Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SkyMobi.5.origin
- Android.RemoteCode.32
Отправляет данные получаемых СМС-сообщений на удалённый хост.
Сетевая активность:
Подключается к:
- iji####.com
- huangda####.com
- v####.####.com
- 6####.####.140
- t####.####.net
- b####.com
- s####.####.com
- 7j####.####.com
- 1####.####.com
- c-h####.####.com
- 1####.####.148
- w####.####.com
- and####.####.com
- d####.####.net
- t####.####.cn
- i####.####.cn
- m####.####.com
- a####.####.com
- and####.####.com:8077
Запросы HTTP GET:
- v####.####.com/pic/tcmn/mnfw/2015/10/09/0039820234856.jpg
- m####.####.com/ando-res/m/fUuctJnkGSxsEOC6TaFXT4moCtSmKHc5drsBHRgzJD7z6QsMCVtUjA
- v####.####.com/pic/tcmn/banner/rule_20160108.jpg
- 1####.####.com/ic.asp
- v####.####.com/pic/tcmn/mnfw/2015/10/09/0039841396350.jpg
- w####.####.com/r/378609775/index.htm?cm=####
- d####.####.net/apkf/3rdapk2/M01/0E/3A/wKhklFhOQDSAWLR7AAC7_347Ocw630.apk
- iji####.com/tcmn/user/get_user_tag?vncode=####&channel=####
- b####.com/
- d####.####.net/apkf/3rdapk2/M00/01/A9/wKhklVaxarmAY7oLAAGew4Nsm_s737.apk
- i####.####.cn/iplookup/iplookup.php?format=####
- v####.####.com/pic/tcmn/banner/banner_20160919.jpg
- 7j####.####.com/tdata_GJm364
- s####.####.com/config/hz-hzv3.conf
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&simid=####&v=####&smsc=####&et=####&imsi=####&imei=####
- w####.####.com/r/p/lyxy.jsp?ln=####&t1=####&cm=####
- iji####.com/tcmn/tyvideo/get_mmplayer?vncode=####&channel=####&pkg=####&isThird=####&vistorNo=####&androidID=####&imei=####&imsi=####&simcode=####&sdk...
- iji####.com/tcmn/user/get_user_notice?vncode=####&channel=####&uid=####&prv_sign=####
- d####.####.net/apkf/3rdapk2/M01/0F/82/wKhklFiFe92AE1NeAAQYN1n4N4Q886.apk
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=####&type=####&system=####&simid=####&v=####&smsc=####&et=####&imsi=####&imei=...
- d####.####.net/apkf/3rdapk2/M01/0E/50/wKhklVhbmUCALwZpAALbi-DxROA978.apk
- v####.####.com/version/tcmn/app/mmplay
- iji####.com/tcmn/home/notification/1?vncode=####&channel=####&pkg=####&isThird=####&vistorNo=####&androidID=####&imei=####&imsi=####&simcode=####
- a####.####.com/fetch.php?gid=####&ch=####&key=####
- v####.####.com/pic/tcmn/mnfw/2015/09/21/3999384708284.jpg
- w####.####.com/r/378609775/378609778/index.htm?cm=####
- v####.####.com/pic/tcmn/mnfw/2015/10/09/0039867577916.jpg
- iji####.com/tcmn/iploc/get_ip
- v####.####.com/pic/tcmn/2016/01/22/5512630642883.jpg
- iji####.com/tcmn/home/mnfw/1?record_id=####&vncode=####&channel=####&uid=####&prv_sign=####&gender=####&pkg=####&isThird=####&vistorNo=####&androidID=...
- 7j####.####.com/tdata_vlu576
- iji####.com/tcmn/home/user_setting?vncode=####&channel=####&uid=####&prv_sign=####&pkg=####&isThird=####&vistorNo=####&androidID=####&imei=####&imsi=#...
- 1####.####.148/applications.json?api_key=####
- d####.####.net/apkf/3rdapk2/M01/0E/50/wKhklFhbmVeAQiZYAAn7f81SmP0972.apk
- m####.####.com/course/504703.html?cm=####
- w####.####.com/r/p/index.jsp?vt=####&cm=####
- b####.com/search/error.html
- a####.####.com/apistore/mobilenumber/mobilenumber?phone=####
- huangda####.com/resource!resource?resTypes=####&carrierCode=####&pushId=####&dexVer=####&appid=####&appVer=####&channel=####&manu=####&type=####&imsi=...
- d####.####.net/apkf/3rdapk2/M00/02/CA/wKhklFcsNaiAAJnOAARvS9T3oS8756.apk
- huangda####.com/resource!chargeUpdate?resTypes=####&dexId=####&dexVer=####&appid=####&appVer=####&channel=####
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=####&type=####&system=####&imsi=####&imei=####&dpi=####&v=####&smsc=####&et=##...
