Android.SmsSpy.10718

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.SmsSpy.677.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) gaand####.talking####.net:80
TCP(HTTP/1.1) q####.qi1####.com:14302

DNS requests:

gaand####.talking####.net
q####.qi1####.com
q####.qi1####.com

HTTP POST requests:

gaand####.talking####.net/g/d?crc=####
q####.qi1####.com:14302/sdk_login?t=####

File system changes:

Creates the following files:

/data/data/####/204696699187743;account_file.xml
/data/data/####/about_str.gifppic
/data/data/####/baidu
/data/data/####/bg_cover.mp3
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/chg_b_cl.gifppic
/data/data/####/chg_b_ok0.gifppic
/data/data/####/chg_b_ok1.gifppic
/data/data/####/chg_b_ok2.gifppic
/data/data/####/chg_gift0.gifppic
/data/data/####/chg_gift1.gifppic
/data/data/####/chg_gift2.gifppic
/data/data/####/chg_gift3.gifppic
/data/data/####/chg_gift4.gifppic
/data/data/####/chg_gift5.gifppic
/data/data/####/chg_gift6.gifppic
/data/data/####/chg_gift7.gifppic
/data/data/####/chg_gift8.gifppic
/data/data/####/chg_gift9.gifppic
/data/data/####/chg_kefu.gifppic
/data/data/####/chg_yuan.gifppic
/data/data/####/config.properties
/data/data/####/cover.gifppic
/data/data/####/cover_b0.gifppic
/data/data/####/cover_b1.gifppic
/data/data/####/cover_b2.gifppic
/data/data/####/cover_b3.gifppic
/data/data/####/cover_b4.gifppic
/data/data/####/cover_b5.gifppic
/data/data/####/cover_b6.gifppic
/data/data/####/cover_b7.gifppic
/data/data/####/cover_b8.gifppic
/data/data/####/cover_kefu.gifppic
/data/data/####/cover_name.gifppic
/data/data/####/cover_player_slot.gifppic
/data/data/####/ef_avatar.mp3
/data/data/####/ef_button0.mp3
/data/data/####/ef_devour.mp3
/data/data/####/ef_fail.mp3
/data/data/####/ef_spit.mp3
/data/data/####/ef_succ.mp3
/data/data/####/ef_timeless.mp3
/data/data/####/finger.gifppic
/data/data/####/flower.gifppic
/data/data/####/helper
/data/data/####/libgame.so
/data/data/####/libhelper.so
/data/data/####/libsmsmanager.so
/data/data/####/libzxvps.so
/data/data/####/m7tpznome33cody8.dex
/data/data/####/mall_b_all.gifppic
/data/data/####/mall_b_close.gifppic
/data/data/####/mall_b_gold_add.gifppic
/data/data/####/mall_b_gold_bg.gifppic
/data/data/####/mall_b_got.gifppic
/data/data/####/mall_bg.gifppic
/data/data/####/mall_skin_achi.gifppic
/data/data/####/mall_skin_bg0.gifppic
/data/data/####/mall_skin_bg1.gifppic
/data/data/####/mall_skin_btn0.gifppic
/data/data/####/mall_skin_btn1.gifppic
/data/data/####/mall_skin_btn2.gifppic
/data/data/####/mall_skin_btn3.gifppic
/data/data/####/mall_skin_locked.gifppic
/data/data/####/mall_skin_names.gifppic
/data/data/####/mall_skin_price.gifppic
/data/data/####/mall_title.gifppic
/data/data/####/mall_title_bg.gifppic
/data/data/####/mobclick_agent_cached_bprw.ksfhb.qndce.CX2017_1075002
/data/data/####/num1.gifppic
/data/data/####/num10.gifppic
/data/data/####/num11.gifppic
/data/data/####/num12.gifppic
/data/data/####/num13.gifppic
/data/data/####/num14.gifppic
/data/data/####/num15.gifppic
/data/data/####/num16.gifppic
/data/data/####/num2.gifppic
/data/data/####/num3.gifppic
/data/data/####/num4.gifppic
/data/data/####/num5.gifppic
/data/data/####/num6.gifppic
/data/data/####/num7.gifppic
/data/data/####/num8.gifppic
/data/data/####/num9.gifppic
/data/data/####/over_b_back.gifppic
/data/data/####/over_b_replay.gifppic
/data/data/####/over_bg.gifppic
/data/data/####/over_title.gifppic
/data/data/####/particle_shape.gifppic
/data/data/####/particle_spit.gifppic
/data/data/####/pass_deco0.gifppic
/data/data/####/pass_deco1.gifppic
/data/data/####/pass_deco2.gifppic
/data/data/####/pass_title.gifppic
/data/data/####/pause_b_0.gifppic
/data/data/####/pause_b_1.gifppic
/data/data/####/pause_b_2.gifppic
/data/data/####/pause_bg.gifppic
/data/data/####/pid
/data/data/####/pref_file.xml
/data/data/####/qy_db_pay
/data/data/####/qy_db_pay-journal
/data/data/####/run_b_avatar.gifppic
/data/data/####/run_b_grow.gifppic
/data/data/####/run_b_invi.gifppic
/data/data/####/run_b_pause.gifppic
/data/data/####/run_b_spit.gifppic
/data/data/####/run_bg.gifppic
/data/data/####/run_move_panel.gifppic
/data/data/####/run_move_point.gifppic
/data/data/####/run_rank_title.gifppic
/data/data/####/run_rank_top.gifppic
/data/data/####/run_weight_title.gifppic
/data/data/####/scroll_str.gifppic
/data/data/####/setting_bg.gifppic
/data/data/####/setting_close.gifppic
/data/data/####/setting_sel.gifppic
/data/data/####/skin_00.gifppic
/data/data/####/skin_01.gifppic
/data/data/####/skin_02.gifppic
/data/data/####/skin_03.gifppic
/data/data/####/skin_04.gifppic
/data/data/####/skin_05.gifppic
/data/data/####/skin_10.gifppic
/data/data/####/skin_100.gifppic
/data/data/####/skin_11.gifppic
/data/data/####/skin_110.gifppic
/data/data/####/skin_12.gifppic
/data/data/####/skin_120.gifppic
/data/data/####/skin_13.gifppic
/data/data/####/skin_130.gifppic
/data/data/####/skin_14.gifppic
/data/data/####/skin_140.gifppic
/data/data/####/skin_150.gifppic
/data/data/####/skin_20.gifppic
/data/data/####/skin_21.gifppic
/data/data/####/skin_22.gifppic
/data/data/####/skin_23.gifppic
/data/data/####/skin_24.gifppic
/data/data/####/skin_25.gifppic
/data/data/####/skin_26.gifppic
/data/data/####/skin_27.gifppic
/data/data/####/skin_30.gifppic
/data/data/####/skin_31.gifppic
/data/data/####/skin_32.gifppic
/data/data/####/skin_40.gifppic
/data/data/####/skin_41.gifppic
/data/data/####/skin_42.gifppic
/data/data/####/skin_43.gifppic
/data/data/####/skin_44.gifppic
/data/data/####/skin_50.gifppic
/data/data/####/skin_51.gifppic
/data/data/####/skin_52.gifppic
/data/data/####/skin_53.gifppic
/data/data/####/skin_54.gifppic
/data/data/####/skin_55.gifppic
/data/data/####/skin_60.gifppic
/data/data/####/skin_61.gifppic
/data/data/####/skin_62.gifppic
/data/data/####/skin_63.gifppic
/data/data/####/skin_70.gifppic
/data/data/####/skin_80.gifppic
/data/data/####/skin_90.gifppic
/data/data/####/skin_faceto.gifppic
/data/data/####/skin_hambg.gifppic
/data/data/####/skin_invi.gifppic
/data/data/####/skin_none.gifppic
/data/data/####/skin_player_names.gifppic
/data/data/####/skin_player_weight.gifppic
/data/data/####/skin_prick.gifppic
/data/data/####/skin_speed.gifppic
/data/data/####/statistic_info_bg.gifppic
/data/data/####/td_pefercen_profile.xml
/data/data/####/tdandroidgame
/data/data/####/tdid.xml
/data/data/####/umeng_general_config.xml
/data/data/####/unknown.xml
/data/media/####/.tcookieid

Miscellaneous:

Executes the following shell scripts:

app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.google.android.gms.analytics.CampaignTrackingService
cat /sys/block/mmcblk0/device/cid
chmod 777 <Package Folder>/files/_zx_lib/helper
dd if <Package Folder>/files/_zx_lib/libhelper.so of <Package Folder>/files/_zx_lib/helper
dd if=<Package Folder>/files/_zx_lib/libhelper.so of=<Package Folder>/files/_zx_lib/helper
ls -l /system/bin/su
sh

Loads the following dynamic libraries:

gmbwb50ix4c1qhyu
libgame
libhelper
libsmsmanager
libzxvps

Uses the following algorithms to encrypt data:

DES-ECB-NoPadding

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

Parses information from SMS.

Gets information about sent/received SMS.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial