Android.SmsSend.17037

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

075585181130: cyMjUwMDI2Njk5MTg3NzQzIzM1NjUwNzA1OTM1MTg5NSM0LjMuMQ==

Сетевая активность:

Подключается к:

2####.####.140
1####.####.80:8000
2####.####.140:8080
1####.####.67
unitedp####.####.com
g####.####.net:8080
sd####.####.com
1####.####.80
w####.####.com:7758
d####.####.com
1####.####.192
1####.####.238
g####.####.net
t####.####.cn

Запросы HTTP GET:

d####.####.com/egsb/otherPay/querySMSLimitMoney
d####.####.com/egsb/startup/queryConfiguration?channelId=####&contentId=####&gameType=####
1####.####.67/codex/version
1####.####.192/unitedpay_sdk/version
unitedp####.####.com/numberbank/interface?getInfo=####

Запросы HTTP POST:

1####.####.80:8000/intp/6ce649412ba45e84f1f00f7de6875f541d880eae
2####.####.140:8080/migusdk/tl/enclog
sd####.####.com/behaviorLogging/eventLogging/accept?
d####.####.com/egsb/verification/getUpdateUrl
d####.####.com/egsb/verification/checkSdkUpdate
1####.####.238/updata/interface.html
d####.####.com/egsb/activityCfg/queryCfgAct
g####.####.net:8080/migusdk/tl/tcttl
t####.####.cn/api/q/a/3f6ec4da684547211e371a67946d85757
g####.####.net/migusdk/tl/tcttl
2####.####.140/migusdk/tl/enclog
d####.####.com/egsb/otherPay/querySMSInterceptorConf
d####.####.com/egsb/gshare/switches
g####.####.net/migusdk/verification/checkSdkUpdate
d####.####.com/egsb/game/getPaymentCapability
w####.####.com:7758/normandie/QueryConfigPolicy
1####.####.80/intp/6ce649412ba45e84f1f00f7de6875f541d880eae
d####.####.com/egsb/thirdPay/queryThirdPayInfo

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/files/edfile/armeabi/libmiguED.so
/data/data/####/app_lemuellabs_reserved/6949bcb86c1c3c34.jar
/data/data/####/files/mgAS.dat
/data/data/####/files/sdk_prefs
/data/data/####/files/MiguPay.Sdk30.Lib_12003003_4d4c7afc770b3429d59fe361edcdfd5f_BN202.dat
/data/data/####/files/libmgRun_04.22.05_01.so
/data/data/####/files/MiguPay.Sdk30.Lib_12003003_4d4c7afc770b3429d59fe361edcdfd5f_BN202.cod
/data/data/####/app_lemuellabs_reserved/831734067fd69bf4.jar
/data/data/####/files/mpush_gateway_preferences_file
/data/data/####/shared_prefs/td_pefercen_profile.xml.bak
/data/data/####/app_lemuellabs_reserved_/lemuel_security_inner.so
/data/data/####/files/ly.jar
/data/data/####/files/mpush_version_preferences_file
/data/data/####/files/mgid.dat
/data/data/####/app_lemuellabs_reserved_/codex_inner.so
/data/data/####/databases/mpush_game.db-journal
/sdcard/Download/data/cn.cmgame.sdk/sdk_prefs.txt
/sdcard/.tcookieid
/data/data/####/files/ED.ini
/data/data/####/files/UNITEDPAYACTLIST_
/data/data/####/app_lemuellabs_reserved/0324e5a8cc28c856.jar
/data/data/####/files/mgSS.dat
/data/data/####/shared_prefs/pref_file.xml
/data/data/####/shared_prefs/3f6ec4da684547211e371a67946d85757|account_file.xml
/data/data/####/files/hbilling.dat
/sdcard/Download/data/cn.cmgame.sdk/ShareData.txt
/data/data/####/shared_prefs/tdid.xml
/data/data/####/shared_prefs/td_pefercen_profile.xml
/sdcard/Download/data/cn.cmgame.sdk/msgflag.txt
/data/data/####/app_lemuellabs_reserved/codex.so
/data/data/####/shared_prefs/pref_file.xml.bak
/data/data/####/temp.dex
/sdcard/Download/data/cn.cmgame.sdk/log/deviceId.txt