Android.SmsSend.24146

Technical information

Malicious functions:

Sends SMS messages:

17688729107: //sberbank.ru/sms/h1
17688729107: <SMS Content>
17688729107: VISA1074 Баланс: 4669.07р. Подробности в мобильном приложении http:
17688729107: 温馨提示:您手机[<Phone Number>]处于安全状态中请放心使用....

Intercepts incoming SMS messages and terminates the process of their transmission to handlers of other applications.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) m.0####.com:80
TCP(HTTP/1.1) www.0####.com:80

DNS requests:

m.0####.com
www.0####.com

HTTP GET requests:

m.0####.com/
m.0####.com/a/top/
m.0####.com/e/tags/?tagname=####
m.0####.com/jiroushuaige/
m.0####.com/jiroushuaige/1255.html
m.0####.com/oumeishuaige/22341.html
m.0####.com/rihanshuaige/
m.0####.com/rihanshuaige/22602.html
m.0####.com/rihanshuaige/22602_2.html
m.0####.com/rihanshuaige/22602_3.html
m.0####.com/style/css/css.css
m.0####.com/style/images/logo.png
m.0####.com/style/images/morelist.png
m.0####.com/style/js/backToTop.js
m.0####.com/style/js/show.js
m.0####.com/zhongguoshuaige/22614.html
m.0####.com/zhongguoshuaige/22614_2.html
m.0####.com/zhongguoshuaige/22614_3.html
m.0####.com/zhongguoshuaige/22614_4.html
m.0####.com/zhongguoshuaige/22615.html
m.0####.com/zhongguoshuaige/22616.html
m.0####.com/zhongguoshuaige/22616_2.html
www.0####.com/d/file/20161228/1-16122R25Q4.jpg
www.0####.com/d/file/20161229/1-161229224501.jpg
www.0####.com/d/file/20170330/1-1F330153I9.jpg
www.0####.com/d/file/20170331/42554fc226a18c897851165de9fd29af.jpg
www.0####.com/d/file/20170405/799022b21c23c39a42b3eb15e5137d86.jpg
www.0####.com/d/file/20170414/1-1F414144137.jpg
www.0####.com/d/file/20170414/1-1F414144Z1.jpg
www.0####.com/d/file/20170414/1-1F414145631.jpg
www.0####.com/d/file/20170731/1-1FI1145506.jpg?x-oss-process=####
www.0####.com/d/file/20170802/1-1FP2162A0.jpg?x-oss-process=####
www.0####.com/d/file/20170803/1-1FP3211424.jpg?x-oss-process=####
www.0####.com/d/file/20170804/1-1FP4112437.jpg
www.0####.com/d/file/20170804/1-1FP4112437.jpg?x-oss-process=####
www.0####.com/d/file/20171004/0P61I434_0.jpg
www.0####.com/d/file/20171015/c7edaf8ad6a209a49e2d298c5b544898.jpg
www.0####.com/d/file/20171024/0P13N424_0.jpg
www.0####.com/d/file/20180314/0P54cQ8_0.jpg
www.0####.com/d/file/20180322/0P0435C7_0.jpg
www.0####.com/d/file/20180513/1-1P513105533.jpg
www.0####.com/d/file/20180513/1-1P513111648.jpg
www.0####.com/d/file/20180514/1-1P514092507.jpg
www.0####.com/d/file/20180514/1-1P514093521.jpg
www.0####.com/d/file/20180515/1-1P325103133.jpg
www.0####.com/d/file/20180515/1-1P515110553.jpg
www.0####.com/d/file/20180517/1-1P51F92G1.jpg
www.0####.com/d/file/20180517/1-1P51F92Q5.jpg
www.0####.com/d/file/20180521/1-1P521091423.jpg
www.0####.com/d/file/20180524/1-1P524094224.jpg
www.0####.com/d/file/20180526/1-1P5260S430.jpg
www.0####.com/d/file/20180526/1-1P5260S936.jpg
www.0####.com/d/file/20180526/1-1P5260S936.jpg?x-oss-process=####
www.0####.com/d/file/20180526/1-1P5260U203.jpg
www.0####.com/d/file/20180529/1-1P52ZZ216.jpg
www.0####.com/d/file/20180529/1-1P52ZZ216.jpg?x-oss-process=####
www.0####.com/d/file/20180529/1-1P52ZZ952.jpg
www.0####.com/d/file/20180529/1-1P52ZZ952.jpg?x-oss-process=####
www.0####.com/d/file/20180529/1-1P52ZZ953-50.jpg
www.0####.com/d/file/20180529/1-1P52ZZ953.jpg
www.0####.com/d/file/20180530/1-1P530111229.jpg
www.0####.com/d/file/20180530/1-1P530112205.jpg
www.0####.com/d/file/20180531/1-1P5310PA4.jpg
www.0####.com/d/file/20180531/1-1P5310PA4.jpg?x-oss-process=####
www.0####.com/d/file/20180531/1-1P5310R229.jpg
www.0####.com/d/file/20180601/1-1P6010J427.png
www.0####.com/d/file/20180601/1-1P6010J427.png?x-oss-process=####
www.0####.com/d/file/20180601/1-1P6010K237.png
www.0####.com/d/file/20180601/1-1P6010K242.png
www.0####.com/d/file/20180601/1-1P6010K308.png
www.0####.com/d/file/20180601/1-1P6010K318.png
www.0####.com/d/file/20180601/1-1P6010P212.png
www.0####.com/d/file/20180601/1-1P6010P212.png?x-oss-process=####
www.0####.com/d/file/20180601/1-1P6010P319.png
www.0####.com/d/file/20180601/1-1P6010PU5.png
www.0####.com/d/file/20180601/1-1P6010PU5.png?x-oss-process=####
www.0####.com/d/file/20180601/1-1P6010Q502.png
www.0####.com/d/file/20180601/1-1P6010Q502.png?x-oss-process=####
www.0####.com/d/file/20180613/1-1P6130AR6.png
www.0####.com/d/file/20180615/1-1P615055553.png
www.0####.com/d/file/20180615/1-1P615062129.png
www.0####.com/d/file/20180615/1-1P615064628.png
www.0####.com/d/js/acmsd/thea10.js
www.0####.com/d/js/acmsd/thea11.js
www.0####.com/d/js/acmsd/thea5.js
www.0####.com/d/js/acmsd/thea6.js
www.0####.com/d/js/acmsd/thea7.js
www.0####.com/d/js/acmsd/thea8.js
www.0####.com/d/js/acmsd/thea9.js

Modified file system:

Creates the following files:

/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/index
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal

Miscellaneous:

Contains functionality to send SMS messages automatically.

Gains access to telephone information (number, imei, etc.).

Displays its own windows over windows of other applications.

Parses information from SMS messages.

Gains access to information about sent/received SMS messages.

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical information

Recommandations pour le traitement

Free trial