Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 1069099903306: ####
Отправляет данные получаемых СМС-сообщений на удалённый хост.
Сетевая активность:
Подключается к:
- p####.####.cn
- m####.####.com
- kay####.cn
- col####.####.com
- a####.####.com
Запросы HTTP GET:
- kay####.cn/photo/%E8%AF%95%E7%9C%8B%E5%9B%BE%E7%89%87/%E6%92%AD%E6%94%BE%E5%86%85%E9%A1%B5/lb3.jpg
- m####.####.com/c.php?id=####
- kay####.cn/photo/home/q7.jpg
- kay####.cn/photo/home/q19.jpg
- kay####.cn/photo/home/q12.jpg
- kay####.cn/photo/home/q10.jpg
- kay####.cn/photo/home/q14.jpg
- kay####.cn/photo/ps/jiesuo.jpg
- kay####.cn/photo/%E8%AF%95%E7%9C%8B%E5%9B%BE%E7%89%87/%E6%92%AD%E6%94%BE%E5%86%85%E9%A1%B5/lb1.jpg
- kay####.cn/photo/home/q11.jpg
- kay####.cn/photo/home/q3.jpg
- kay####.cn/photo/????/????/lb1####
- kay####.cn/photo/ps/nvpn.jpg
- kay####.cn/photo/home/q2.jpg
- kay####.cn/photo/home/q4.jpg
- kay####.cn/photo/home/q13.jpg
- kay####.cn/photo/home/q15.jpg
- kay####.cn/photo/home/q18.jpg
- kay####.cn/photo/%E8%AF%95%E7%9C%8B%E5%9B%BE%E7%89%87/%E6%92%AD%E6%94%BE%E5%86%85%E9%A1%B5/lb2.jpg
- kay####.cn/photo/home/q6.jpg
- kay####.cn/photo/home/q9.jpg
- kay####.cn/photo/home/q17.jpg
- kay####.cn/photo/ps/zf38.jpg
- kay####.cn/photo/home/q1.jpg
- kay####.cn/photo/home/q5.jpg
- kay####.cn/photo/home/q16.jpg
- kay####.cn/photo/ps/video_black_bg18.jpg
- kay####.cn/photo/home/q8.jpg
- kay####.cn/photo/%E8%AF%95%E7%9C%8B%E5%9B%BE%E7%89%87/%E6%92%AD%E6%94%BE%E5%86%85%E9%A1%B5/lb4.jpg
- kay####.cn/photo/home/q20.jpg
Запросы HTTP POST:
- col####.####.com/pay-sms-access//getAccessPayChannel.json
- p####.####.cn/api/home?imei=####&cid=####
- col####.####.com/pay-data-collect/uploadChannelNormalData.json
- col####.####.com/pay-data-collect/collectAppStartUserData.json
- a####.####.com/app_logs
- col####.####.com/mobile-service/getOpenImsiMobilePhone.json
- col####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
- p####.####.cn/api/init?imei=####&cid=####
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/Android/data/####/cache/793dnidfsy0pcrh0b079y1udl.tmp
- /sdcard/Android/data/####/cache/4zuo5510ycut8auunkqktmxr8.tmp
- /data/data/####/cache/picasso-cache/b7030efadba16f9b35b1c24a1d465291.1.tmp
- /sdcard/WYKB/play015.txt
- /data/data/####/cache/picasso-cache/f2e98c1c5afd6170616a172e8d655ae1.1.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Android/data/####/cache/quqaova9akv8vb6cmina0sco.tmp
- /sdcard/Android/data/####/cache/6kbnf9vurxehsomqsqywjzzhk.tmp
- /data/data/####/cache/picasso-cache/3606f462bdd03948eef85aae159030c5.1
- /sdcard/Android/data/####/cache/47q2xptm0pl2fu64mu1f85j8u
- /sdcard/Android/data/####/cache/3q28b608rcvfruypmrczq9m9s
- /data/data/####/cache/picasso-cache/b8cf94d12e490f7c7c4f2bb03c4edb52.0.tmp
- /data/data/####/cache/picasso-cache/e4b014cc65cd2fc2602e092fa4c97376.1.tmp
- /data/data/####/cache/picasso-cache/journal.tmp
- /data/data/####/cache/picasso-cache/b8cf94d12e490f7c7c4f2bb03c4edb52.1
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/dalvik-cache/base-1.dex
- /data/data/####/cache/picasso-cache/6c28e063dbaa80c895e0b7e0737d3432.1
- /data/data/####/cache/picasso-cache/7e81314c13782aa5876c616bfcbda9a4.1.tmp
- /data/data/####/cache/picasso-cache/68093359017f7630c889a95e1b79f962.0.tmp
- /sdcard/Android/data/####/cache/40u0w5vheixnobaifd2prcujx.tmp
- /data/data/####/cache/sms.apk.apk
- /sdcard/Android/data/####/cache/4bk3t8s64biiusr0fulkea6i7
- /data/data/####/cache/picasso-cache/6893d05a46da2517c9a969ccca444d68.0.tmp
- /data/data/####/cache/picasso-cache/28d1dd474f06a3da2a26705e7941e695.0.tmp
- /data/data/####/cache/picasso-cache/7a81583cebf383866cd1db72f2ace609.1
- /data/data/####/cache/picasso-cache/af92e4edafbf08522055962dca7ece27.0.tmp
- /data/data/####/cache/picasso-cache/f2e98c1c5afd6170616a172e8d655ae1.0.tmp
- /sdcard/Android/data/####/cache/65qaob1vyrylsjm1cwb0lpe8y.tmp
- /sdcard/Android/data/####/cache/3st025q0cumhjql81mxj1dky4
- /sdcard/Android/data/####/cache/6u9sa1iqeezhvd2tsv8imudrs
- /data/data/####/cache/picasso-cache/f14163fe4cce2dafd391647ca25cdce8.1
- /data/data/####/cache/picasso-cache/f74ff17b966cec9d6f034654567b2d10.1
- /data/data/####/cache/picasso-cache/738cfdc4f7ee5cb932f6f69ee49b3f38.1.tmp
- /data/data/####/cache/picasso-cache/bc0b3b23b035d409386bdb3411aa7b53.0.tmp
- /data/data/####/cache/picasso-cache/892a7a879c1e1fc4577dfeb2e0afe285.0.tmp
- /data/data/####/cache/picasso-cache/68093359017f7630c889a95e1b79f962.1
- /data/data/####/shared_prefs/com.souying.pay.xml
- /data/data/####/app_apCoreplugn/smp.apk
- /data/data/####/cache/picasso-cache/ab9d0b3cb382296544636f80c2bffe9c.0.tmp
- /data/data/####/files/umeng_it.cache
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/databases/recordInfo-journal
- /data/data/####/cache/picasso-cache/0c60dc145bdd3e70a31728463ced0c54.0.tmp
- /data/data/####/shared_prefs/com.souying.pay.plugmain_p_config.xml
- /sdcard/Android/data/####/cache/1ymrmnvvz9ltt6t0fbd9v7dkg.tmp
- /data/data/####/cache/picasso-cache/32c412197198b1469ab6ded57fd3bc19.0.tmp
- /data/data/####/cache/picasso-cache/77234c3080a120ba00db878d0a3c1877.0.tmp
- /data/data/####/cache/picasso-cache/8cc1fce1dc855d57601b1e6866e5834f.1
- /sdcard/Android/data/####/cache/6gpyxrxd0o3vk8l6iii0ceawf.tmp
- /data/data/####/cache/picasso-cache/892a7a879c1e1fc4577dfeb2e0afe285.1
- /sdcard/Android/data/####/cache/6eip1fj8qfalbxuiuw6xu6rsi.tmp
- /data/data/####/shared_prefs/plugins.serviceMapping.xml
- /data/data/####/cache/picasso-cache/6893d05a46da2517c9a969ccca444d68.1
- /data/data/####/cache/picasso-cache/0c60dc145bdd3e70a31728463ced0c54.1
- /sdcard/Android/data/.nomedia
- /data/data/####/cache/picasso-cache/af92e4edafbf08522055962dca7ece27.1.tmp
- /data/data/####/app_apCoreplugn/sms.apk
- /data/data/####/cache/picasso-cache/551794ffac5389faeabf32b76ad39cd7.0.tmp
- /data/data/####/shared_prefs/plugins.installed.xml
- /data/data/####/cache/picasso-cache/ab9d0b3cb382296544636f80c2bffe9c.1
- /data/data/####/databases/com.souying.pay.plugmain_sy_pay_record-journal
- /sdcard/Android/data/####/cache/375b1b41bdc2opsks6mkjalz9
