Technical information
Malicious functions:
Sends SMS messages:
- 12114: HZSY#####
Executes code of the following detected threats:
- Android.SkyMobi.6.origin
- Android.Triada.155.origin
Network activity:
Connecting to:
- 1####.####.10:9090
- 1####.####.42:9091
- mo####.####.com
- 1####.####.10
- and####.####.com
- w####.####.com
- 1####.####.227:8080
- d####.####.net
- 1####.####.174
- 1####.####.227
- a####.####.com
- and####.####.com:8077
HTTP GET requests:
- d####.####.net/apkf/3rdapk2/M01/0F/ED/wKhklFi3kP6AenV0AAK1r2oCKfQ234.apk
- d####.####.net/apkf/3rdapk2/M01/0E/50/wKhklFhblTOAFDJdAADx6QcmZVE171.apk
- d####.####.net/apkf/3rdapk2/M01/0F/FB/wKhklVi9BSKAGGrJAAQail-YwhA993.apk
- d####.####.net/apkf/3rdapk2/M01/0E/50/wKhklFhbmYeALjHcAACxpWlURyc965.apk
- d####.####.net/apkf/3rdapk2/M00/02/CA/wKhklFcsNaiAAJnOAARvS9T3oS8756.apk
- d####.####.net/apkf/3rdapk2/M01/0F/8A/wKhklVib1VaAFGm5AAn7f81SmP0432.apk
- w####.####.com/r/p/index.jsp?vt=####&cm=####
HTTP POST requests:
- and####.####.com/zm-adv-mis/adv/list/query.do
- 1####.####.42:9091/genuser/000000000040
- 1####.####.227/sdkrp/api/report.do
- 1####.####.227:8080/websys/api/pay/getInfo.do
- and####.####.com/android/sms/netpay/prefetch.do
- 1####.####.10:9090/DownloadBillingList/1003/000000000040/2.8.4.4/00001031/0
- and####.####.com/query-plat/cap/query.do
- and####.####.com:8077/query-plat/cap/query.do
- 1####.####.227/websys/api/pay/getInfo.do
- 1####.####.174/download
- mo####.####.com/pay-sms-access//getAccessPayChannel.json
- a####.####.com/app_logs
- mo####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
- and####.####.com/android//sms/price/prefetch.do
- 1####.####.10/getMsgList/000000000407
- mo####.####.com/mobile-service/getOpenImsiMobilePhone.json
Modified file system:
Creates the following files:
- /data/data/####/SkyAdver_file/NotifyBarAdvResponse
- /data/data/####/app_workbench56440/apk.zip
- /data/data/####/app_plugin_dir/com.souying.tools.sms/1.0_1/base-1.apk
- /data/data/####/app_workbench39556/apk.zip
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.new.data.temp
- /data/data/####/files/mobclick_agent_cached_####2844
- /sdcard/IYouPay/IYouPay_error_log20170126_08-08-23.log
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/iyou/IYouPay/default_dex/####/iyoupay_data.jar
- /data/data/####/files/DownloadBillingList_100300062711_00001031_000000000040_250026699187743unanaly
- /data/data/####/databases/Data_sync.db-journal
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk
- /data/data/####/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
- /data/data/####/app_workbench34256/apk.zip
- /sdcard/crash/####/crash-1485418095293.log
- /data/data/####/app_apCoreplugn/sm.apk
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/PushDataReciveTime
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.new.data
- /data/data/####/files/libexec.so
- /data/data/####/app_apCoreplugn/smaip.apk
- /data/data/####/shared_prefs/Cocos2dxPrefsFile.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.new.data
- /data/data/####/app_workbench89822/apk.zip
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/NextReqInterval
- /data/data/####/app_apCoreplugn/smt.apk
- /data/data/####/files/eY1dSEzxeHv-xepuEtgGypg8u4qM-hZdBcyXRQ==/-97zV-H5qO3ee2tOXnltgw==.new
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/PushDataServerTime
- /data/data/####/app_workbench73018/apk.zip
- /data/data/####/files/eY1dSEzxeHv-xepuEtgGypg8u4qM-hZdBcyXRQ==/2R21ZwqV5CzgxR16tMG5wA==
- /data/data/####/app_workbench84150/apk.zip
- /data/data/####/files_main/key_AppPluginCapInfo
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/dalvik-cache/base-1.dex
- /data/data/####/cache/1485418095047.apk
- /data/data/####/files/DownloadBillingList_100300062711_00001031_000000000040_250026699187743analied.dat
- /data/data/####/files/libexecmain.so
- /data/data/####/SkyAdver_file/PushDataReciveTime
- /data/data/####/shared_prefs/com.souying.pay.xml
- /data/data/####/app_workbench45082/apk.zip
- /data/data/####/app_apCoreplugn/sn.apk
