Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.451.origin
- Android.Triada.226.origin
- Android.SmsSend.1848.origin
Сетевая активность:
Подключается к:
- cha####.####.com
- m####.####.com
- 1####.####.56:9039
- p####.####.com
- 1####.####.56
Запросы HTTP GET:
- 1####.####.56:9039//gamesit/xysdk/init
- m####.####.com/get.php?apiKey=####&imsi=####
- 1####.####.56/gamesit/jysdk/inix
- 1####.####.56/gamesit/jysdk/initsdk?os_info=####&os_model=####&net_info=####&imsi=####&imei=####&type=####&version=####
- p####.####.com/genuser.php?chid=####&subchid=####&vercode=####&type=####&data=####&gver=####&glvl=####
- p####.####.com/ckappinfo.php?action=####&data=####
Запросы HTTP POST:
- cha####.####.com/channel/paymentHandle.action?v=####&requestId=####
- p####.####.com/statistics.php?action=####&data=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/baea/tmb.jar
- /data/data/####/gameplugins/####/lib/.####.jar.sinfo
- /data/data/####/files/rdata_comvlkewqeiwejfadl.new
- /data/data/####/.platformcache/lib_kxqpplatform/libkxqpplatform.so
- /data/data/####/.platformcache/lib_kxqpplatform/tmp55760029tmp
- /data/data/####/files/mj.apk
- /data/data/####/shared_prefs/ma_data.xml
- /sdcard/.####/game_res/verinfo.cfg
- /data/data/####/.platformcache/lib/tmp.sH2225
- /data/data/####/databases/mp.db
- /data/data/####/shared_prefs/ma_call.xml
- /data/data/####/shared_prefs/edition.xml
- /data/data/####/shared_prefs/platform.xml.bak
- /data/data/####/.platformcache/lib_kxqpplatform/os.rephelmvzbil
- /data/data/####/shared_prefs/b_share.xml
- /data/data/####/shared_prefs/extractInfo.xml.bak
- /data/data/####/shared_prefs/cpMsg.xml
- /data/data/####/.platformcache/lib_kxqpplatform/.kxqpplatform.jar.sinfo
- /data/data/####/shared_prefs/new_vvsion.xml
- /sdcard/Android/data/.nomedia
- /data/data/####/files/rdata_comvlkewqeiwejfadl
- /data/data/####/.platformcache/lib_kxqpplatform/libexecloader.so
- /sdcard/.####/game_res/conveying
- /data/data/####/files/extracted
- /data/data/####/shared_prefs/nnt_data.xml
- /data/data/####/files/INbuYZgvXTRgIl_PLLrzWQAtu2LLyPsRPbnB_mWHw_4=/rSz5bf1scVlQHndFSMqeiA==/diRE2ZCh5MX4jDq27OGQSA==
- /data/data/####/files/INbuYZgvXTRgIl_PLLrzWQAtu2LLyPsRPbnB_mWHw_4=/R4MS6-zo5w0bdL3EGxIjcw==/qVKCOSFTMDC9DbXi.zip
- /data/data/####/shared_prefs/platform.xml
- /data/data/####/files/suejva_d/suejva_f.zip
- /data/data/####/shared_prefs/userInfo.xml
- /data/data/####/shared_prefs/uuid.xml
- /sdcard/.####/game_res/savedch
- /sdcard/.####/game_res/3rd/jar/####.jar
- /data/data/####/files/INbuYZgvXTRgIl_PLLrzWQAtu2LLyPsRPbnB_mWHw_4=/oyQH025Qi4oRsRBX42ewdQ==.new
- /sdcard/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk
- /data/data/####/files/INbuYZgvXTRgIl_PLLrzWQAtu2LLyPsRPbnB_mWHw_4=/Ud5pGvp2UHGQyDxMpYpu5w==.new
- /data/data/####/databases/webview.db-journal
- /data/data/####/####.sinfo
- /data/data/####/shared_prefs/zhangpay_share.xml.bak
- /data/data/####/.platformcache/main.jar
- /data/data/####/shared_prefs/getFlag.xml
- /sdcard/.twservice/qshp_3002_2229.zip
- /data/data/####/shared_prefs/extractInfo.xml
- /data/data/####/.platformcache/lib/libexecloader.so
- /data/data/####/files/INbuYZgvXTRgIl_PLLrzWQAtu2LLyPsRPbnB_mWHw_4=/g2Scstg7_K-VkRJWiO_bMA==/data.dat.tmp
- /data/data/####/shared_prefs/gameInfo.xml
- /data/data/####/files/INbuYZgvXTRgIl_PLLrzWQAtu2LLyPsRPbnB_mWHw_4=/rSz5bf1scVlQHndFSMqeiA==/4j2U4wWzNASSSE_G
- /data/data/####/.platformcache/lib_kxqpplatform/libzvmhelper.so
- /data/data/####/gameplugins/####/lib/os.ppcds2ococbil
- /sdcard/.####/game_res/compVersion
- /data/data/####/gameplugins/####/lib/tmp1461094803tmp
- /sdcard/com/android/system/uid.sys
- /data/data/####/databases/mp.db-journal
- /data/data/####/.platformcache/lib_main/tmp.hv2057
- /data/data/####/.platformcache/lib_kxqpplatform/classes.dex
- /sdcard/.twservice/qshp_3002_2229/tw
- /data/data/####/baea/entrance.jar
- /data/data/####/.platformcache/kxqpplatform.jar
- /data/data/####/.platformcache/lib/libkxqpplatform.so
- /data/data/####/.platformcache/lib_kxqpplatform/libkxqpplatform.sinfo
- /sdcard/.####/game_res/3rd/config/####.cfg.tmp
- /data/data/####/shared_prefs/kxqpChannal.xml
- /data/data/####/files/INbuYZgvXTRgIl_PLLrzWQAtu2LLyPsRPbnB_mWHw_4=/oyQH025Qi4oRsRBX42ewdQ==
- /data/data/####/.platformcache/lib/tmp.ap2114
- /data/data/####/shared_prefs/zhangpay_share.xml
- /data/data/####/databases/kxqp.db-journal
- /data/data/####/.platformcache/lib_main/libkxqptest.so
- /data/data/####/.platformcache/lib_kxqpplatform/tmp-209684923tmp
- /data/data/####/.platformcache/lib_main/libapplypatch.so
- /data/data/####/shared_prefs/updateInfo.xml
- /data/data/####/shared_prefs/device_id.xml.xml
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/.platformcache/lib_kxqpplatform/libkxqpplatform.so
- /data/data/####/.platformcache/lib_kxqpplatform/libexecloader.so
- /data/data/####/.platformcache/kxqpplatform.jar
- /data/data/####/.platformcache/lib/libkxqpplatform.so
- /data/data/####/.platformcache/lib/libexecloader.so
- /data/data/####/.platformcache/main.jar
- /data/data/####/.platformcache/lib_main/libkxqptest.so
- /data/data/####/.platformcache/lib_main/libapplypatch.so
Другие:
Может автоматически отправлять СМС-сообщения.
