Technical information
Malicious functions:
Sends SMS messages:
- 106575206321505460: dyl#####,####,6000089-1-1-6_kh29s0109_-0
- 12114: dyl#####,####,6000089-1-1-6_kh29s0109_-0
- 12114: HZSY#####
- 10690529113383: dyl#####,####,6000089-1-1-6_kh29s0109_-0
Executes code of the following detected threats:
- Android.Spy.205.origin
- Android.Triada.162
Downloads the following detected threats from the Web:
- Android.Triada.162
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- p####.####.cc
- 2####.####.134
- p####.####.com
- pa####.####.com
- c####.####.com
- w####.####.com
- collec####.####.com
- apm-col####.####.com
- greenxs####.net
- 2####.####.134:8080
- a####.####.com
- m####.####.cn
HTTP GET requests:
- greenxs####.net/resource!chargeUpdate?resTypes=####&dexId=####&dexVer=##...
- greenxs####.net/resource!resource?resTypes=####&appid=####&channel=####&...
- greenxs####.net/doking/smsd!hiGo.action?t=####&dexId=####&dexVer=####&ap...
- greenxs####.net/active!activeLog.action?provider=####&clickId=####&manu=...
- m####.####.cn/mtin.db.unacc_TH_2017011601.zip
- w####.####.com/rdo/order?mcpid=####&orderNo=####&feeCode=####&reqTime=##...
- p####.####.com/sdkMis/getRdoUrl
- w####.####.com/rdo/order/invalid;jsessionid=82A6B497A897B5A56D2506866A9E...
- m####.####.cn/mtin.db.shcut.zip
- c####.####.com/20170424/tongyu-pay-lib-2145-2.apk
HTTP POST requests:
- p####.####.com/sdkMis/sdk-update
- 2####.####.134/mtin/home
- greenxs####.net/shop/shop_upload_log
- p####.####.cc/index.php/API
- apm-col####.####.com/cpi/crash
- 2####.####.134:8080/mtin/home
- pa####.####.com/mobile-service/getOpenImsiMobilePhone.json
- pa####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
- p####.####.com/sdkMis/init-submit
- a####.####.com/app_logs
- pa####.####.com/pay-sms-access//getAccessPayChannel.json
- collec####.####.com/pay-data-collect/uploadClientCrashLog.json
Modified file system:
Creates the following files:
- /data/data/####/shared_prefs/gud.xml
- /data/data/####/shared_prefs/TestinCrash.xml.bak
- /data/data/####/cache/sms.apk.apk
- /sdcard/.twservice/qshp_3003_2247/tw
- /data/data/####/shared_prefs/sy_pay_config.xml.bak
- /data/data/####/files/noend.ini
- /data/data/####/files/com.dyl.pay.ui.apk
- /data/data/####/shared_prefs/device_id.xml.xml
- /data/data/####/shared_prefs/plugins.serviceMapping.xml
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/cpMsg.xml
- /data/data/####/databases/TestinAgent.db-journal
- /data/data/####/cache/crash/####/crash-1493728934453.log
- /sdcard/.tpservice/####/download/jar/qsha_80001_5094.jar
- /data/data/####/app_tongyu/plugins/download/tongyu-pay-lib.apk
- /data/data/####/shared_prefs/port.xml.bak
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/app_apCoreplugn/sms.apk
- /data/data/####/cache/smp.apk.apk
- /data/data/####/shared_prefs/port.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/plugins.installed.xml
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/dalvik-cache/base-1.dex
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/shared_prefs/dispatch_log.xml
- /data/data/####/files/.imprint
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk
- /data/data/####/databases/TestinAgent.db
- /data/data/####/databases/com.souying.pay.plugmain_sy_pay_record-journal
- /data/data/####/files/mobclick_agent_cached_####1
- /data/data/####/shared_prefs/getFlag.xml
- /data/data/####/databases/webview.db-journal
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk
- /data/data/####/shared_prefs/com.souying.pay.xml
- /data/data/####/app_apCoreplugn/smp.apk
- /sdcard/.twservice/qshp_3003_2247.zip
- /data/data/####/app_tongyu/plugins/tongyu-pay-lib.apk
- /data/data/####/cache/crash/####/crash-1493728889470.log
- /data/data/####/shared_prefs/twc.xml
- /data/data/####/databases/mp.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/databases/recordInfo-journal
- /data/data/####/shared_prefs/twc.xml.bak
- /data/data/####/databases/mp.db
- /data/data/####/files/mtin.db.unacc_TH_2017011601.zip
- /data/data/####/files/mtin.db.shcut.zip
- /data/data/####/shared_prefs/TestinCrash.xml
- /data/data/####/app_apCoreplugn/ZIP/plugin-20170105-2.1.8.6.1.bin
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/sy_pay_config.xml
- /data/data/####/shared_prefs/pretw.xml
- /data/data/####/shared_prefs/com.souying.pay.plugmain_p_config.xml
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 52 40 55028 /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk 1243976466 -8434925 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework
- logcat -t 100 -v time
- /system/bin/dexopt --dex 27 85 40 88924 /data/data/####/files/mtin.db.unacc_TH_2017011601.zip 1252291804 -692792220 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /
- cat /sys/block/mmcblk0/device/cid
- /system/bin/dexopt --dex 27 84 40 29808 /data/data/####/files/mtin.db.shcut.zip 1251825351 -1802210082 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
- /system/bin/dexopt --dex 27 57 40 119396 /data/data/####/app_tongyu/plugins/tongyu-pay-lib.apk 1244433845 2012307508 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar
- cat /proc/version
- /system/bin/dexopt --dex 27 51 40 213440 /storage/emulated/0/.tpservice/####/download/jar/qsha_80001_5094.jar 1248298237 -1297833896 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/fr
- /system/bin/dexopt --dex 27 52 40 134668 /data/data/####/app_tongyu/plugins/tongyu-pay-lib.apk 0 240775792 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
- /system/bin/dexopt --dex 27 58 40 266588 /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk 1243976482 -2093026819 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /sys
- cat /sys/class/net/wlan0/address
- /system/bin/dexopt --dex 27 81 40 134668 /data/data/####/app_tongyu/plugins/tongyu-pay-lib.apk 0 240775792 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fr
- /system/bin/dexopt --dex 27 64 40 273440 /storage/emulated/0/.twservice/qshp_3003_2247/tw.jar 1249136898 -1202193357 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
Contains functionality to send SMS messages automatically.
