Technical information
Malicious functions:
Sends SMS messages:
- 1069013312315: y####
Executes code of the following detected threats:
- Android.SkyMobi.5.origin
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- tra####.####.cn
- dynami####.####.com
- 7x####.####.com
- and####.####.com
- pl####.####.com
- p####.####.cn
- pr####.####.com
- and####.####.com:8077
HTTP GET requests:
- 7x####.####.com/000002/paster
- pl####.####.com/20161220sy69.apk
- tra####.####.cn/traffic-server/plug!plugSwitch.action?appId=####&channel...
HTTP POST requests:
- and####.####.com/record-plat/record/upload.do
- and####.####.com:8077/record-plat/seq/query.do
- tra####.####.cn/stats.service
- dynami####.####.com/dynamicpay//noteStats.json?
- dynami####.####.com/dynamicpay//getSyFormalChannels.json?
- pr####.####.com/prc-has/getThirdPluginAccountInfo.json
- p####.####.cn/prc-has/getImsiMobilePhone.json
Modified file system:
Creates the following files:
- /data/data/####/databases/video_record-journal
- /data/data/####/databases/video_record
- /data/data/####/databases/p_db
- /sdcard/SYPAYFILENAME/CACHE/SMSCACHE/ISDELSMS
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.apk
- /data/data/####/app_workbench07482/apk.zip
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/ds_configer.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/files####/.libs/libhammer.so
- /data/data/####/databases/p_db-journal
- /data/data/####/EOZTzhVG.jar
- /data/data/####/files####/.libs/libmy-ndk.so
- /data/data/####/databases/Data_sync.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/databases/statistics_db-journal
- /data/data/####/shared_prefs/config.xml
- /data/data/####/shared_prefs/p_config.xml
- /data/data/####/shared_prefs/config_ad.xml
- /data/data/####/app_workbench01956/apk.zip
- /data/data/####/files/syHello
- /data/data/####/shared_prefs/plugin_record_app_info.xml
- /data/data/####/databases/app_download_record-journal
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
- /data/data/####/databases/statistics_db
- /data/data/####/cache/webviewCacheChromium/index
Sets the 'executable' attribute to the following files:
- /data/data/####/files/syHello
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 56 40 80704 /data/data/####/app_workbench01956/apk.zip 1251699079 -2103829846 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.apk
- chmod 777 /data/data/####/files/syHello
- sh
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
- /system/bin/dexopt --dex 27 40 40 1125364 /data/data/####/EOZTzhVG.jar 1220916369 -1455556798 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fra
- /system/bin/dexopt --dex 27 48 40 125092 /data/data/####/app_workbench07482/apk.zip 1251699079 1437815336 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
Contains functionality to send SMS messages automatically.
