Android.SmsSend.22171

Added to the Dr.Web virus database: 2017-08-24

Virus description added: 2017-08-24

Malicious functions:

Sends SMS messages:

Executes code of the following detected threats:

Downloads the following detected threats from the Web:

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

HTTP GET requests:

HTTP POST requests:

Modified file system:

Creates the following files:

<Package Folder>/app_payload_lib/done
<Package Folder>/app_payload_lib/libcocos2dcpp.so
<Package Folder>/app_payload_lib/libcrypt_sign.so
<Package Folder>/app_payload_lib/libgoldcoast.so
<Package Folder>/app_payload_lib/libkjOnlinePay.so
<Package Folder>/app_payload_odex/3b685c8bc5810a3d6e4b4bf2e54d7297.dex (deleted)
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/f_000003
<Package Folder>/cache/####/f_000004
<Package Folder>/cache/####/f_000005
<Package Folder>/cache/####/f_000006
<Package Folder>/cache/####/f_000007
<Package Folder>/cache/####/f_000008
<Package Folder>/cache/####/index
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/3b685c8bc5810a3d6e4b4bf2e54d7297.apk
<Package Folder>/files/a0c175d0.apk
<Package Folder>/files/u.apk
<SD-Card>/com.zckj.files/u.apk

Miscellaneous:

Executes next shell scripts:

Loads the following dynamic libraries:

Gains access to geolocation.

Gains access to telephone information (number, imei, etc.).

Displays its own windows over windows of other applications.

Gains access to information about sent/received SMS messages.