Android.SmsSend.17207

Technical information

Malicious functions:

Sends SMS messages:

075585181130: cyMjUwMDI2Njk5MTg3NzQzIzM1NjUwNzA1OTM1MTg5NSM0LjMuMQ==

Network activity:

Connecting to:

1####.####.80:8000
2####.####.140:8080
1####.####.67
unitedp####.####.com
d####.####.com
w####.####.com:7758
1####.####.192
1####.####.238

HTTP GET requests:

d####.####.com/egsb/otherPay/querySMSLimitMoney
d####.####.com/egsb/startup/queryConfiguration?channelId=####&contentId=####&gameType=####
1####.####.67/codex/version
1####.####.192/unitedpay_sdk/version
unitedp####.####.com/numberbank/interface?getInfo=####

HTTP POST requests:

2####.####.140:8080/migusdk/tl/enclog
d####.####.com/egsb/verification/getUpdateUrl
d####.####.com/egsb/verification/checkSdkUpdate
1####.####.238/updata/interface.html
1####.####.80:8000/intp/c2bdcbaf207053f758d38f80c14c2d5e465b9deb
d####.####.com/egsb/otherPay/querySMSInterceptorConf
d####.####.com/egsb/game/getPaymentCapability
w####.####.com:7758/normandie/QueryConfigPolicy
d####.####.com/egsb/thirdPay/queryThirdPayInfo

Modified file system:

Creates the following files:

/data/data/####/files/UNITEDPAYACTLIST_
/data/data/####/files/edfile/armeabi/libmiguED.so
/data/data/####/files/mgid.dat
/data/data/####/app_lemuellabs_reserved/93643295cb358eb0.jar
/data/data/####/files/MiguPay.Sdk30.Lib_12003003_07e001f49cf7425a25878b7204c8de63_BN202.cod
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml
/data/data/####/shared_prefs/sogou.singlegame.sdk.xml
/data/data/####/app_lemuellabs_reserved_/4656768377b6beeb.jar
/data/data/####/shared_prefs/td_pefercen_profile.xml.bak
/data/data/####/app_lemuellabs_reserved_/lemuel_security_inner.so
/data/data/####/files/ly.jar
/data/data/####/app_lemuellabs_reserved/e1eebcc1b3eb2399.jar
/data/data/####/2230.dex
/data/data/####/databases/sogou_game_sdk.db
/data/data/####/app_lemuellabs_reserved_/codex_inner.so
/data/data/####/files/MiguPay.Sdk30.Lib_12003003_07e001f49cf7425a25878b7204c8de63_BN202.dat
/data/data/####/databases/mpush_game.db-journal
/sdcard/Download/data/cn.cmgame.sdk/sdk_prefs.txt
/sdcard/.tcookieid
/data/data/####/files/mpush_gateway_preferences_file
/data/data/####/databases/sogou_game_sdk.db-journal
/data/data/####/files/ED.ini
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
/sdcard/贪吃蛇大作战对战版/log/1485418494512
/data/data/####/files/mpush_version_preferences_file
/data/data/####/files/mgAS.dat
/data/data/####/2087.dex
/data/data/####/files/mgSS.dat
/data/data/####/shared_prefs/pref_file.xml
/data/data/####/shared_prefs/3f6ec4da684547211e371a67946d85757|account_file.xml
/data/data/####/files/hbilling.dat
/sdcard/Download/data/cn.cmgame.sdk/ShareData.txt
/data/data/####/shared_prefs/tdid.xml
/data/data/####/cache/volley/imgs/journal.tmp
/data/data/####/shared_prefs/td_pefercen_profile.xml
/sdcard/Download/data/cn.cmgame.sdk/msgflag.txt
/data/data/####/app_lemuellabs_reserved/codex.so
/data/data/####/shared_prefs/pref_file.xml.bak
/data/data/####/files/libmgRun_04.22.06_01.so
/sdcard/Download/data/cn.cmgame.sdk/log/deviceId.txt