Android.SmsSend.17854

Technical information

Malicious functions:

Sends SMS messages:

106584211: 5fd3bec6c0a86a604200201060886070M302000A免费登录短信，请勿修改

Network activity:

Connecting to:

s####.####.com
7x####.####.com
c-h####.####.com
obf0c####.####.com
w####.####.com
1####.####.195
d####.####.com:8083
boo####.####.cn
m####.####.com
a####.####.com

HTTP GET requests:

boo####.####.cn/tdata_tcA311
boo####.####.cn//pubres/picture/show_img/xinshufree.jpg
boo####.####.cn/pubres/picture/show_img/yinengnn.jpg
boo####.####.cn/pubres/picture/LoadingPage/-209853654156563477.jpg
boo####.####.cn/cppartner/1x1/11x0/110x0/11000077626/11000077626.jpg
obf0c####.####.com/visenvt9_9_20160808104730.zip
boo####.####.cn/pubres/picture/show_img/wanbenfree.jpg
boo####.####.cn/cppartner/1x1/11x0/110x0/11000074446/11000074446.jpg
w####.####.com/sso/p/logindata.jsp?e_l=9&purl=/r/p/myspacedata.jsp?aaa_f...
boo####.####.cn/cppartner/1x1/11x0/110x0/11000028085/11000028085.jpg
boo####.####.cn/cppartner/1x1/11x0/110x0/11000028142/11000028142.jpg
boo####.####.cn/cppartner/1x1/11x0/110x0/11000006280/11000006280.jpg
boo####.####.cn/cppartner/1x1/11x0/110x0/11000079573/11000079573.jpg
boo####.####.cn/cppartner/1x1/11x0/110x0/11000049442/11000049442.jpg
boo####.####.cn//pubres/picture/show_img/wanbenfree.jpg
s####.####.com/config/hz-hzv3.conf
boo####.####.cn/cppartner/1x1/11x0/110x0/11000072603/11000072603.jpg
w####.####.com/r/p/myspacedata.jsp?vt=####&aaa_flag=####
boo####.####.cn/cppartner/1x1/11x0/110x0/11000031727/11000031727.jpg
boo####.####.cn/cppartner/1x1/11x0/110x0/11000002838/11000002838.jpg
boo####.####.cn/cppartner/1x1/11x0/110x0/11000001468/11000001468.jpg
boo####.####.cn/cppartner/1x1/11x0/110x0/11000000377/11000000377.jpg
w####.####.com/r/?vt=####&cm=####&aaa_flag=####
boo####.####.cn/cppartner/1x1/11x0/110x0/11000069434/11000069434.jpg
7x####.####.com/zip/payjar_-1_20170418211225.zip
boo####.####.cn/cppartner/1x1/11x0/110x0/11000003116/11000003116.jpg
boo####.####.cn/cppartner/1x1/11x0/110x0/11000008173/11000008173.jpg
boo####.####.cn/pubres/picture/show_img/xinshufree.jpg
boo####.####.cn/tdata_DBk687
boo####.####.cn/cppartner/1x1/11x0/110x0/11000079588/11000079588.jpg
boo####.####.cn/tdata_lqw967
boo####.####.cn//pubres/picture/show_img/yinengnn.jpg

HTTP POST requests:

s####.####.com/api.php?format=####&t=####
a####.####.com/app_logs
1####.####.195/asg/portal.do
m####.####.com/gateway.do
c-h####.####.com/api.php?format=####&t=####
d####.####.com:8083/useractive

Modified file system:

Creates the following files:

