Android.SmsSend.21011

Technical information

Malicious functions:

Sends SMS messages:

1065888016: PT1@<IMSI>@1q0132
1065888016: TK
13800: 1

Network activity:

Connecting to:

1####.####.18
a####.####.com
gaand####.####.net
i####.####.com
m####.com
mi####.com
quanzh####.com
quanzh####.com:8088
s####.####.cn
t####.####.cn
v####.####.com
v####.####.com:8080

HTTP GET requests:

1####.####.18/sdk_controler/mobile-area?model=####&cellid=####&osbuild=#...
i####.####.com/a/315432f0c34a6005ff1c18a57a27f742e
m####.com/billing/20151215.apk
mi####.com/Info.ashx
s####.####.cn/sdkspserver/dxagainsend.action?fee=####&sid=####&imsi=####...
v####.####.com/VideoPalyInterface/GetPromoteInfo.aspx
v####.####.com:8080/VideoPalyInterface/GetPromoteInfo.aspx

HTTP POST requests:

a####.####.com/app_logs
gaand####.####.net/g/d?crc=####
i####.####.com/Info.ashx
quanzh####.com/MakeJoyJson/JsonRead
quanzh####.com:8088/MakeJoyJson/JsonRead
t####.####.cn/api/statis/315432f0c34a6005ff1c18a57a27f742e/game-5306B725...

Modified file system:

Creates the following files:

<Package Folder>/databases/lepeng.db-journal
<Package Folder>/databases/mpush_game.db-journal
<Package Folder>/databases/mydb
<Package Folder>/databases/mydb-journal
<Package Folder>/databases/sms_db
<Package Folder>/databases/sms_db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/.imprint
<Package Folder>/files/QPAY.apk
<Package Folder>/files/libexec.so
<Package Folder>/files/libexecmain.so
<Package Folder>/files/mj.apk
<Package Folder>/files/mj.apkdata
<Package Folder>/files/mobclick_agent_cached_<Package>1
<Package Folder>/files/mpush_gateway_preferences_file
<Package Folder>/files/mpush_version_preferences_file
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/315432f0c34a6005ff1c18a57a27f742e|account_file.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/JunLinCacheData.xml
<Package Folder>/shared_prefs/JunLinCacheData.xml.bak
<Package Folder>/shared_prefs/STORE.xml
<Package Folder>/shared_prefs/STORE.xml.bak
<Package Folder>/shared_prefs/cache.xml
<Package Folder>/shared_prefs/cache.xml.bak
<Package Folder>/shared_prefs/mjpay.xml
<Package Folder>/shared_prefs/pay_shared_file.xml
<Package Folder>/shared_prefs/pref_file.xml
<Package Folder>/shared_prefs/pref_file.xml.bak
<Package Folder>/shared_prefs/qpay.xml
<Package Folder>/shared_prefs/shared_file.xml
<Package Folder>/shared_prefs/sp.store.xml
<Package Folder>/shared_prefs/td_pefercen_profile.xml
<Package Folder>/shared_prefs/td_pefercen_profile.xml.bak
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/util_preference.xml
<SD-Card>/.tcookieid