Android.SmsSpy.5694

Technical information

Malicious functions:

Sends SMS messages:

12114: HZSY#####

Executes code of the following detected threats:

Android.SkyMobi.6.origin
Android.Triada.155.origin
Android.Triada.226.origin

Sends data on received text messages to remote host.

Network activity:

Connecting to:

1####.####.10:9090
1####.####.42:9091
1####.####.10
and####.####.com
1####.####.227:8080
a####.####.com
d####.####.net
1####.####.174:9090
1####.####.227
mo####.####.com
and####.####.com:8077

HTTP GET requests:

d####.####.net/apkf/3rdapk2/M01/0F/ED/wKhklFi3kP6AenV0AAK1r2oCKfQ234.apk
d####.####.net/apkf/3rdapk2/M01/0E/50/wKhklFhblTOAFDJdAADx6QcmZVE171.apk
d####.####.net/apkf/3rdapk2/M01/0F/FB/wKhklVi9BSKAGGrJAAQail-YwhA993.apk
d####.####.net/apkf/3rdapk2/M01/0E/50/wKhklFhbmYeALjHcAACxpWlURyc965.apk
d####.####.net/apkf/3rdapk2/M00/02/CA/wKhklFcsNaiAAJnOAARvS9T3oS8756.apk
d####.####.net/apkf/3rdapk2/M01/0E/57/wKhklVhl8iuAPRONAASU16x8R3w033.apk
d####.####.net/apkf/3rdapk2/M01/0F/8A/wKhklVib1VaAFGm5AAn7f81SmP0432.apk

HTTP POST requests:

and####.####.com/record-plat/record/upload.do
and####.####.com/zm-adv-mis/adv/list/query.do
and####.####.com/android/third/prefetch/index.do
1####.####.227/sdkrp/api/report.do
1####.####.227:8080/websys/api/pay/getInfo.do
and####.####.com/android/sms/netpay/prefetch.do
and####.####.com/query-plat/cap/query.do
and####.####.com:8077/query-plat/cap/query.do
1####.####.227/websys/api/pay/getInfo.do
1####.####.10/getMsgList/000000000431
mo####.####.com/mobile-service/getOpenImsiMobilePhone.json
mo####.####.com/pay-sms-access//getAccessPayChannel.json
a####.####.com/app_logs
mo####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
and####.####.com/android//sms/price/prefetch.do
and####.####.com/record-plat/seq/query.do
1####.####.10:9090/DownloadBillingList/1003/000000000041/2.9.3.1/00001229/0
1####.####.174:9090/download
1####.####.42:9091/genuser/000000000041

Modified file system:

Creates the following files:

/data/data/####/SkyAdver_file/NotifyBarAdvResponse
/data/data/####/files/x4abfvPG-8L2W_M6TSlYTWTKJL_NKOmwrVyVKw==/LT5zP4sf1lT5Sq1d16PQHA==/2b8SMzU2F5rHbsE-.zip
/data/data/####/app_workbench92274/apk.zip
/data/data/####/app_plugin_dir/com.souying.tools.sms/1.0_1/base-1.apk
/data/data/####/files/x4abfvPG-8L2W_M6TSlYTWTKJL_NKOmwrVyVKw==/peYgRhzYZV8MkpCz-HtDiA==
/data/data/####/files/mobclick_agent_cached_####302931
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/files/.umeng/exchangeIdentity.json
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.thirdpay.new.data
/data/data/####/files/sbfyvq_d/sbfyvq_f.zip
/sdcard/iyou/IYouPay/default_dex/####/iyoupay_data.jar
/data/data/####/files/defrayPriority100300062711250026699187743.dat
/data/data/####/databases/Data_sync.db-journal
/data/data/####/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
/data/data/####/files/x4abfvPG-8L2W_M6TSlYTWTKJL_NKOmwrVyVKw==/v309RNId8l1sp5_bNgvu6w==/H2oVwD5AaaioWl72
/data/data/####/files/DownloadBillingList_100300062711_00001229_000000000041_250026699187743analied.dat
/data/data/####/app_apCoreplugn/sm.apk
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/PushDataReciveTime
/data/data/####/app_workbench86748/apk.zip
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.new.data
/data/data/####/files/libexec.so
/data/data/####/files/x4abfvPG-8L2W_M6TSlYTWTKJL_NKOmwrVyVKw==/v309RNId8l1sp5_bNgvu6w==/UUsOlFLSA_oJ8tkfCaDufw==
/data/data/####/app_apCoreplugn/smaip.apk
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.new.data
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/NextReqInterval
/data/data/####/app_apCoreplugn/smt.apk
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/PushDataServerTime
/data/data/####/app_workbench81222/apk.zip
/data/data/####/cache/1485418686411.apk
/data/data/####/files_main/key_AppPluginCapInfo
/data/data/####/app_workbench42234/apk.zip
/data/data/####/cache/1485418686952.apk
/data/data/####/files/libexecmain.so
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.new.data.temp
/sdcard/iyou/IYouPay/dex/####/temp.jar
/data/data/####/app_workbench47760/apk.zip
/data/data/####/SkyAdver_file/PushDataReciveTime
/data/data/####/shared_prefs/com.souying.pay.xml
/data/data/####/cache/1485418687463.apk
/data/data/####/shared_prefs/iyouypay.xml
/data/data/####/files/umeng_it.cache
/data/data/####/shared_prefs/plugin_record_app_info.xml
/data/data/####/databases/recordInfo-journal
/data/data/####/files/rdata_compalahaadaiah.new
/data/data/####/shared_prefs/com.souying.pay.plugmain_p_config.xml
/data/data/####/files/rdata_compalahaadaiah
/data/data/####/shared_prefs/iyouypay.xml.bak
/data/data/####/cache/1485418687202.apk
/data/data/####/app_plugin_dir/com.souying.net/1.0_1/dalvik-cache/base-1.dex
/data/data/####/shared_prefs/plugins.serviceMapping.xml
/data/data/####/files/x4abfvPG-8L2W_M6TSlYTWTKJL_NKOmwrVyVKw==/Xjw85JJXfKEOiu0Zc9UBpw==/data.dat.tmp
/data/data/####/app_workbench58892/apk.zip
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.new.data.temp
/data/data/####/app_plugin_dir/com.souying.net/1.0_1/base-1.apk
/sdcard/Android/data/.nomedia
/data/data/####/files/userBehavior/100300062711-170126
/data/data/####/shared_prefs/plugins.installed.xml
/data/data/####/shared_prefs/BOOT_SMS_SENT_TIME.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.new.data
/data/data/####/shared_prefs/mainplugin_query.xml
/data/data/####/files/classes.dex
/data/data/####/databases/com.souying.pay.plugmain_sy_pay_record-journal
/sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yummysdk.new.apk.temp
/sdcard/Android/data/com.skymobi.pay.newsdk/files_main/key_ServerPluginInfo
/data/data/####/app_workbench03326/apk.zip
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.thirdpay.new.data.temp
/data/data/####/app_apCoreplugn/sn.apk
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/LatestPushIndex
/data/data/####/files/x4abfvPG-8L2W_M6TSlYTWTKJL_NKOmwrVyVKw==/peYgRhzYZV8MkpCz-HtDiA==.new
/sdcard/IYouPay/IYouPay_error_log20170126_08-18-20.log
/data/data/####/shared_prefs/sy_pay_config.xml.bak
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.new.data.temp
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.data
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.new.data.temp
/data/data/####/databases/sy_pay_record-journal
/data/data/####/app_workbench53366/apk.zip
/data/data/####/app_workbench64418/apk.zip
/data/data/####/files/.imprint
/data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk
/data/data/####/files/DownloadBillingList_100300062711_00001229_000000000041_250026699187743unanaly
/sdcard/crash/####/crash-1485418687638.log
/data/data/####/app_workbench36708/apk.zip
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/NotifyBarAdvResponse
/data/data/####/files_main/key_ServerPluginInfo
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.new.data
/data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk
/data/data/####/app_temp/iyoupay.so
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.data
/data/data/####/shared_prefs/BOOT_SMS_INFO.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/user.sys
/data/data/####/app_apCoreplugn/ZIP/0
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/data/data/####/SkyAdver_file/PushDataServerTime
/data/data/####/SkyAdver_file/LatestPushIndex
/data/data/####/app_libs/iyoupay.so
/data/data/####/SkyAdver_file/NextReqInterval
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.data.temp
/data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/dalvik-cache/base-1.dex
/data/data/####/shared_prefs/pref_recomm.xml
/data/data/####/files/x4abfvPG-8L2W_M6TSlYTWTKJL_NKOmwrVyVKw==/-F2HKeHyjj9nG2itrc9uNQ==.new

Miscellaneous:

Executes next shell scripts:

chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.thirdpay.data
cat /proc/version

Uses special library to hide executable bytecode.

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial