Android.Siggen.6531

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.SkyMobi.5.origin

Network activity:

Connecting to:

h####.####.com
i####.####.com
pi####.####.com
and####.####.com
f####.####.com
w####.####.com
d####.####.net
l####.####.com
m####.####.com
and####.####.com:8077
ping####.####.com
a####.####.com
b####.####.com

HTTP GET requests:

i####.####.com/28/4/47373916_1_1.jpg?v=####
a####.####.com/2339/m/static/base/styles/public_83fb756.css
b####.####.com/group1/M00/00/04/ChM3JFeWyCeAMVL6AABXFYsHb98529.JPG
i####.####.com/52/4/24573940_1_1.jpg?v=####
d####.####.net/apkf/3rdapk2/M01/0C/74/wKhklFggLLiAJT70AAAkOW2094g958.apk
i####.####.com/16/0/35982928_1_0.jpg?v=####
i####.####.com/44/4/40455340_11.jpg?v=####
h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja...
b####.####.com/group1/M00/00/00/ChM0-lkJf3mABVD4AAGLvDJ37ZI354.png
l####.####.com/base/scripts/--/jquery.js,util/oo.js,util/json2.js,util/t...
ping####.####.com/pingd?dm=####&pvi=####&si=####&url=####&arg=####&ty=##...
a####.####.com/2339/m/static/page/index/index_9270fbf.js
w####.####.com/r/378609775/index.htm?cm=####
i####.####.com/61/5/1487908673981.jpg
i####.####.com/36/4/5118308_1_0_180180.jpg?v=####
w####.####.com/r/p/lyxy.jsp?ln=####&t1=####&cm=####
a####.####.com/public/blackword_list/1?callback=####&_=####
pi####.####.com/h5/stats.js
i####.####.com/30/6/1482465479518.jpg
d####.####.net/apkf/3rdapk2/M01/13/6C/wKhklVjwsaCARWV-AAQm7yY3ixc640.apk
b####.####.com/group1/M00/00/08/ChM3JFgphJOAfVwBAABKEoDdw0M541.jpg
b####.####.com/group1/M00/00/08/ChM3JFgphIGAax9sAABe-bWRr58234.jpg
l####.####.com/base/styles/--/normalize.css,level/level.css
i####.####.com/4/4/20108676_1_1.jpg?v=####
i####.####.com/13/5/19048909_1_0.jpg?v=####
i####.####.com/30/6/38632094_1_0.jpg?v=####
a####.####.com/2339/m/static/page/index/index_8706ffd.css
i####.####.com/55/7/1482465487159.jpg
i####.####.com/8/0/1206088_1_0.jpg?v=####
i####.####.com/48/0/47862384_1_1.jpg?v=####
i####.####.com/26/2/17545498_1_0.jpg?v=####
i####.####.com/48/0/21861296_1_1.jpg?v=####
f####.####.com/qvod/handao_img/newsp/zuan_1.mp4
i####.####.com/10/2/19563594_1_1.jpg?v=####
i####.####.com/59/3/1452150023355.jpg
i####.####.com/54/6/20286006_1_0_180180.jpg?v=####
w####.####.com/r/378609775/378609778/index.htm?cm=####
i####.####.com/47/7/31030703_1_0_180180.jpg?v=####
d####.####.net/apkf/3rdapk2/M01/0F/ED/wKhklFi3kP6AenV0AAK1r2oCKfQ234.apk
i####.####.com/9/1/15794569_1_0.jpg?v=####
a####.####.com/channel/prop?_id=####&callback=####&_=####
a####.####.com/2339/m/static/page/index/tmpl_beee10f.js
d####.####.net/apkf/3rdapk2/M01/0F/82/wKhklFiFqJKAOnnKAACb3YsVzOg199.apk
b####.####.com/group1/M00/00/0B/ChM3JFkUABmAanBTAAJAJt3vuCs728.png
i####.####.com/57/1/23737081_1_0.jpg?v=####
i####.####.com/12/4/18646284_1_1.jpg?v=####
i####.####.com/10/2/34625290_1_1_180180.jpg?v=####
m####.####.com/course/504703.html?cm=####
b####.####.com/group1/M00/00/00/ChM0-lkJf4KAKL3OAAQ2hH9WU04493.png
m####.####.com/?union=####
h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln...
a####.####.com/2339/m/static/pkg/base_0fa99ab.js
b####.####.com/group1/M00/00/09/ChM3JFgz5yWARKgjAAFZjVv2gkE922.jpg
d####.####.net/apkf/3rdapk2/M01/11/F8/wKhklVjkZD6AChDMAAP3wtpPkhM733.apk
i####.####.com/51/3/22740019_1_1.jpg?v=####
i####.####.com/1/1/1203265_1.jpg?v=####
i####.####.com/47/7/49682607_1_1.jpg?v=####
a####.####.com/public/blackword_list/0?callback=####&_=####
i####.####.com/36/4/14890660_11.jpg?v=####
b####.####.com/group1/M00/00/0B/ChM3JFkJf5WAbOTrAAEHLgVo8VU780.png
w####.####.com/r/p/index.jsp?vt=####&cm=####
i####.####.com/12/4/45380940_1_0.jpg?v=####
i####.####.com/1/1/22881601_1_1.jpg?v=####
i####.####.com/5/5/16770245_11.jpg?v=####
i####.####.com/9/1/18701001_1_0.jpg?v=####
i####.####.com/13/5/2047693_1_1.jpg?v=####
b####.####.com/group1/M00/00/09/ChM3JFgz5OKAGeCaAAFlhmB50Fs280.jpg
i####.####.com/13/5/36229389_1_1.jpg?v=####
a####.####.com/t/font_qrktvih5p2wklnmi.ttf?t=####
a####.####.com/2339/m/static/base/styles/theme/logo_7f47006.png
b####.####.com/group1/M00/00/08/ChM3JFgphISAViF5AADcylQhmNE306.jpg
i####.####.com/49/1/18791665_1_0.jpg?v=####
i####.####.com/63/7/14797119_1_1.jpg?v=####
b####.####.com/group1/M00/00/08/ChM3JFgphJiACwYDAAwHbIsLTxU256.gif
i####.####.com/55/7/40916599_1_0.jpg?v=####
h####.####.com/hm.js?a97087b####

