Android.SmsSend.16736

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

075585181130: cyMjUwMDI2Njk5MTg3NzQzIzM1NjUwNzA1OTM1MTg5NSM0LjMuMQ==

Сетевая активность:

Подключается к:

1####.####.80:8000
2####.####.140:8080
1####.####.67
unitedp####.####.com
d####.####.com
sd####.####.com
1####.####.192
p####.####.com
w####.####.com:7758
g####.####.net:8080
1####.####.238

Запросы HTTP GET:

d####.####.com/egsb/startup/queryConfiguration?channelId=####&contentId=####&gameType=####
unitedp####.####.com/numberbank/interface?getInfo=####
1####.####.67/codex/version
1####.####.192/unitedpay_sdk/version

Запросы HTTP POST:

2####.####.140:8080/migusdk/tl/enclog
p####.####.com/api/q/a/3f6ec4da684547211e371a67946d85757
sd####.####.com/behaviorLogging/eventLogging/accept?
1####.####.80:8000/intp/40bb7e3e5b1c0af3bb8bec94d4b7621be81144e2
1####.####.238/updata/interface.html
g####.####.net:8080/migusdk/tl/tcttl
w####.####.com:7758/normandie/QueryConfigPolicy

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/shared_prefs/td_pefercen_profile.xml
/data/data/####/app_lemuellabs_reserved/a52e7cdc914408b3.jar
/data/data/####/files/edfile/armeabi/libmiguED.so
/data/data/####/files/mgid.dat
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml
/data/data/####/app_lemuellabs_reserved_/2c10b6017a07c3a2.jar
/data/data/####/files/sdk_prefs
/data/data/####/files/rdata_comchzhynbj.new
/data/data/####/files/MiguPay.Sdk30.Lib_12003003_4d4c7afc770b3429d59fe361edcdfd5f_BN202.dat
/data/data/####/files/UNITEDPAYACTLIST_
/data/data/####/files/libmgRun_04.22.05_01.so
/data/data/####/files/MiguPay.Sdk30.Lib_12003003_4d4c7afc770b3429d59fe361edcdfd5f_BN202.cod
/data/data/####/files/mpush_gateway_preferences_file
/data/data/####/files/bEGgH0D3mfGv6L_8T5XZA3VGcz4z3BrY/T2ihwqW_sTt9VbWqAeXF7g==.new
/data/data/####/files/mpush_version_preferences_file
/data/data/####/files/bEGgH0D3mfGv6L_8T5XZA3VGcz4z3BrY/bdmAwdCiuQ3djMrehn_XLw==
/data/data/####/files/ly.jar
/data/data/####/shared_prefs/td_pefercen_profile.xml.bak
/data/data/####/app_lemuellabs_reserved_/codex_inner.so
/data/data/####/databases/mpush_game.db-journal
/data/data/####/files/bEGgH0D3mfGv6L_8T5XZA3VGcz4z3BrY/196TB275R4qKLhXlelSFMw==/V3ZpMXAelcrW8o_6
/data/data/####/app_lemuellabs_reserved/274af13501e0b134.jar
/sdcard/Download/data/cn.cmgame.sdk/sdk_prefs.txt
/sdcard/.tcookieid
/data/data/####/files/ED.ini
/data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
/data/data/####/files/hueiaq_d/hueiaq_f.zip
/data/data/####/files/mgAS.dat
/data/data/####/files/bEGgH0D3mfGv6L_8T5XZA3VGcz4z3BrY/sxm8rjIGH9j17-wPWA_dqg==/data.dat.tmp
/data/data/####/files/mgSS.dat
/data/data/####/shared_prefs/pref_file.xml
/data/data/####/app_lemuellabs_reserved_/lemuel_security_inner.so
/data/data/####/files/bEGgH0D3mfGv6L_8T5XZA3VGcz4z3BrY/_KPb6lmcnUNS9ipnvVBh3A==/wqSkvoeEE3ruShID.zip
/data/data/####/shared_prefs/3f6ec4da684547211e371a67946d85757|account_file.xml
/data/data/####/files/hbilling.dat
/sdcard/Download/data/cn.cmgame.sdk/ShareData.txt
/data/data/####/shared_prefs/tdid.xml
/data/data/####/files/bEGgH0D3mfGv6L_8T5XZA3VGcz4z3BrY/196TB275R4qKLhXlelSFMw==/OVQOo2I4XEfIcbB7u6FieQ==
/sdcard/Download/data/cn.cmgame.sdk/msgflag.txt
/data/data/####/app_lemuellabs_reserved/codex.so
/data/data/####/shared_prefs/pref_file.xml.bak
/data/data/####/temp.dex
/sdcard/Download/data/cn.cmgame.sdk/log/deviceId.txt