Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 12114: 苏州易N支付##########
Сетевая активность:
Подключается к:
- s####.####.com
- h####.####.com:808
- h####.####.com
- 1####.####.56:9039
- p####.####.com:13579
- p####.####.com
- 1####.cn
- d####.####.com
- p####.####.com:808
- s####.####.com:4001
- p####.####.com:6680
- 1####.####.56
- cd####.####.com
- thirdpa####.####.com
Запросы HTTP GET:
- h####.####.com/uploads/img/1-3-10.jpg
- d####.####.com/ml212.jar
- h####.####.com/uploads/img/1-2-2.jpg
- h####.####.com/uploads/img/1-1-7.jpg
- cd####.####.com/download/dex/ep.jar
- h####.####.com/uploads/img/1-3-2.jpg
- h####.####.com/uploads/img/1-2-5.jpg
- h####.####.com/uploads/img/1-1-4.jpg
- h####.####.com/uploads/img/1-1-1.jpg
- h####.####.com/uploads/img/1-1-2.jpg
- h####.####.com/uploads/img/1-3-9.jpg
- h####.####.com/uploads/img/1-2-6.jpg
- h####.####.com/uploads/img/1-1-9.jpg
- h####.####.com/uploads/img/1-1-18.jpg
- h####.####.com/uploads/img/1-3-26.jpg
- h####.####.com/uploads/img/1-1-21.jpg
- h####.####.com/uploads/img/1-1-14.jpg
- h####.####.com/uploads/comment/1007747-1.jpg
- h####.####.com/uploads/img/1-1-12.jpg
- 1####.####.56/gamesit/jysdk/initsdk?os_info=####&os_model=####&net_info=####&imsi=####&imei=####
- h####.####.com/uploads/img/1-3-21.jpg
- h####.####.com/uploads/img/1-1-13.jpg
- h####.####.com/uploads/img/iaf0amkfvqm4jch.jpg
- h####.####.com/uploads/img/1-3-14.jpg
- h####.####.com/uploads/img/1-2-8.jpg
- h####.####.com/uploads/img/1-1-19.jpg
- h####.####.com/uploads/comment/4731146-1.jpg
- h####.####.com/uploads/img/1-3-17.jpg
- h####.####.com/uploads/img/1-1-8.jpg
- h####.####.com/uploads/img/1-1-17..jpg
- h####.####.com/uploads/img/1-3-25.jpg
- h####.####.com/uploads/img/gtotbd2les7sxml.jpg
- h####.####.com/uploads/img/1-2-1.jpg
- h####.####.com/uploads/img/wqvtt6uej4cwl0c.jpg
- h####.####.com/uploads/img/6joq8eg1qygmsjf.jpg
- h####.####.com/uploads/img/1-3-7.jpg
- 1####.cn/order/getPort
- h####.####.com/uploads/img/1-1-24.jpg
- h####.####.com/uploads/img/1-1-11.jpg
- h####.####.com/uploads/img/1-3-18.jpg
- h####.####.com/uploads/img/1-3-24.jpg
- h####.####.com/uploads/img/1-3-22.jpg
- h####.####.com/uploads/img/1-1-22.jpg
- h####.####.com/uploads/img/1-1-5.jpg
- h####.####.com/uploads/img/1-1-23.jpg
- h####.####.com/uploads/img/kyjetvjnrn4fzbh.jpg
- h####.####.com/uploads/img/1-3-8.jpg
- h####.####.com/uploads/img/1-3-27.jpg
- h####.####.com/uploads/img/1-3-3.jpg
- h####.####.com/uploads/img/1-1-16.jpg
- h####.####.com/uploads/img/1-3-19.jpg
- h####.####.com/uploads/img/1-2-3.jpg
- h####.####.com/uploads/img/1-1-3.jpg
- h####.####.com/uploads/img/1-1-15.jpg
- 1####.####.56//gamesit/xysdk/init
- h####.####.com/uploads/img/1-3-23.jpg
- h####.####.com/uploads/img/1-3-20.jpg
- h####.####.com/uploads/comment/7253932-2.jpg
- h####.####.com/uploads/img/anhbkovwkphcrpg.jpg
- h####.####.com/uploads/img/1-1-10.jpg
- h####.####.com/uploads/img/1-1-20.jpg
- h####.####.com/uploads/img/1-1-6.jpg
- h####.####.com/uploads/img/97kfjeq73elzxvm.jpg
- h####.####.com/uploads/comment/295894372-2.jpg
- 1####.####.56:9039/gamesit/puinit/data
- h####.####.com/uploads/img/1-3-6.jpg
- h####.####.com/uploads/img/6dyhghmvatiuimz.jpg
- h####.####.com/uploads/img/1-2-7.jpg
- h####.####.com/uploads/img/1-3-5.jpg
- h####.####.com/uploads/comment/6061887-2.jpg
- h####.####.com/uploads/img/1-2-4.jpg
Запросы HTTP POST:
- h####.####.com/userapi/movie
- p####.####.com/SmsPayServer/sms/initMobile/initInfoNew
- h####.####.com:808/userapi/home
- h####.####.com/userapi/home
- p####.####.com:13579/SMSpay/api/updateVersion.do?