- d####.####.net/apkf/3rdapk2/M01/0C/53/wKhklVgcJiSAS1maAAGLoBOH4oA961.apk
- v####.####.com/pic/tcmn/mnfw/2015/10/09/0039859150530.jpg
Запросы HTTP POST:
- and####.####.com/record-plat/record/upload.do
- a####.####.com/v1/device
- iji####.com/tcmn/pvuv/check_device?tt=####&pkg=####
- and####.####.com/zm-adv-mis/recommwall/active/query.do
- iji####.com/tcmn/pvuv/record?isRtn=####&pkg=####&apiName=####
- a####.####.com/v1/conf/profile
- 6####.####.140/ando/x/liv?app_id=####&r=####
- and####.####.com/zm-adv-mis/recommwall/list/query.do
- and####.####.com/zm-adv-mis/adv/list/query.do
- and####.####.com:8077/query-plat/cap/query.do
- and####.####.com/android/sms/netpay/prefetch.do
- huangda####.com/shop/shop_upload_log
- c-h####.####.com/api.php?format=####&t=####
- s####.####.com/api.php?format=####&t=####
- t####.####.net/g/d?crc=####
- t####.####.cn/api/q/a/3f6ec4da684547211e371a67946d85757
- iji####.com/tcmn/user/register/2
- and####.####.com/record-plat/seq/query.do
- and####.####.com/zm-adv-mis/folder/list/query.do
- and####.####.com/zm-adv-mis/advplugin/query.do
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/com.fjlfywon.oweiyocodwer/SkyAdver_file/LatestPushIndex
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/plugin.info
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/app_payload_odex/H5Lj3I8bCfd_payload.apk
- /data/data/####/shared_prefs/pref.xml
- /sdcard/.env/.uunique.new
- /data/data/####/shared_prefs/firstStart.xml
- /data/data/####/Plugin/com.azwxuocceujtrptv/lib/libzimon.so
- /sdcard/.twservice/qshp_3002_2229.zip
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/mobclick_agent_cached_####84
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.pussdk.new.apk.temp
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/com.fjlfywon.oweiyocodwer/SkyAdver_file/NextReqInterval
- /data/data/####/shared_prefs/result.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data
- /data/data/####/databases/mpush_app.db-journal
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/com.fjlfywon.oweiyocodwer/SkyAdver_file/PushDataServerTime
- /data/data/####/cache/webviewCacheChromium/index
- /sdcard/system/tmp/local/tdata_GJm364
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.new.data
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.tongyusdk.new.apk
- /data/data/####/Plugin/com.azwxuocceujtrptv/lib/libtm_pay.so
- /data/data/####/files/mpush_gateway_preferences_file
- /data/data/####/Plugin/com.fjlfywon.oweiyocodwer/lib/libplugin_phone.so
- /data/data/####/files/mpush_version_preferences_file
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.hssdk.new.apk.temp
- /data/data/####/shared_prefs/mi_first.xml
- /sdcard/libs/com.fjlfywon.oweiyocodwer.db
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.new.data.temp
- /data/data/####/Plugin/com.azwxuocceujtrptv/Signature/Signature_0.key
- /data/data/####/Plugin/com.azwxuocceujtrptv/apk/base-1.apk
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/cache/webviewCacheChromium/f_000001
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.pussdk.new.apk
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /sdcard/com.fjlfywon.oweiyocodwer/apk/f42a2f3be7be22d7413a108337d7f9e0
- /sdcard/.twservice/qshp_3002_2229/tw
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/com.fjlfywon.oweiyocodwer/SkyAdver_file/PushDataReciveTime
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/shared_prefs/TDCloudSettingsConfig123AE38EA588329A81ACCC192381C1A2.xml.bak
- /data/data/####/Plugin/com.azwxuocceujtrptv/dalvik-cache/base-1.dex
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yummysdk.new.apk
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/shared_prefs/TDpref_shorttime.xml
- /data/data/####/Plugin/com.fjlfywon.oweiyocodwer/Signature/Signature_0.key
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_push/dolls_push/sharemem_push.lock
- /sdcard/.tcookieid
- /sdcard/system/tmp/local/tdata_vlu576
- /data/data/####/shared_prefs/TDCloudSettingsConfig123AE38EA588329A81ACCC192381C1A2.xml
- /data/data/####/Plugin/com.azwxuocceujtrptv/lib/libplugin_phone.so
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yummysdk.new.apk.temp
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_main/key_ServerPluginInfo
- /sdcard/libs/com.getui.sdk.deviceId.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/firstEnter.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.tongyusdk.new.apk.temp
- /data/data/####/app_payload_odex/Al3F7mJC26n_payload.apk
- /data/data/####/files/td.lock
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.new.data.temp
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.hssdk.new.apk
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /data/data/####/Plugin/com.fjlfywon.oweiyocodwer/apk/base-1.apk
- /data/data/####/files/tdlock.txt
- /data/data/####/shared_prefs/TDpref_longtime.xml.bak
- /data/data/####/shared_prefs/phoneTest.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.data
- /sdcard/libs/app.db
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.new.data
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.data
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/com.fjlfywon.oweiyocodwer/SkyAdver_file/NotifyBarAdvResponse
- /sdcard/Android/data/com.skymobi.pay.newsdk/user.sys
- /data/data/####/shared_prefs/tdid.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
- /data/data/####/Plugin/com.fjlfywon.oweiyocodwer/dalvik-cache/base-1.dex
- /data/data/####/Plugin/com.fjlfywon.oweiyocodwer/lib/tmp.pk2108
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.data.temp
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/Plugin/com.azwxuocceujtrptv/lib/libtm_pay.so
- /data/data/####/Plugin/com.fjlfywon.oweiyocodwer/lib/libplugin_phone.so
- /data/data/####/Plugin/com.azwxuocceujtrptv/lib/libzimon.so
- /data/data/####/Plugin/com.azwxuocceujtrptv/lib/libplugin_phone.so
Другие:
Может автоматически отправлять СМС-сообщения.