/sdcard/.ishugui/K101651cache_web/cache_199/html.js
/data/data/####/files/init.pid
/sdcard/.ishugui/Cache/4lj7wje99e97cpd0nis07so6o
/data/data/####/shared_prefs/Cookies250026699187743.xml
/sdcard/.ishugui/Cache/6tyrfx09yvxe89nomzh4qvqr1
/sdcard/.ishugui/Cache/69wo8vcgarwlcglgafesa5jwy
/sdcard/.ishugui/books/11000001870/793704.kf
/sdcard/.ishugui/Cache/1m8b2oznq4gej0qh7rb4mkff
/sdcard/.ishugui/Cache/lf3vt0jmi0uwkel5x79zbwmw
/sdcard/.ishugui/Cache/c8v4ui3g6x68afbnhsssqumg
/sdcard/.ishugui/books/11000001253/bookinfo.bat
/data/data/####/databases/dbqzmc-journal
/sdcard/.ishugui/Cache/2y62l1ihdg2gi1itjwaf7om15
/sdcard/.ishugui/books/11000001912/856445.kf
/sdcard/.ishugui/Cache/39ykagtyuunh7h4yekxtc78ju
/data/data/####/databases/pushg.db-journal
/sdcard/.ishugui/K101651cache_web/cache_199/html.css
/sdcard/libs/####.db
/data/data/####/databases/webview.db-journal
/data/data/####/files/100400022600UploadUserBehavior.dat
/sdcard/.ishugui/books/11000000439/bookinfo.bat
/data/data/####/files/tdata_DBk687.tmp
/sdcard/.ishugui/books/11000000439/244038.kf
/data/data/####/files/tdata_DBk687.jar
/sdcard/.ishugui/Cache/wdcs0kmxtpkioff6mea8zox1
/data/data/####/databases/increment.db-journal
/data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
/sdcard/.system/confv9/visen.conf
/data/data/####/files/mobclick_agent_cached_####1010305
/data/data/####/files/run.pid
/sdcard/.ishugui/empty.system
/data/data/####/files/gdaemon_20161017
/sdcard/.ishugui/books/11000001976/ex_info.kf
/data/data/####/shared_prefs/gx_sp.xml
/data/data/####/app_temp/libcryto_zywx.so
/data/data/####/files/tdata_lqw967.jar
/data/data/####/files/tdata_tcA311.tmp
/data/data/####/app_libs/libcryto_zywx.so
/sdcard/.ishugui/books/11000000271/bookinfo.bat
/sdcard/.ishugui/Cache/6ky1tiljftav7srng2ahybd48
/sdcard/.ishugui/books/11000001251/392144.kf
/data/data/####/shared_prefs/conf_sp_name.xml
/data/data/####/shared_prefs/myepay.xml
/sdcard/system/tmp/local/tdata_lqw967
/sdcard/.ishugui/payerr.txt
/data/data/####/databases/pushgdm.db-journal
/sdcard/.ishugui/cover/K101651.cover.tmp
/sdcard/.system/confv9/visen.conf.temp
/sdcard/.ishugui/books/11000001912/bookinfo.bat
/sdcard/.ishugui/Cache/2oifxrykm65nmkcla9n5i0v1f
/sdcard/.ishugui/books/11000000271/ex_info.kf
/sdcard/.ishugui/Cache/1ipydlsd7ga2pl6937pexsj3
/sdcard/system/tmp/local/tdata_DBk687
/data/data/####/files/umeng_it.cache
/sdcard/.ishugui/Cache/6dxymx188mgy7f152s9pdz4rn
/sdcard/iapppay/statistics/####/statistics.log
/sdcard/.ishugui/books/11000001870/ex_info.kf
/sdcard/.ishugui/books/11000000271/188288.kf
/sdcard/.ishugui/Cache/1k2fpa5y595w2rpb2wwvxueyj
/sdcard/.ishugui/Cache/6yqqn0dd0d6lc9gcqrkr53bnd
/data/data/####/shared_prefs/ishugui.shareInfo.xml
/data/data/####/files/push.pid
/data/data/####/databases/pushsdk.db-journal
/sdcard/.ishugui/Cache/1r990ezk8ipw9tnxvpbjd2iom
/sdcard/.ishugui/books/11000000377/ex_info.kf
/sdcard/.ishugui/books/11000001253/ex_info.kf
/sdcard/.system/device/factory.dzt
/data/data/####/databases/ishugui.db-journal
/sdcard/.ishugui/K101651cache_web/cache_199/html.txt
/data/data/####/shared_prefs/ishugui.shareInfo.xml.bak
/sdcard/.ishugui/books/11000001870/bookinfo.bat
/data/data/####/shared_prefs/umeng_general_config.xml
/sdcard/system/tmp/local/tdata_tcA311
/sdcard/.system/confv9/visen.conf.mark
/sdcard/.ishugui/books/11000001912/ex_info.kf
/sdcard/.ishugui/Cache/c7bxhl67yxy9nkbxv9o07ol2
/data/data/####/files/defrayPriority100400022600250026699187743.dat
/data/data/####/shared_prefs/iapppay_config.xml
/sdcard/.ishugui/Cache/zz7pqgj0w4olea9bf319ig5i
/sdcard/.ishugui/Cache/4xh9shomixhzzg10oso3byx7l
/sdcard/.ishugui/.log/mianfei-xiaoshagiopwieqt_log.txt
/sdcard/.ishugui/Cache/5y8w1wh5ldd9zhqxz1cl8e3hs
/data/data/####/files/DownloadBillingList_100400022600_00000848_000000003288_250026699187743unanaly
/data/data/####/files/tdata_tcA311.jar
/sdcard/.ishugui/Cache/6c8xwxiax1a2czerr2kh9et53
/sdcard/.ishugui/Cache/5m9ebh0mx2uxx7yxrg0sc95tw
/sdcard/.ishugui/books/11000000439/ex_info.kf
/sdcard/.ishugui/books/11000000377/227457.kf
/sdcard/libs/com.getui.sdk.deviceId.db
/data/data/####/shared_prefs/####_preferences.xml
/sdcard/.ishugui/books/11000001251/bookinfo.bat
/sdcard/.ishugui/books/11000000377/bookinfo.bat
/data/data/####/app_tcxec/classes.jar
/data/data/####/files/tdata_lqw967.tmp
/data/data/####/databases/pushext.db-journal
/sdcard/.ishugui/Cache/7h5w8zhuwpgp1jvobylo6gzqe
/sdcard/libs/com.igexin.sdk.deviceId.db
/sdcard/zywx/MyEPay/default_dex/####/myepay_data.jar
/data/data/####/files/.imprint
/sdcard/.system/confv9/paydex.dzlib.temp
/sdcard/libs/app.db
/sdcard/.ishugui/books/11000001976/931538.kf
/sdcard/.ishugui/books/11000001251/ex_info.kf
/sdcard/.ishugui/Cache/5gn0giu4eiomi6tj755ierl9j
/sdcard/.ishugui/Cache/5zxmck24z1e5xc0t2glhaobfg
/sdcard/.ishugui/Cache/608par6idsz6ke40nbswt5no6
/data/data/####/shared_prefs/####_preferences.xml.bak
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/sdcard/.ishugui/cover/K101651.cover
/sdcard/.ishugui/books/11000001253/392410.kf
/sdcard/.ishugui/books/11000001976/bookinfo.bat
/data/data/####/shared_prefs/Cookies250026699187743.xml.bak
/sdcard/.ishugui/Cache/4zaujjex4502pz79kk4m6lp3w

Sets the 'executable' attribute to the following files:

/data/data/####/files/gdaemon_20161017

Miscellaneous:

Executes next shell scripts:

/data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 25874 300 0
chmod 700 /data/data/####/files/gdaemon_20161017

Contains functionality to send SMS messages automatically.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial