Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 1069009512114: 苏州易N支付##########
Сетевая активность:
Подключается к:
- i####.####.com
- 1####.####.212:9002
- 7x####.####.com
- o####.####.com
- 1####.cn
- i####.####.com:8081
- d####.####.com
- 1####.####.90
- w####.####.com
- w####.cn
- ut####.cn:8080
- a####.####.com
Запросы HTTP GET:
- a####.####.com/dianbo%2Fimg%2Fb_3.jpg
- a####.####.com/dianbo%2Fvip_info
- a####.####.com/dianbo%2Fimg%2F15.jpg
- a####.####.com/dianbo%2Fimg%2F61.jpg
- 7x####.####.com/videoimg_55.jpg
- a####.####.com/dianbo%2Fimg%2F19.jpg
- a####.####.com/dianbo%2Fimg%2F54.jpg
- a####.####.com/dianbo%2Fimg%2F9.jpg
- a####.####.com/location/ip?ak=####
- i####.####.com/ZBZP/1.26/4.jpg
- a####.####.com/dianbo%2Fimg%2F57.jpg
- i####.####.com/ZBZP/1.26/32.jpg
- a####.####.com/dianbo%2Fimg%2F51.jpg
- i####.####.com/service/getIpInfo2.php?ip=####
- a####.####.com/dianbo%2Fimg%2Fgg_2.jpg
- a####.####.com/dianbo%2Fimg%2F1_5.jpg
- w####.####.com/r/374577408/index.htm?cm=####
- 1####.####.90/code/init?app=####&lon=####&count=####&imei=####&iccid=####&nwtype=####&ctech=####&aimsi=####&cpid=####&cid=####&osversion=####&pck=####...
- a####.####.com/dianbo%2Fimg%2F11.jpg
- a####.####.com/dianbo%2Fimg%2F47.jpg
- i####.####.com/APP/AppTask.aspx
- a####.####.com/dianbo%2Fimg%2Fbanner_03.jpg
- o####.####.com/wmapp/update/d_data_wimipay.dat
- a####.####.com/dianbo%2Fimg%2F58.jpg
- a####.####.com/dianbo%2Fimg%2F1_6.jpg
- a####.####.com/dianbo%2Fimg%2Ffree_img%2F2.jpg
- a####.####.com/dianbo%2Fimg%2F42.jpg
- a####.####.com/dianbo%2Fimg%2F48.jpg
- a####.####.com/dianbo%2Fimg%2F59.jpg
- a####.####.com/dianbo%2Fimg%2F10.jpg
- a####.####.com/dianbo%2Fimg%2F1_b.jpg
- a####.####.com/dianbo%2Fimg%2F37.jpg
- a####.####.com/dianbo%2Fimage%2Fshikan_1.jpg
- i####.####.com/ZBZP/1.26/3.jpg
- a####.####.com/dianbo%2Fimg%2F52.jpg
- a####.####.com/dianbo%2Fimg%2F20.jpg
- a####.####.com/dianbo%2Fimg%2F53.jpg
- a####.####.com/dianbo%2Fimg%2F1.jpg
- a####.####.com/dianbo%2Fpay_mode
- a####.####.com/dianbo%2Fimg%2F60.jpg
- a####.####.com/dianbo%2Fimg%2F56.jpg
- a####.####.com/dianbo%2Fimg%2Ffree_img%2F4.jpg
- a####.####.com/dianbo%2Fimg%2Fbanner_01.jpg
- a####.####.com/dianbo%2Fimg%2F46.jpg
- a####.####.com/dianbo%2Fimg%2F2_b.jpg
- a####.####.com/dianbo%2Ffree_info
- a####.####.com/dianbo%2Fimg%2F4_b_mjzw.jpg
- a####.####.com/dianbo%2Fimg%2F50.jpg
- a####.####.com/dianbo%2Fimg%2F45.jpg
- i####.####.com:8081/ZBZP/1.26/2.jpg
- a####.####.com/dianbo%2Fimg%2F7.jpg
- a####.####.com/dianbo%2Fbanner_info
- a####.####.com/dianbo%2Fimg%2F6.jpg
- a####.####.com/dianbo%2Fanchor_info
- 7x####.####.com/utopay_20170119.zip
- a####.####.com/dianbo%2Fimg%2Fbanner_02_2.jpg
- a####.####.com/dianbo%2Fimg%2F25.jpg
- 1####.####.212:9002/install.php?imei=####&imsi=####&provice=####&model=####&os=####&wnet=####&appid=####&freeNode=####&appkey=####&service=####&iccid=...
Запросы HTTP POST:
- d####.####.com/wmserver/WMUpdate
- o####.####.com/v2/get_update_time
- w####.cn/wosdk/appalive
- 1####.cn/phone/fetch
- o####.####.com/v2/check_config_update
- a####.####.com/app_logs
- ut####.cn:8080/excalibur/avalon/sdk/init.aspx
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/MmData.xml
- /data/data/####/databases/utopay.db-journal
- /sdcard/Android/data/####/cache/uil-images/71fw90qtv36f2kfinhyw5laow.0.tmp
- /sdcard/Android/data/####/cache/uil-images/53e4nfkjflsvux4de3xe60ngl.0.tmp
- /data/data/####/files/212FEFE2A924077B2EF078AC774A9D73.jar
- /sdcard/Android/data/####/cache/uil-images/bdlw5ztcqaiy9ijs7em3ejof.0.tmp
- /sdcard/Android/data/####/cache/uil-images/13jrjkej9kzgzfvsat1h3g0jl.0.tmp
- /sdcard/Android/data/####/cache/uil-images/50ssdew036uq6i24mffnxvj5l.0.tmp
- /sdcard/Android/data/####/cache/uil-images/78h2nwil5rwsvig09dfzsolng.0.tmp
- /sdcard/Android/data/####/cache/uil-images/1o3cqo5klo9np3no7xxuh4msg.0.tmp
- /sdcard/Android/data/####/cache/uil-images/6qauywjpocc4e4g576i4worwp.0.tmp
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/Wimipay_System.xml
- /sdcard/Android/data/####/cache/uil-images/7h4lqumcyumri9996966pdevk.0.tmp
- /sdcard/Android/data/####/cache/uil-images/1fde6n2hegajpz15aknq03ipd.0
- /data/data/####/databases/lepeng.db-journal
- /sdcard/Android/data/####/cache/uil-images/190myxn74cstzk77t09lj9fd8.0.tmp
- /data/data/####/shared_prefs/device_authenticity.xml
- /sdcard/Android/data/####/cache/uil-images/4ppwiyg8mj3m4r1a0qsiwrf53.0.tmp
- /data/data/####/app_dex/utopay.jar
- /sdcard/Android/data/####/cache/uil-images/348oeu43vvl7ums5c5p6p09dp.0.tmp
- /sdcard/fywx_sdk_log.txt
- /sdcard/Android/data/####/cache/uil-images/27nucl2h0s178ib7nocjk0niy.0.tmp
- /sdcard/Android/data/####/cache/uil-images/5sv84tt1hjgjkfuh6hohgdmzs.0.tmp
- /sdcard/Android/data/####/cache/uil-images/12lasvh68n578fm7fmk6oj0pz.0.tmp
- /sdcard/Android/data/####/cache/uil-images/3ds1mvhrlmc11qpq5jv9nowld.0.tmp
- /sdcard/Android/data/####/cache/uil-images/28fybzyo3bnu9t89kio5wib9y.0.tmp
- /data/data/####/shared_prefs/device_authenticity.xml.bak
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Android/data/####/cache/uil-images/171crjzsz3hvglbc2i662fnfo.0.tmp
- /sdcard/Android/data/####/cache/uil-images/5eavtk0cc2cmxvbgexixbv641.0
- /sdcard/Android/data/####/cache/uil-images/749lfalkmc043bn0dyoika82u.0.tmp
- /data/data/####/app_dex/utopay_close.png
- /sdcard/Android/data/####/cache/uil-images/7ifzfk6cz1itma0wioqmkoydx.0.tmp
- /sdcard/Android/data/####/cache/uil-images/3l4zk9xo7ii6uktwpmc5kiaj3.0.tmp
- /sdcard/Android/data/####/cache/uil-images/67njh4kol85fkf2up18xrsjk5.0.tmp
- /sdcard/Android/data/####/cache/uil-images/13mphd723ahhgfq6eugr03b6z.0.tmp
- /data/data/####/app_dex/utopay_icon.gif
- /sdcard/Android/data/####/cache/uil-images/56gbt182qmr9wb724zqfxkxv2.0.tmp
- /sdcard/Android/data/####/cache/uil-images/3yed517j8m7z9yt85x5eeva1t.0.tmp
- /sdcard/Android/data/####/cache/uil-images/6p5d44aar3qu6gs544gj5wtai.0.tmp
- /sdcard/Android/data/####/cache/uil-images/47hiezqb0d53tfelle472t1gj.0.tmp
- /data/data/####/files/.imprint
- /data/data/####/shared_prefs/util_preference.xml
- /sdcard/Android/data/####/cache/uil-images/3x9tsaw6ntw8gwmhkf8j6fxl0.0.tmp
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/Android/data/####/cache/uil-images/34y3gdls3uriwu959197kf7ks.0.tmp
- /sdcard/Android/data/####/cache/uil-images/11scco0dhaxzxax2564zhmiw.0.tmp
- /data/data/####/app_dex/utopay.dex
- /sdcard/Android/data/####/cache/uil-images/2fadgy87dg43gx5bih1ozxm6m.0.tmp
- /sdcard/Android/data/####/cache/uil-images/2ekuv5yhlquristq42zode5hz.0.tmp
- /data/data/####/shared_prefs/Filter.xml
- /sdcard/Android/data/####/cache/uil-images/2k1qp20y1nwngmrrukyjs72tx.0
- /sdcard/Android/data/####/cache/uil-images/4nch0x1ex37org4hcde01uojl.0
- /data/data/####/shared_prefs/wosdk_day.xml
- /sdcard/Android/data/####/cache/uil-images/4cs1c48wxd22wf7ix4nok4kyj.0.tmp
- /sdcard/Android/data/####/cache/uil-images/6h9em7cq22bx0vvcagdcbe1m5.0.tmp
- /data/data/####/files/umeng_it.cache
- /sdcard/Android/data/####/cache/uil-images/7d4wrkojm2hzahpccjz141y59.0.tmp
- /sdcard/Android/data/####/cache/.nomedia
- /sdcard/Android/data/####/cache/uil-images/48sf4prigi28zit7gwirjgusa.0
- /sdcard/Android/data/####/cache/uil-images/6krfz30zndke9ynbur3mqpy5g.0.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /sdcard/Android/data/####/cache/uil-images/3ph174fvh87itda5u4z0wuh46.0.tmp
- /data/data/####/app_dex/utopay.zip
- /sdcard/Android/data/####/cache/uil-images/3urhku8rtjaknwhjiw2cqg2un.0.tmp
- /sdcard/Android/data/####/cache/uil-images/journal.tmp
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /sdcard/Android/data/####/cache/uil-images/6bm530eboe2x9lgswh2e3f9oz.0.tmp
Другие:
Запускает следующие shell-скрипты:
- getprop apps.customerservice.device
Может автоматически отправлять СМС-сообщения.