- thirdpa####.####.com/CpInfoServlet
- p####.####.com/SmsPayServer/sms/initMobile/province
- p####.####.com/paypalt_res/offline/sms.txt
- p####.####.com/SmsPayServer/sms/extra/getbrushpuv
- 1####.cn/phone/fetch
- h####.####.com/userapi/xieyihome
- s####.####.com/ymsdkv1/api05
- p####.####.com:808/userapi/add
- thirdpa####.####.com/r
- h####.####.com/userapi/comment
- s####.####.com:4001/ymsdkv1/api05
- p####.####.com:6680/paypalt_res/offline/sms.txt
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/volley/1026966199-2109616260
- /data/data/####/cache/volley/1026966199-2113310344
- /data/data/####/cache/volley/1586242491-2047333879
- /data/data/####/cache/volley/1026966199-360903769
- /data/data/####/cache/volley/1026966199-364597853
- /data/data/####/cache/volley/1026966199-362750811
- /data/data/####/shared_prefs/srnvram.xml
- /data/data/####/files/cache.info
- /data/data/####/cache/volley/1026966199-1173020958
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/volley/10269661991291382708
- /data/data/####/files/payinfo.info
- /data/data/####/cache/volley/1026966199407573111
- /data/data/####/cache/volley/1026966199-2110539781
- /data/data/####/cache/volley/1026966199-391379962
- /data/data/####/files/ymsdk_01.jar
- /data/data/####/cache/volley/1026966199-1170250395
- /data/data/####/cache/volley/1026966199-384915315
- /data/data/####/cache/volley/1026966199-1171173916
- /data/data/####/databases/milipay_sms_one.db-journal
- /data/data/####/cache/volley/10269661991296923834
- /data/data/####/cache/volley/1026966199406649590
- /data/data/####/cache/volley/1026966199-2115157386
- /data/data/####/shared_prefs/xy45405.xml.xml
- /data/data/####/cache/volley/1026966199404802548
- /data/data/####/cache/volley/1026966199409420153
- /data/data/####/files/kkapp.dat
- /data/data/####/shared_prefs/DexPref.xml
- /data/data/####/cache/volley/10269661991293229750
- /data/data/####/cache/volley/-551486098957587319
- /data/data/####/cache/volley/1026966199402955506
- /data/data/####/cache/volley/17711812081745244696
- /data/data/####/cache/volley/1026966199-363674332
- /data/data/####/cache/volley/1026966199-361827290
- /data/data/####/shared_prefs/util_preference.xml
- /data/data/####/databases/lepeng.db-journal
- /data/data/####/cache/volley/1026966199-1172097437
- /data/data/####/cache/volley/1586242491-573481113
- /data/data/####/cache/volley/1026966199408496632
- /data/data/####/databases/sms_db
- /data/data/####/cache/volley/1928877077119841685
- /data/data/####/cache/volley/1928877077243897384
- /data/data/####/cache/volley/1026966199-388609399
- /data/data/####/cache/volley/1026966199-389532920
- /data/data/####/cache/volley/1026966199-387685878
- /data/data/####/files/libymsdk_21037.so
- /data/data/####/shared_prefs/xy001002.xml.xml
- /data/data/####/cache/volley/1026966199-1168403353
- /data/data/####/databases/database-journal
- /data/data/####/cache/volley/10269661991290459187
- /data/data/####/shared_prefs/xy001.xml.xml
- /data/data/####/cache/volley/1026966199403879027
- /data/data/####/cache/volley/1026966199-393227004
- /data/data/####/cache/volley/1026966199-1198879546
- /data/data/####/shared_prefs/com_epplus_sdk_prefer.xml
- /data/data/####/cache/volley/10269661991292306229
- /data/data/####/shared_prefs/payInfo.xml
- /data/data/####/cache/volley/1026966199-1194261941
- /data/data/####/cache/volley/-4334318721703589877
- /data/data/####/cache/volley/1026966199-1167479832
- /data/data/####/cache/volley/1026966199410343674
- /data/data/####/cache/volley/10269661991294153271
- /data/data/####/cache/volley/1026966199405726069
- /data/data/####/cache/volley/1928877077-1351303601
- /data/data/####/cache/info/ml206.jar
- /data/data/####/cache/volley/1026966199-2111463302
- /data/data/####/cache/volley/1026966199-1195185462
- /data/data/####/cache/volley/1026966199-392303483
- /data/data/####/cache/volley/1026966199-385838836
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/mj.apk
- /data/data/####/cache/volley/1026966199-390456441
- /data/data/####/cache/volley/1026966199-1202573630
- /data/data/####/files/ep.txt
- /data/data/####/cache/volley/19288770771058113636
- /data/data/####/cache/volley/1026966199-2116080907
- /data/data/####/files/jarinfo.info
- /data/data/####/cache/volley/10269661991296000313
- /data/data/####/shared_prefs/zhangpay_sms_info.xml
- /data/data/####/cache/volley/1586242491637668952
- /data/data/####/files/goonpost.info
- /data/data/####/cache/volley/1026966199-1173944479
- /data/data/####/cache/volley/1586242491-67766923
- /data/data/####/databases/sms_db-journal
- /data/data/####/cache/volley/10269661991295076792
- /data/data/####/shared_prefs/zhangpay_share.xml.bak
- /data/data/####/cache/volley/1026966199-1196108983
- /data/data/####/cache/volley/1026966199-1169326874
- /data/data/####/shared_prefs/zhangpay_share.xml
- /data/data/####/cache/volley/1026966199-2112386823
Другие:
Запускает следующие shell-скрипты:
- getprop apps.customerservice.device
Может автоматически отправлять СМС-сообщения.