- /data/data/####/shared_prefs/iyouypay.xml
- /data/data/####/files/umeng_it.cache
- /data/data/####/databases/recordInfo-journal
- /data/data/####/app_apCoreplugn/ZIP/res-20160928-218-NewServer-NoHY.bin
- /data/data/####/shared_prefs/com.souying.pay.plugmain_p_config.xml
- /data/data/####/shared_prefs/iyouypay.xml.bak
- /data/data/####/app_workbench95348/apk.zip
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.data
- /data/data/####/shared_prefs/plugins.serviceMapping.xml
- /data/data/####/app_workbench67492/apk.zip
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.new.data.temp
- /data/data/####/app_plugin_dir/com.souying.net/1.0_1/base-1.apk
- /data/data/####/cache/1485418095297.apk
- /sdcard/Android/data/.nomedia
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yummysdk.new.apk
- /data/data/####/files/userBehavior/100300062711-170126
- /data/data/####/shared_prefs/plugins.installed.xml
- /data/data/####/shared_prefs/BOOT_SMS_SENT_TIME.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.new.data
- /data/data/####/shared_prefs/mainplugin_query.xml
- /data/data/####/app_workbench89676/apk.zip
- /data/data/####/files/classes.dex
- /data/data/####/databases/com.souying.pay.plugmain_sy_pay_record-journal
- /data/data/####/shared_prefs/Cocos2dxPrefsFile.xml.bak
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yummysdk.new.apk.temp
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_main/key_ServerPluginInfo
- /data/data/####/files/eY1dSEzxeHv-xepuEtgGypg8u4qM-hZdBcyXRQ==/m92XpkVhOzcE_ctKyFtf6g==/data.dat.tmp
- /data/data/####/cache/1485418094918.apk
- /data/data/####/shared_prefs/sy_pay_config.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/LatestPushIndex
- /data/data/####/files/eY1dSEzxeHv-xepuEtgGypg8u4qM-hZdBcyXRQ==/-JfMCZurvj4Gis-9RKHP6g==/fBUsxc3wmym-UcZXAtzfSQ==
- /data/data/####/files/eY1dSEzxeHv-xepuEtgGypg8u4qM-hZdBcyXRQ==/2R21ZwqV5CzgxR16tMG5wA==.new
- /data/data/####/SkyAdver_file/NextReqInterval
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.new.data.temp
- /data/data/####/app_plugin_dir/com.souying.tools.sms/1.0_1/dalvik-cache/base-1.dex
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.data
- /data/data/####/app_workbench78850/apk.zip
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.new.data.temp
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/files/rdata.new
- /data/data/####/files/.imprint
- /data/data/####/shared_prefs/mainplugin_query.xml.bak
- /data/data/####/files/tffaq_d/tffaq_f.zip
- /sdcard/IYouPay/IYouPay_error_log20170126_08-08-44.log
- /data/data/####/files/defrayPriority100300062711250026699187743.dat
- /data/data/####/app_workbench50914/apk.zip
- /data/data/####/files/rdata
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/NotifyBarAdvResponse
- /data/data/####/files_main/key_ServerPluginInfo
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.new.data
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk
- /data/data/####/app_temp/iyoupay.so
- /data/data/####/app_plugin_dir/com.souying.net/1.0_1/dalvik-cache/base-1.dex
- /data/data/####/files/eY1dSEzxeHv-xepuEtgGypg8u4qM-hZdBcyXRQ==/-JfMCZurvj4Gis-9RKHP6g==/ZcTtaHx_1RCAcr7t
- /data/data/####/shared_prefs/BOOT_SMS_INFO.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/user.sys
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/SkyAdver_file/PushDataServerTime
- /data/data/####/SkyAdver_file/LatestPushIndex
- /data/data/####/app_libs/iyoupay.so
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
- /data/data/####/files/rdata.old
- /data/data/####/cache/1485418094537.apk
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/dalvik-cache/base-1.dex
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.data.temp
Miscellaneous:
Executes next shell scripts:
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.data
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.data
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.data
- cat /proc/version
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