HTTP POST requests:

and####.####.com/record-plat/record/upload.do
and####.####.com/record-collect/record/upload.do
and####.####.com/query-plat/conf/common/query.do
and####.####.com/record-plat/seq/query.do
and####.####.com/zm-adv-mis/recommwall/active/query.do
and####.####.com/zm-adv-mis/push/active/query.do
and####.####.com/video-plat/new/column/query.do
and####.####.com/zm-adv-mis/recommwall/list/query.do
and####.####.com/zm-adv-mis/adv/list/query.do
and####.####.com:8077/query-plat/cap/query.do
and####.####.com/zm-adv-mis/push/list/query.do
and####.####.com/android/sms/netpay/prefetch.do
and####.####.com/zm-adv-mis/folder/active/query.do
and####.####.com/record-plat/msg/strategy/query.do
and####.####.com/video-plat/plugin/query.do
and####.####.com/zm-adv-mis/folder/list/query.do
and####.####.com/zm-adv-mis/advplugin/query.do

Modified file system:

Creates the following files:

/data/data/####/SkyAdver_file/NotifyBarAdvResponse
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/cache/image_manager_disk_cache/d76ce66ccdec5535cdde063ceb80dae0c14c9d75a40b7664ecd0c50f30a25546.0.tmp
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/SkyAdver_file/reqseq
/sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yijiesdk.new.apk
/data/data/####/databases/Data_sync.db-journal
/data/data/####/databases/webview.db-journal
/data/data/####/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/plugin.info
/sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.zhongzhisdk.new.apk.temp
/data/data/####/app_PayImgs/531A5C15C029D8B07E6B4307444783BD
/data/data/####/files/libabc
/data/data/####/shared_prefs/pref_recomm.xml.bak
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data
/data/data/####/shared_prefs/pref_folder.xml.bak
/data/data/####/cache/webviewCacheChromium/index
/data/data/####/shared_prefs/paypush_preference.xml.bak
/sdcard/Android/data/com.skymobi.pay.zmvideo/assets/video.mp4
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.new.data
/data/data/####/cache/webviewCacheChromium/f_00000a
/data/data/####/cache/webviewCacheChromium/f_00000c
/data/data/####/cache/webviewCacheChromium/f_00000b
/data/data/####/cache/webviewCacheChromium/f_00000e
/data/data/####/cache/webviewCacheChromium/f_00000d
/data/data/####/cache/webviewCacheChromium/f_00000f
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/reqseq
/data/data/####/shared_prefs/ntf_idpadv.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/PushDataServerTime
/data/data/####/cache/image_manager_disk_cache/5fb0db671ad746bf64982eb667e7ebb0b1143ba78801bf8f920e70e06ce005d5.0.tmp
/data/data/####/files_main/key_AppPluginCapInfo
/data/data/####/cache/webviewCacheChromium/f_000011
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.new.data.temp
/data/data/####/cache/webviewCacheChromium/f_000009
/data/data/####/cache/webviewCacheChromium/f_000008
/sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.zhongzhisdk.new.apk
/data/data/####/cache/webviewCacheChromium/f_000001
/data/data/####/cache/image_manager_disk_cache/5b67f3233ec5f54bd24868d6c0a217a66b151fe827edc4ac2e377b6c6ce48ba9.0.tmp
/data/data/####/cache/webviewCacheChromium/f_000003
/data/data/####/cache/webviewCacheChromium/f_000002
/data/data/####/cache/webviewCacheChromium/f_000005
/data/data/####/cache/webviewCacheChromium/f_000004
/data/data/####/cache/webviewCacheChromium/f_000007
/data/data/####/cache/webviewCacheChromium/f_000006
/data/data/####/shared_prefs/plugin_record_app_info.xml
/data/data/####/shared_prefs/pref_advert.xml
/data/data/####/cache/image_manager_disk_cache/f8326f95a261689a5377af131ffccf522962b4208468da669f6052efdbb2db93.0.tmp
/data/data/####/shared_prefs/pref_folder.xml
/data/data/####/app_workbench59634/apk.zip
/data/data/####/cache/webviewCacheChromium/f_000012
/data/data/####/cache/webviewCacheChromium/f_000013
/data/data/####/cache/webviewCacheChromium/f_000010
/data/data/####/shared_prefs/paypush_preference.xml
/sdcard/Android/data/.nomedia
/data/data/####/cache/image_manager_disk_cache/ab4626134a9884ea3a407b1626026da68ffe958b57fd7af7d112940b62eeeb55.0.tmp
/data/data/####/shared_prefs/data.xml
/data/data/####/databases/cc/cc.db-journal
/data/data/####/cache/image_manager_disk_cache/5d2142df72211827533323f163d6ae6becd321b23aa358edb570a0788c6936e6.0.tmp
/data/data/####/shared_prefs/mainplugin_query.xml
/data/data/####/shared_prefs/BOOT_SMS_SENT_TIME.xml
/data/data/####/app_workbench65160/apk.zip
