Android.SmsSend.19999

Technical information

Malicious functions:

Sends SMS messages:

15121150845: #2016#40041&93066&<IMSI>&<IMEI>&<ICCID>

Executes code of the following detected threats:

Android.SkyMobi.6.origin
Android.SkyMobi.6.origin
Android.SkyMobi.6.origin

Downloads the following detected threats from the Web:

Android.SkyMobi.6.origin
Android.SkyMobi.6.origin
Android.SkyMobi.6.origin

Network activity:

Connecting to:

1####.####.181
and####.####.com
and####.####.com:8077
c####.####.com
l####.####.com
l####.####.com:9820
m####.####.com
w####.####.com

HTTP GET requests:

1####.####.181/Interface/SdkUserInterface.aspx?imsi=####&imei=####&iccid...
and####.####.com/3rd-access-android/image/show.do?imageName=####
m####.####.com/course/693628.html?dataSrcId=####&sqId=####&cm=####
w####.####.com/r/p/index.jsp?vt=####&cm=####

HTTP POST requests:

and####.####.com:8077/android/sms/netpay/prefetch.do
c####.####.com/uploadCrashLogInfo.do
l####.####.com/chnlt/ltpay/pytstart.do
l####.####.com:9820/chnlt/ltpay/pytstart.do

Modified file system:

Creates the following files:

<Package Folder>/.cache/version
<Package Folder>/app_workbench17218/apk.zip
<Package Folder>/app_workbench22518/apk.zip
<Package Folder>/app_workbench22824/apk.zip
<Package Folder>/app_workbench28044/apk.zip
<Package Folder>/app_workbench28350/apk.zip
<Package Folder>/app_workbench72784/apk.zip
<Package Folder>/app_workbench72944/apk.zip
<Package Folder>/app_workbench78310/apk.zip
<Package Folder>/databases/Data_sync.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/log1496213094470
<Package Folder>/files/####/log1496213107489
<Package Folder>/files/####/log1496213144917
<Package Folder>/files/classes.dex
<Package Folder>/files/libnesec.so
<Package Folder>/files/sec.lck
<Package Folder>/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
<Package Folder>/shared_prefs/BOOT_SMS_INFO.xml
<Package Folder>/shared_prefs/BOOT_SMS_SENT_TIME.xml
<Package Folder>/shared_prefs/CrashTimes.xml
<Package Folder>/shared_prefs/InitTag.xml
<Package Folder>/shared_prefs/IsSecondEx.xml
<Package Folder>/shared_prefs/IsSecondEx.xml.bak
<Package Folder>/shared_prefs/IsSecondEx.xml.bak (deleted)
<Package Folder>/shared_prefs/appstartone.xml
<Package Folder>/shared_prefs/appstarttwo.xml
<Package Folder>/shared_prefs/out.xml
<Package Folder>/shared_prefs/sdktype.xml
<Package Folder>/shared_prefs/uuid.xml
<Package Folder>/shared_prefs/ysec.xml
<Package Folder>/zyfadv/ad4083923264a6583a716b0724d0b789.img
<Package Folder>/zyfadv/c7a44900a7f1959b3eaf5a573371e8d3.img
<Package Folder>/zyfadv/response.data
<SD-Card>/Android/####/ad4083923264a6583a716b0724d0b789.img
<SD-Card>/Android/####/c7a44900a7f1959b3eaf5a573371e8d3.img
<SD-Card>/Android/####/com.lyhtgh.pay.ltplugin.apk
<SD-Card>/Android/####/com.skymobi.pay.plugin.main.apk
<SD-Card>/Android/####/com.skymobi.pay.plugin.recordupload.apk
<SD-Card>/Android/####/com.skymobi.pay.plugin.smspay.apk
<SD-Card>/Android/####/response.data
<SD-Card>/Android/####/user.sys
<SD-Card>/check/check
<SD-Card>/com/####/uid.sys

Miscellaneous:

Executes next shell scripts:

<dexopt>
chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.apk
chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.apk
logcat -d -v threadtime
ls -l /system/bin/su

Uses special library to hide executable bytecode.