- /sdcard/Android/data/####/cache/719paopxwranfhvg7c7lhomm3
- /data/data/####/shared_prefs/sy_pay_config.xml.bak
- /data/data/####/cache/picasso-cache/f14163fe4cce2dafd391647ca25cdce8.0.tmp
- /data/data/####/cache/picasso-cache/bc0b3b23b035d409386bdb3411aa7b53.1
- /data/data/####/cache/picasso-cache/28d1dd474f06a3da2a26705e7941e695.1
- /data/data/####/cache/picasso-cache/7a81583cebf383866cd1db72f2ace609.0.tmp
- /sdcard/Android/data/####/cache/5v4x1j12csja0r7frk0f0jv32.tmp
- /data/data/####/cache/picasso-cache/3ee6e19fff16c8049e0d06e90de51f00.0.tmp
- /data/data/####/cache/picasso-cache/f74ff17b966cec9d6f034654567b2d10.0.tmp
- /data/data/####/cache/picasso-cache/ec64e53b5714b5a76b35f55f98d013d6.1
- /data/data/####/cache/picasso-cache/0c998758c526a8675df75458e9c23588.1.tmp
- /data/data/####/shared_prefs/sy_pay_config.xml
- /sdcard/Android/data/####/cache/71x0h34u0c8dwhttqldj0tawn.tmp
- /data/data/####/cache/picasso-cache/3ee6e19fff16c8049e0d06e90de51f00.1
- /sdcard/Android/data/####/cache/rw66jwlbsb8t08rozy4kc4db.tmp
- /sdcard/Android/data/####/cache/vfaoi5m04otyq5g01ix3do9k
- /sdcard/Android/data/####/cache/qdquwtmz438wgz65ubo8px78
- /data/data/####/cache/picasso-cache/ec64e53b5714b5a76b35f55f98d013d6.0.tmp
- /sdcard/Android/data/####/cache/6tm44f1o465ixpdyecu9okq0h.tmp
- /data/data/####/cache/picasso-cache/6c28e063dbaa80c895e0b7e0737d3432.0.tmp
- /sdcard/Android/data/####/cache/3072xs5gq8gzkwhixa4nwwheh
- /data/data/####/databases/sy_pay_record-journal
- /data/data/####/cache/smp.apk.apk
- /data/data/####/cache/picasso-cache/738cfdc4f7ee5cb932f6f69ee49b3f38.0.tmp
- /data/data/####/files/.imprint
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk
- /sdcard/Android/data/####/cache/4lvbfar71gtg5nejurcmzsvey.tmp
- /data/data/####/cache/picasso-cache/0c998758c526a8675df75458e9c23588.0.tmp
- /data/data/####/cache/picasso-cache/3606f462bdd03948eef85aae159030c5.0.tmp
- /sdcard/Android/data/####/cache/4ret27g6wdh6ifyedoj3pacbd.tmp
- /data/data/####/cache/picasso-cache/77234c3080a120ba00db878d0a3c1877.1
- /data/data/####/cache/picasso-cache/8cc1fce1dc855d57601b1e6866e5834f.0.tmp
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk
- /data/data/####/cache/picasso-cache/32c412197198b1469ab6ded57fd3bc19.1
- /data/data/####/cache/picasso-cache/7e81314c13782aa5876c616bfcbda9a4.0
- /data/data/####/cache/picasso-cache/7e81314c13782aa5876c616bfcbda9a4.1
- /sdcard/Android/data/####/cache/iikrumnf8g9zyl5w7e3pdf5c.tmp
- /data/data/####/cache/picasso-cache/e4b014cc65cd2fc2602e092fa4c97376.0.tmp
- /data/data/####/cache/picasso-cache/b7030efadba16f9b35b1c24a1d465291.0.tmp
- /sdcard/Android/data/####/cache/1m7kakvb3mg5y6adj7o1se45m.tmp
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/dalvik-cache/base-1.dex
- /data/data/####/app_apCoreplugn/ZIP/plugin-20170105-2.1.8.7.bin
- /data/data/####/cache/picasso-cache/551794ffac5389faeabf32b76ad39cd7.1
- /sdcard/Android/data/####/cache/39b5sgppkxodmiy5bw6ldlr2o.tmp
Другие:
Может автоматически отправлять СМС-сообщения.
