Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 12114: 优易付注册,保护您的账号安全,安全码@FCR6810316A9DC0f
Сетевая активность:
Подключается к:
- reso####.####.net
- unipa####.####.cn:8080
- jiangai####.com
- f####.####.com
- f####.####.com:26000
- a####.####.com
Запросы HTTP GET:
- reso####.####.net/gslb/?ver=####&type=####&connpt=####&uuid=####&list=####&key=####
- jiangai####.com/picture//201407/23/11/08/1406084916292ADF99C9.jpg
- unipa####.####.cn:8080/SDKStoreManager/sdkRequest/sdkupdate.do?sdktype=####¤tversion=####&IMSI=####&operation=####&channelid=####&appid=####&cpi...
- jiangai####.com/ImageResize.JPG?pic=####&w=####&h=####&t=####&i=####&y=####
Запросы HTTP POST:
- jiangai####.com/resource/v2/userservice/ispayuser
- jiangai####.com/resource/v2/userservice/reg
- jiangai####.com/resource/v2/sysservice/payswitch
- jiangai####.com/resource/v2/userservice/getalbumphotolist
- jiangai####.com/resource/v2/msgservice/getunredemsgnum
- jiangai####.com/resource/v2/searchservice/getrecommenduserlist/v2
- jiangai####.com/resource/v2/searchservice/getuser
- jiangai####.com/resource/v2/sysservice/stat
- jiangai####.com/resource/v2/msgservice/getmsglist
- jiangai####.com/resource/v2/billservice/channelbillstate
- jiangai####.com/resource/v2/componentservice/getfateuid
- f####.####.com:26000/gamefee/sdk/dot_upload
- a####.####.com/app_logs
- jiangai####.com/resource/v2/searchservice/getrecommenduserlist
- f####.####.com/gamefee/sdk/init
- jiangai####.com/resource/v2/sysservice/activationcount
- jiangai####.com/resource/v2/userservice/touserinfo
- jiangai####.com/resource/v2/regservice/regguide/v2
- jiangai####.com/resource/v2/userservice/getmt
- jiangai####.com/resource/v2/msgservice/bombbox
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/.um/um_cache_1485419092577.env
- /data/data/####/.cnunicom/3.2.1_resource.apk
- /data/data/####/shared_prefs/mipush.xml.bak
- /data/data/####/shared_prefs/mipush.xml
- /sdcard/com.jiangaihunlian.db/jahl.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/user_login.xml
- /data/data/####/shared_prefs/mipush_extra.xml
- /data/data/####/shared_prefs/hpay_game_config.xml.bak
- /data/data/####/.ucache/unicom_classez.jar
- /data/data/####/files/.imprint
- /sdcard/Android/data/####/cache/6552ax0x7y7hqdr65u7942zzt.tmp
- /data/data/####/shared_prefs/hpay_game_config.xml
- /data/data/####/cache/volley/-13099803652040756959
- /data/data/####/cache/volley/-1842701883447925753
- /sdcard/com.jiangaihunlian.db/jahl.db-journal
- /data/data/####/shared_prefs/user_info.xml
- /data/data/####/files/mobclick_agent_cached_####11
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/Android/data/####/cache/maxs5zak9qto2mk3dynaid1r.tmp
- /data/data/####/shared_prefs/activation.xml
- /data/data/####/shared_prefs/mobclick_agent_user_####.xml
- /data/data/####/cache/volley/-1955346620-247450088
- /sdcard/Android/data/####/cache/6mp120jzbge8j6p2yu62w0bay.tmp
- /data/data/####/cache/volley/910389325-1451086862
- /data/data/####/cache/volley/910389325-194762105
- /sdcard/Android/data/####/cache/1s05ruqocg4aeee1pg8efk817.tmp
- /sdcard/Android/data/####/cache/v4ff2xsigal4msblc4evnlws.tmp
- /data/data/####/shared_prefs/close_headmenu.xml
- /sdcard/Android/data/####/cache/2sbljhjzt6ejtdftb8iomuwff.tmp
- /data/data/####/shared_prefs/hpay.xml
- /data/data/####/files/####:pushservice
- /sdcard/hpay100/.hpay_device_id
- /data/data/####/cache/volley/-1954685540967834319
- /sdcard/Android/data/####/cache/4hvei85mz0hwgyu2u2ne0ror.tmp
- /data/data/####/cache/volley/-1206610085338781526
- /data/data/####/files/umeng_it.cache
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/sdk_load_info.xml
- /data/data/####/cache/volley/21075773781960088591
- /data/data/####/shared_prefs/returnphone.xml
- /data/data/####/shared_prefs/user_reg_date.xml
- /data/data/####/shared_prefs/unicomsdk.xml
- /data/data/####/shared_prefs/mipush_account.xml
- /data/data/####/shared_prefs/sdk_load_info.xml.bak
- /sdcard/Android/data/####/cache/523dl6aqd07wqi5th05ksfslp.tmp
- /data/data/####/.ulibs/libunicomsdk.so
- /sdcard/com.jiangaihunlian/files/1495415477
- /data/data/####/shared_prefs/pref_registered_pkg_names.xml
- /data/data/####/cache/volley/910389325-1641783214
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh -c ps
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
