Android.SmsSend.16374

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

075585181130: cyMjUwMDI2Njk5MTg3NzQzIzM1NjUwNzA1OTM1MTg5NSM0LjMuMQ==

Сетевая активность:

Подключается к:

2####.####.140
1####.####.80:8000
2####.####.140:8080
1####.####.67
g####.####.net
1####.####.192
unitedp####.####.com
sd####.####.com
1####.####.80
w####.####.com:7758
d####.####.com
w####.####.com
1####.####.238
g####.####.net:8080

Запросы HTTP GET:

d####.####.com/egsb/startup/queryConfiguration?channelId=####&contentId=####&gameType=####
unitedp####.####.com/numberbank/interface?getInfo=####
1####.####.67/codex/version
1####.####.192/unitedpay_sdk/version
unitedp####.####.com/script/qsg/qxgwdb_340_J_a1ad_xgm_170213/version_tag

Запросы HTTP POST:

g####.####.net:8080/migusdk/verification/checkSdkUpdate
2####.####.140:8080/migusdk/tl/enclog
1####.####.80:8000/intp/e7363ef88cacf293c9eb1d274be9d77a7d9d3daa
sd####.####.com/behaviorLogging/eventLogging/accept?
1####.####.80/intp/e7363ef88cacf293c9eb1d274be9d77a7d9d3daa
1####.####.238/updata/interface.html
g####.####.net/migusdk/tl/tcttl
g####.####.net/migusdk/verification/checkSdkUpdate
w####.####.com/normandie/QueryConfigPolicy
2####.####.140/migusdk/tl/enclog
d####.####.com/egsb/game/getPaymentCapability
w####.####.com:7758/normandie/QueryConfigPolicy
d####.####.com/egsb/thirdPay/queryThirdPayInfo

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/files/Y97W5gIdK2VozWRqeSddvH1dhI6KFQdTnxUDVA==/GqPoMLguOJw7ZnhYEhRH2g==
/data/data/####/files/edfile/armeabi/libmiguED.so
/data/data/####/files/mgid.dat
/data/data/####/files/MiguPay.Sdk30.Lib_12003003_4d4c7afc770b3429d59fe361edcdfd5f_BN202.dat
/data/data/####/files/libmgRun_04.22.05_01.so
/data/data/####/app_lemuellabs_reserved_/ac9fdd24d22db9e8.jar
/data/data/####/files/MiguPay.Sdk30.Lib_12003003_4d4c7afc770b3429d59fe361edcdfd5f_BN202.cod
/data/data/####/app_lemuellabs_reserved_/b30a9ba29fe7361b.jar
/data/data/####/app_lemuellabs_reserved_/lemuel_security_inner.so
/data/data/####/files/ly.jar
/data/data/####/app_lemuellabs_reserved/13efab4010d9f600.jar
/data/data/####/files/mgSS.dat
/data/data/####/app_lemuellabs_reserved_/codex_inner.so
/data/data/####/app_lemuellabs_reserved/894ebae3e470d533.jar
/data/data/####/files/Y97W5gIdK2VozWRqeSddvH1dhI6KFQdTnxUDVA==/CCd6CZ6hVzghHInrXDa8tg==.new
/sdcard/Download/data/cn.cmgame.sdk/sdk_prefs.txt
/data/data/####/app_lemuellabs_reserved/f425b77f7dec8801.jar
/data/data/####/app_lemuellabs_reserved_/26d426864522923d.jar
/data/data/####/app_lemuellabs_reserved/ddb336645ea5ffa9.jar
/data/data/####/files/ED.ini
/data/data/####/app_lemuellabs_reserved_/3e81a239134333bb.jar
/data/data/####/files/UNITEDPAYACTLIST_
/data/data/####/files/mgAS.dat
/data/data/####/files/gecobq_d/gecobq_f.zip
/data/data/####/shared_prefs/pref_file.xml
/data/data/####/files/hbilling.dat
/sdcard/Download/data/cn.cmgame.sdk/ShareData.txt
/data/data/####/files/Y97W5gIdK2VozWRqeSddvH1dhI6KFQdTnxUDVA==/GqPoMLguOJw7ZnhYEhRH2g==.new
/data/data/####/app_lemuellabs_reserved/05fd817409b1f66c.jar
/sdcard/Download/data/cn.cmgame.sdk/msgflag.txt
/data/data/####/app_lemuellabs_reserved/codex.so
/data/data/####/shared_prefs/pref_file.xml.bak
/data/data/####/temp.dex
/sdcard/Download/data/cn.cmgame.sdk/log/deviceId.txt