=####&page=####&purl=####&nid=####&vt=####&dataSrcId=####&sqId=####
w####.####.com/r/l/n.jsp?nid=####&vt=####&ln=####&dataSrcId=####&sqId=####&cm=####
m####.####.com/p/retrieval_new.jsp?parentId=####&subClassId=####&ord=####&sort=####&dataSrcId=####&sqId=####&cm=####
w####.####.com/r/408109873/408113247.htm;jsessionid=C819BBDAEB92072F3C6F7830813BAA44.8ngFwnDIs.2.0?ln=####&nid=####&purl=####&page=####&vt=####
m####.####.com/course/387134.html?dataSrcId=####&sqId=####&cm=####

HTTP POST requests:

Modified file system:

Creates the following files:

/data/data/####/shared_prefs/CobubRazor_SharedPref.xml
/data/data/####/shared_prefs/TestinCrash.xml.bak
/data/data/####/files/ymsdk_01.jar
/sdcard/.comssgjby
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/shared_prefs/device_id.xml.xml
/data/data/####/databases/dataeye_database_C9034F0A2763EC373E918F17F4DB2C11.db-journal
/sdcard/.SystemService/DEID/####/oid
/data/data/####/shared_prefs/CobubRazor_SharedPref.xml.bak
/data/data/####/databases/TestinAgent.db-journal
/data/data/####/shared_prefs/dc.C9034F0A2763EC373E918F17F4DB2C11.preferences.xml
/data/data/####/databases/TestinAgent.db
/data/data/####/cache/cobub.cache
/data/data/####/databases/jrnewad3.db-journal
/data/data/####/shared_prefs/.tpns.xml.xml
/data/data/####/files/libymsdk_21035.so
/sdcard/.SystemService/C9034F0A2763EC373E918F17F4DB2C11/uid
/data/data/####/shared_prefs/device_id.xml
/data/data/####/files/comssgjby
/sdcard/Tencent/mta/.mid.txt
/data/data/####/databases/mp.db-journal
/data/data/####/databases/mp.db
/data/data/####/shared_prefs/JOYPUSH_PREFS.xml
/data/data/####/shared_prefs/dc.C9034F0A2763EC373E918F17F4DB2C11.preferences.xml.bak
/data/data/####/shared_prefs/TestinCrash.xml

Miscellaneous:

Executes next shell scripts:

/system/bin/sh
logcat -t 100 -v time
/data/data/####/lib/libtpnsWatchdog.so ####,2100183303;####,2100183303; 55612 203.205.128.130 [{"idx":0,"ts":%d,"et":2000,"si":0,"ui":"####","ky":"Axg%lu","mid":"51973416055ba38743fb9ebf05357ba5a88344c6","ev":{"ov":"18","sr
/data/data/####/lib/libtpnsWatchdog.so ####,2100183303; 55612 203.205.128.130 [{"idx":0,"ts":%d,"et":2000,"si":0,"ui":"####","ky":"Axg%lu","mid":"0","ev":{"ov":"18","sr":"800*552","md":"Generic Android-x86","lg":"en","sv":"2.42","

Contains functionality to send SMS messages automatically.