Android.SmsSend.17178

Technical information

Malicious functions:

Sends SMS messages:

12114516412: systemcGx1dG8yNTAwMjY2OTkxODc3NDM=

Executes code of the following detected threats:

Android.Triada.151.origin

Network activity:

Connecting to:

1####.####.56:9039
1####.####.136:6577
e####.####.com
apm-col####.####.com
p####.####.cn
1####.####.56
i####.####.cn
a####.####.com

HTTP GET requests:

1####.####.56:9039//gamesit/xysdk/init
e####.####.com/album/s%3D1600%3Bq%3D90/sign=9fae12de9445d688a702b6a294f2466f/500fd9f9d72a6059797e3af72e34349b023bbaf5.jpg
e####.####.com/album/s%3D1600%3Bq%3D90/sign=caee331957da81cb4ae687cb6256eb67/14ce36d3d539b6005d73d45aef50352ac75cb79a.jpg
1####.####.56/gamesit/jysdk/initsdk?os_info=####&os_model=####&net_info=####&imsi=####&imei=####

HTTP POST requests:

i####.####.cn/iplookup/iplookup.php?format=####
a####.####.com/app_logs
1####.####.136:6577/main.aspx
apm-col####.####.com/cpi/crash
p####.####.cn/index.php/API

Modified file system:

Creates the following files:

/data/data/####/shared_prefs/TestinCrash.xml.bak
/sdcard/widgets/system/configs/tmn19.sys42f47bc2-b441-446e-8817-d247a742d897.tmp
/data/data/####/shared_prefs/####_preferences.xml
/sdcard/.balt/sysds.datb6d2a73e-362b-4393-913c-0606ec6fffb1.tmp
/sdcard/widgets/system/configs/tmn19.sysfb20563e-a605-4d24-bb4f-44d725dbad1c.tmp
/data/data/####/databases/mp.db
/sdcard/widgets/system/configs/tmn19.sys9a2a102b-714f-4d9c-809b-79057b039f3d.tmp
/data/data/####/shared_prefs/device_id.xml.xml
/data/data/####/databases/TestinAgent.db-journal
/sdcard/widgets/system/configs/tmn19.sysd7a1e4bc-d8c4-4871-a8b9-aabb199b7cfc.tmp
/sdcard/sdtmp/id12383e676-47aa-4a4f-a151-3490bf295750.tmp
/data/data/####/app_pload_lib/libhelper.so
/data/data/####/shared_prefs/umeng_general_config.xml
/sdcard/widgets/system/configs/tmn19.sys537d608c-ada8-45a2-8333-d10734ade370.tmp
/data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
/data/data/####/files/.imprint
/data/data/####/databases/TestinAgent.db
/sdcard/widgets/system/configs/tmn19.sys3ec96fe9-ac73-495e-8c55-85975f191f7d.tmp
/data/data/####/shared_prefs/zhangpay_sms_info.xml
/sdcard/widgets/system/configs/tmn19.sys8b39ca4f-736b-436e-b317-3c87707a8017.tmp
/data/data/####/files/droidinfotemp.txt
/data/data/####/shared_prefs/tml_data_2014_19.xml
/sdcard/.hand/lastacc
/data/data/####/app_temp/id
/data/data/####/shared_prefs/####_preferences.xml.bak
/sdcard/widgets/system/configs/tmn19.syscd5114ed-b24e-4e87-91fb-15826c0f6464.tmp
/sdcard/.uct/uuid3d43820ce-4d0b-4fa3-acce-3c2e24edc759.tmp
/sdcard/mmt/widegets/data/droidinfo-journal
/data/data/####/shared_prefs/zhangpay_share.xml
/sdcard/widgets/system/configs/tmn19.sys8af6ed7e-43f6-474a-b0bd-960f2c5363f4.tmp
/data/data/####/shared_prefs/database.xml
/data/data/####/shared_prefs/getFlag.xml
/data/data/####/app_res_out/JMediaRes.apk
/data/data/####/shared_prefs/zhangpay_share.xml.bak
/data/data/####/files/umeng_it.cache
/data/data/####/databases/mp.db-journal
/data/data/####/app_pload_odex/pload.inf
/sdcard/Android/data/####/cache/.nomedia
/sdcard/widgets/system/configs/tmn19.sysd1d0fbda-c4c6-44d7-9cc2-f1dea4ee3be0.tmp
/sdcard/widgets/system/configs/tmn19.sys0de375e8-f191-4e2c-976c-261403671871.tmp
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/data/data/####/databases/database-journal
/sdcard/.hand/lastacc5289498f-a609-4598-8632-26e7d4670a61.tmp
/data/data/####/shared_prefs/TestinCrash.xml
/sdcard/sdtmp/id29211c90a-41a1-4e01-b0e6-8bc8a5f1db14.tmp
/data/data/####/app_pload_odex/pload.apk
/sdcard/Android/data/####/cache/uil-images/1799940966
/sdcard/widgets/system/configs/tmn19.sysb78e5eec-e807-46f5-8dc1-db2ad589e911.tmp
/sdcard/Android/data/####/cache/uil-images/800581590
/sdcard/mmt/widegets/data/droidinfo