Android.SmsSend.15076

Technical information

Malicious functions:

Sends SMS messages:

12114516386: 上海麦圈网##########

Executes code of the following detected threats:

Android.Triada.151.origin

Network activity:

Connecting to:

g####.####.com
1####.####.136:6577
o####.####.com
s####.####.cn
p####.####.com
i####.####.cn
a####.####.com

HTTP POST requests:

s####.####.cn/j
g####.####.com/cooguosdk?b=####&requestId=####&a=####
1####.####.136:6577/main.aspx
o####.####.com/v2/get_update_time
p####.####.com/interfaceAction?unikey=####
o####.####.com/v2/check_config_update
i####.####.cn/iplookup/iplookup.php?format=####
a####.####.com/app_logs

Modified file system:

Creates the following files:

/data/data/####/files/hqcyaq_d/hqcyaq.zip
/sdcard/widgets/system/configs/tmn19.sysc5ffa38c-b5df-42da-bc44-6442e01b4e03.tmp
/data/data/####/app_temp/id
/sdcard/widgets/system/configs/tmn19.sysc029d932-37da-4278-bd4b-5a8c9a020372.tmp
/sdcard/.balt/sysds.dat96c84968-d71b-4862-96f6-95c16fd8287f.tmp
/sdcard/widgets/system/configs/tmn19.sysc53165c3-9d70-43e5-b5ec-7a4e11123da5.tmp
/data/data/####/files/uYQiTGFcIoM=/YHiE79YMO2nBLs80h_B-1Q==
/sdcard/widgets/system/configs/tmn19.sysf97b0dce-f2dd-47f7-80be-a8c64c8c2711.tmp
/sdcard/.system/TIpOTAhZHVuavVDj/FKSO-PTG-6bHG6iKfVdjtUdNFkk=
/sdcard/widgets/system/configs/tmn19.sysfa72dae9-9c2c-41e3-adb2-3bd919c4f860.tmp
/data/data/####/shared_prefs/sendtimedetail.xml
/data/data/####/files/uYQiTGFcIoM=/KCqEZt3x8HbguFu9/-TGzDy2KiahaxnSzqo82XCOWJq8=
/sdcard/sdtmp/id254e70e5f-ca24-4397-894b-866387a85292.tmp
/data/data/####/app_pload_lib/libhelper.so
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/files/uYQiTGFcIoM=/Ht2KbKEiIQzAjPwsCykPOQ==
/data/data/####/shared_prefs/onlineconfig_agent_online_setting_####.xml
/sdcard/widgets/system/configs/tmn19.sys
/data/data/####/files/uYQiTGFcIoM=/KCqEZt3x8HbguFu9/RHZjkYuxgXt6UIutQmfbrwQXSIcJd8r9
/data/data/####/files/.imprint
/data/data/####/shared_prefs/cg.xml
/sdcard/.uct/uuid35cba9f5b-9e2a-480a-95e0-4f269c77a37a.tmp
/sdcard/.hand/lastaccc65d0d42-d3a3-4732-8789-b945f26c22d2.tmp
/sdcard/widgets/system/configs/tmn19.sys4c7a4d20-44c4-4a6e-865b-b1f60fa9bac3.tmp
/data/data/####/files/droidinfotemp.txt
/sdcard/widgets/system/configs/tmn19.sys37af1412-085f-4b34-8523-ad05ad2140bb.tmp
/data/data/####/shared_prefs/tml_data_2014_19.xml
/data/data/####/files/uYQiTGFcIoM=/PVusz63UDbVZ4XAbvywJDQ==
/sdcard/sdtmp/id14c7abbb7-fab8-41e9-94aa-7537d3799788.tmp
/data/data/####/app_pload_odex/pload.inf
/sdcard/widgets/system/configs/tmn19.sysde226ad0-6b1b-493a-a84f-bc07f39cc3d0.tmp
/data/data/####/shared_prefs/database.xml
/data/data/####/shared_prefs/sendsms.xml
/data/data/####/app_res_out/JMediaRes.apk
/sdcard/widgets/system/configs/tmn19.sys7ffc31a9-e6da-40ce-a360-5988e7aa16f1.tmp
/data/data/####/files/umeng_it.cache
/sdcard/widgets/system/configs/tmn19.sys93f453a9-0877-43a9-a9b0-21d0c065bd90.tmp
/sdcard/cooguo/data/code/CG.DAT
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/sdcard/Android/data/####/cache/.nomedia
/sdcard/.system/TIpOTAhZHVuavVDj/B_T7LWxUigqpuSU4D7h_Xw7lDRCpdrzs
/sdcard/widgets/system/configs/tmn19.sys254b6aca-0466-43d5-9c7d-397e343de892.tmp
/data/data/####/shared_prefs/phoneDetail.xml
/data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
/data/data/####/app_pload_odex/pload.apk
/sdcard/mmt/widegets/data/droidinfo
/sdcard/mmt/widegets/data/droidinfo-journal