/sdcard/Android/data/com.skymobi.pay.newsdk/files_main/key_ServerPluginInfo
/data/data/####/cache/image_manager_disk_cache/4ef7f0581215cb748b33fe01d23c9cc78bab36e4e832932706c52399eee99096.0.tmp
/sdcard/Android/data/com.skymobi.pay.zmvideo/plugins/com.skymobi.pay.zmvideo.plugin.jar
/data/data/####/files/mobclick_agent_cached_####1305
/data/data/####/app_workbench70686/apk.zip
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/LatestPushIndex
/data/data/####/app_workbench32004/apk.zip
/sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yijiesdk.new.apk.temp
/data/data/####/databases/cc/cc.db
/sdcard/Android/data/com.skymobi.pay.zmvideo/data.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.data
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.new.data.temp
/data/data/####/files/3754c3ba0a7e1f887f5ae6303b906a50.apk
/data/data/####/shared_prefs/mainplugin_query.xml.bak
/data/data/####/cache/image_manager_disk_cache/04a6055cc9de18774482d04049cfafb29e85d90346b903e8daa9698ef5b10bc8.0.tmp
/sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/NotifyBarAdvResponse
/data/data/####/cache/image_manager_disk_cache/journal.tmp
/data/data/####/files_main/key_ServerPluginInfo
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.new.data
/data/data/####/app_PayImgs/5A0C98FA35D82BC7E418646B07304289
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.data
/data/data/####/shared_prefs/BOOT_SMS_INFO.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/user.sys
/data/data/####/app_workbench42830/apk.zip
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/data/data/####/SkyAdver_file/PushDataServerTime
/data/data/####/SkyAdver_file/LatestPushIndex
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
/data/data/####/cache/image_manager_disk_cache/2666bad6004c3d482ee86083c1f2ee3af0aefb90f5f65501929795e6a8564701.0.tmp
/data/data/####/shared_prefs/pref_recomm.xml
/sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.data.temp

Miscellaneous:

Executes next shell scripts:

/system/bin/dexopt --dex 27 52 40 94816 /data/data/####/app_workbench65160/apk.zip 1252157204 -264446213 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framew
/system/bin/dexopt --dex 27 98 40 102120 /storage/emulated/0/android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.zhongzhisdk.apk 1245148595 620116018 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framewor
/system/bin/dexopt --dex 27 49 40 129872 /data/data/####/app_workbench70686/apk.zip 1252157204 591524218 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framew
/system/bin/dexopt --dex 27 90 40 102120 /storage/emulated/0/android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.zhongzhisdk.apk 1245148595 620116018 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framewor
/system/bin/dexopt --dex 27 40 40 1277392 /data/data/####/files/3754c3ba0a7e1f887f5ae6303b906a50.apk 2179072 -2144747102 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.ja
/system/bin/dexopt --dex 27 92 40 17056 /storage/emulated/0/android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yijiesdk.apk 1229753698 832928151 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bo
/system/bin/dexopt --dex 27 100 40 17056 /storage/emulated/0/android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yijiesdk.apk 1229753698 832928151 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/b
chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.zmvideo/plugins/com.skymobi.pay.zmvideo.plugin.jar
/system/bin/dexopt --dex 27 44 40 1952028 /storage/emulated/0/Android/data/com.skymobi.pay.zmvideo/plugins/com.skymobi.pay.zmvideo.plugin.jar 1249802083 -1651174093 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycas
/system/bin/dexopt --dex 27 93 40 618728 /data/data/####/app_workbench32004/apk.zip 1252157208 1597167270 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/frame
/system/bin/dexopt --dex 27 53 40 540224 /data/data/####/app_workbench59634/apk.zip 1252157205 1715135955 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/frame
/system/bin/dexopt --dex 27 81 40 541712 /data/data/####/app_workbench32004/apk.zip 1252157207 -349942904 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/frame
/system/bin/dexopt --dex 27 94 40 349240 /data/data/####/app_workbench42830/apk.zip 1252157208 -1220698994 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/fram

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial