Technical information
Malicious functions:
Sends SMS messages:
- 106575206321505460: dyl#####,####,6000076-1-131-rxun_rlys_1-0
- 12114: dyl#####,####,6000076-1-131-rxun_rlys_1-0
Executes code of the following detected threats:
- Android.Spy.205.origin
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- greenxs####.net
- newbyv####.com:10001
HTTP GET requests:
- greenxs####.net/resource!chargeUpdate?resTypes=####&dexId=####&dexVer=##...
- greenxs####.net/active!activeLog.action?provider=####&clickId=####&manu=...
- greenxs####.net/resource!resource?resTypes=####&appid=####&channel=####&...
- greenxs####.net/doking/smsd!hiGo.action?t=####&dexId=####&dexVer=####&ap...
HTTP POST requests:
- newbyv####.com:10001/api/v1/phones
- greenxs####.net/shop/shop_upload_log
Droppers:
Loaded to be executed by the following detected threats:
- Android.Packed.21410
Modified file system:
Creates the following files:
- /sdcard/.tpservice/####/download/jar/qsha_80001_5094.jar
- /data/anr/traces.txt
- /data/data/####/shared_prefs/pretw.xml
- /data/data/####/shared_prefs/twc.xml
- /data/data/####/shared_prefs/dispatch_log.xml
- /data/data/####/files/noend.ini
- /data/data/####/databases/webview.db-journal
- /sdcard/.twservice/qshp_3003_2247/tw
- /data/data/####/files/dump
- /sdcard/.twservice/qshp_3003_2247.zip
Miscellaneous:
Executes next shell scripts:
- cat /sys/block/mmcblk0/device/cid
- /system/bin/dexopt --dex 27 42 40 213440 /storage/emulated/0/.tpservice/####/download/jar/qsha_80001_5094.jar 1248298237 -1297833896 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/f
- /system/bin/dexopt --dex 27 48 40 273440 /storage/emulated/0/.twservice/qshp_3003_2247/tw.jar 1249136898 -1202193357 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
Contains functionality to send SMS messages automatically.
