Technical information
Malicious functions:
Sends SMS messages:
- 1069013312315: y####
Executes code of the following detected threats:
- Android.SkyMobi.5.origin
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- pl####.####.com
- 7x####.####.com
- p####.####.cn
- pr####.####.com
- and####.####.com:8077
HTTP GET requests:
- p####.####.cn/traffic-server/plug!plugSwitch.action?appId=####&channelId...
- 7x####.####.com/000002/paster
- pl####.####.com/20161220sy69.apk
HTTP POST requests:
- and####.####.com:8077/record-plat/seq/query.do
- p####.####.cn/prc-has/getImsiMobilePhone.json
- pr####.####.com/prc-has/getThirdPluginAccountInfo.json
- pr####.####.com/dynamicpay//getSyFormalChannels.json?
- p####.####.cn/stats.service
Modified file system:
Creates the following files:
- /data/data/####/databases/video_record-journal
- /data/data/####/databases/video_record
- /data/data/####/databases/p_db
- /sdcard/SYPAYFILENAME/CACHE/SMSCACHE/ISDELSMS
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.apk
- /data/data/####/app_workbench29976/apk.zip
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/ds_configer.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/files####/.libs/libhammer.so
- /sdcard/SAdAssets/game.properties
- /data/data/####/databases/p_db-journal
- /data/data/####/EOZTzhVG.jar
- /data/data/####/files####/.libs/libmy-ndk.so
- /data/data/####/databases/Data_sync.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/databases/statistics_db-journal
- /data/data/####/shared_prefs/config.xml
- /data/data/####/shared_prefs/p_config.xml
- /data/data/####/shared_prefs/config_ad.xml
- /data/data/####/app_workbench24450/apk.zip
- /data/data/####/files/syHello
- /data/data/####/shared_prefs/plugin_record_app_info.xml
- /data/data/####/databases/app_download_record-journal
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
- /data/data/####/databases/statistics_db
- /sdcard/SAdAssets/game20150817.apk
- /data/data/####/cache/webviewCacheChromium/index
Miscellaneous:
Executes next shell scripts:
- /system/bin/dexopt --dex 27 50 40 125092 /data/data/####/app_workbench29976/apk.zip 1251699796 1437815336 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
- /system/bin/dexopt --dex 27 40 40 1125364 /data/data/####/EOZTzhVG.jar 1220964898 -1455556798 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fra
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.apk
- chmod 777 /data/data/####/files/syHello
- /system/bin/dexopt --dex 27 54 40 80704 /data/data/####/app_workbench24450/apk.zip 1251699797 -2103829846 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/f
- sh
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
Contains functionality to send SMS messages automatically.
