Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 12114: HZSY#####
Отправляет данные получаемых СМС-сообщений на удалённый хост.
Сетевая активность:
Подключается к:
- sm####.####.com
- 1####.####.104
- mobil####.####.com
- 1####.####.104:10081
- collec####.####.com
Запросы HTTP GET:
- 1####.####.104/vportal/upload/20161206145640302958072.jpg
- 1####.####.104/vportal/upload/2016120613510048081985.jpg
- 1####.####.104/vportal/upload/20161206145231133211435.jpg
- 1####.####.104/vportal/upload/20161206150003055123218.jpg
- 1####.####.104/vportal/upload/20161206133915883851955.jpg
- 1####.####.104/vportal/ccharging/imsi/250026699187743/imei/3565070593518...
- 1####.####.104/vportal/upload/20161206152048939399193.jpg
- 1####.####.104/vportal/upload/20161206141732664236329.jpg
- 1####.####.104/vportal/upload/2017031811515327218117.jpg
- 1####.####.104/vportal/upload/20161206151832738428658.jpg
- 1####.####.104/vportal/upload/20170318115951406711049.jpg
- 1####.####.104/vportal/upload/2016120615212752843879.jpg
- 1####.####.104/vportal/upload/20161206134319027164885.jpg
- 1####.####.104/vportal/upload/20161123140152954706970.jpg
- 1####.####.104/vportal/upload/20161206152011092101173.jpg
- 1####.####.104/vportal/upload/20161206135153818231767.jpg
- 1####.####.104/vportal/upload/2016120613401012071219.jpg
- 1####.####.104/vportal//front/220.shtml
- 1####.####.104/vportal/upload/20161206145455788489024.jpg
- 1####.####.104/vportal/upload/2016120614532440999212.jpg
- 1####.####.104/vportal/upload/20161206134111870279554.jpg
- 1####.####.104/vportal/upload/20161206151923921723873.jpg
- 1####.####.104/vportal/upload/20161123140353667302865.jpg
- 1####.####.104/vportal/upload/20161206133530318318155.jpg
- 1####.####.104/vportal/upload/20170318120427859867932.jpg
- 1####.####.104/vportal//front/224.shtml
- 1####.####.104/vportal/upload/20161206145552048429256.jpg
- 1####.####.104/vportal/upload/20170318115434911243416.jpg
- 1####.####.104/vportal/upload/20161206145729816407150.jpg
- 1####.####.104/vportal/upload/20170318115252923576442.jpg
- 1####.####.104/vportal/upload/20161206134221366494019.jpg
- 1####.####.104/vportal/upload/20161124205517229762696.jpg
- 1####.####.104/vportal/upload/20161206145817814558657.jpg
- 1####.####.104/vportal/upload/20161206150129961807777.jpg
- 1####.####.104/vportal/upload/2016120615004677193813.jpg
- 1####.####.104/vportal/upload/2016120615271964675034.jpg
- 1####.####.104/vportal/upload/2016112420491589407686.jpg
- 1####.####.104/vportal/front/index.shtml?appId=####
- 1####.####.104/vportal/upload/20161124210152610861468.jpg
- 1####.####.104/vportal/upload/20161124205653439686871.jpg
- 1####.####.104/vportal/upload/20161206152342093559722.jpg
- 1####.####.104/vportal/upload/20161206145900116761070.jpg
- 1####.####.104/vportal/upload/20161123140242576107091.jpg
- 1####.####.104/vportal/upload/20161206152258881624511.jpg
- 1####.####.104/vportal/upload/20161206152217885787177.jpg
- 1####.####.104:10081/vportal/log/index.shtml?type=####&channelNo=####&im...
- 1####.####.104/vportal/clientver/download.shtml?isPush=####&channelNo=##...
- 1####.####.104/vportal/upload/2016120614541002230739.jpg
- 1####.####.104/vportal/upload/20161124205307674569718.jpg
Запросы HTTP POST:
- sm####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
- sm####.####.com/pay-sms-access//getAccessPayChannel.json
- mobil####.####.com/mobile-service/getOpenImsiMobilePhone.json
- collec####.####.com/pay-data-collect/collectAppStartUserData.json
- collec####.####.com/pay-data-collect/uploadChannelNormalData.json
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/Android/data/####/files/imageCache/752f0a02805ff756bbbf44082c13ccc9addbe3fb6cdd6ec8b56b7f0d67722e09.0.tmp
- /sdcard/Android/data/####/files/imageCache/a80abd12d3d5371aa34a9c0b94e62334e213c7be666be4908929c194645f8901.0.tmp
- /sdcard/Android/data/####/files/imageCache/d2b43e00ca31f4158a31ae027e2edb07838609cf37a0b9ec34e10d4606a78c77.0.tmp
- /sdcard/Android/data/####/files/imageCache/010860390a07ada3f51e2091a31970ca94e36808f65fa6c240dda0e5ad277a60.0.tmp
- /data/data/####/shared_prefs/plugins.serviceMapping.xml
- /sdcard/Android/data/####/files/imageCache/1a1bb15e5d20423c2e2824585b545ee65c2e23e88fc05bc6c07b7755058e4c23.0.tmp
- /data/data/####/cache/volley/-1077880325-1260439730
- /data/data/####/databases/com.souying.pay.plugmain_sy_pay_record-journal
- /sdcard/Android/data/####/files/imageCache/bf01e376cf66e7aa7b3572c362b4239aedacd3eef4e62418d0525ddefcc6dc76.0.tmp
- /sdcard/Android/data/####/files/imageCache/3e952223bc2d4364e758753cdd52eb2cae5f5d3c9f9e3e5d35ec7b1510f78173.0.tmp
- /sdcard/Android/data/####/files/imageCache/08edc0adc9a06511cdd1d7a335311b0cb5377840ae62c4beb14882adcf46f935.0.tmp
- /data/data/####/shared_prefs/sy_pay_config.xml.bak
- /sdcard/Android/data/####/files/imageCache/0fca8c97ef80f04c6598bc9b874ed84295eef5d9b9ad35dac2a47e74e5bd31b5.0.tmp
- /data/data/####/databases/cc/cc.db
- /sdcard/Android/data/####/files/imageCache/eb1f332b42e4efd7b5356b9d84c2455374e9c6e11061f3274816ba528468c758.0.tmp
- /sdcard/Android/data/####/files/imageCache/a82d5827b43ddf7e34c08278037a5d929d03534007f75df0c14da601dfb0b352.0.tmp
- /sdcard/Android/data/####/files/imageCache/32e8a45661c86c8279f2e616d428bc14fe572f8a32063ed54e924bd5dc1347f6.0.tmp
- /sdcard/Android/data/####/files/imageCache/34803e2e00a4f831b9cf22d61638d7e4e695a3c83bcef208626ab7ed9a5ef38d.0.tmp
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/dalvik-cache/base-1.dex
- /sdcard/Android/data/####/files/imageCache/0db11ef7d443106d500c7f600b7266307024cbec5b678fa6c9010ca282ea1b2f.0.tmp
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/cache/volley/791647108-2135904750
- /data/data/####/cache/volley/-1077880325-1590205491
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/app_apCoreplugn/map.apk
- /data/data/####/shared_prefs/plugins.installed.xml
- /sdcard/Android/data/####/files/imageCache/d55561df8cbb4e2a107e49d690784330bb28b89ca84e498bfcbcc2d41c420d2a.0.tmp
- /data/data/####/cache/map.apk.apk
- /sdcard/Android/data/####/files/imageCache/d12d0d54aa55472c92fa333673e04f057dcca2d230a04ff84c0c0ce62bf62aee.0.tmp
- /sdcard/Android/data/####/files/imageCache/164fb066f63c9c186db8b5cba0a96f99e4ada5cfb613e04ee49edc1321ad8e61.0.tmp
- /data/data/####/files/mobclick_agent_cached_####1000
- /sdcard/Android/data/####/files/imageCache/4ce11aa17291102ef86f5c0a1ff874d7261648516151250a2bc563319be8120d.0.tmp
- /sdcard/Android/data/####/files/imageCache/cb7dccc657a2e7fedfd49039d7d340e8592a85bce8e688ce29d6521de75f242e.0.tmp
- /data/data/####/databases/recordInfo-journal
- /data/data/####/app_apCoreplugn/ZIP/plugin-20170330-2.1.9-release.bin
- /sdcard/Android/data/####/files/imageCache/840a894ee2abb5eeabdf814a50006e11ebc2f73f61a8fc2c2725b62351c8e74f.0.tmp
- /sdcard/Android/data/####/files/imageCache/6fd917c8ce1505f83220a231d4c19488471d5eb31fdeb5e1d681c6cea13d6911.0.tmp
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk
- /data/data/####/shared_prefs/MokaPayPreference.xml
- /sdcard/Android/data/####/files/imageCache/88587a46badd1ee38dae380674d4e37b9e79186e9ace764fd4c424b591a31822.0.tmp
- /data/data/####/cache/sm.apk.apk
- /sdcard/Android/data/####/files/imageCache/0b3fe541dcfb3ae3bcfda30a3a33d338343c29cca505d3b3ca93856ca4e0ce4a.0.tmp
- /sdcard/Android/data/####/files/imageCache/8fa6aa35a635c41dfb8b63d63bfc814129fb844c0a2232f9fc86cd52bfb580d5.0.tmp
- /data/data/####/app_apCoreplugn/sm.apk
- /sdcard/Android/data/####/files/imageCache/418661993834ab656e31d4087427b5cba76194d19a8ca58f6e0be2e1ec95585a.0.tmp
- /sdcard/Android/data/####/files/imageCache/29ef692dfb974653fd54ab7998d5f1c31234f188adb8106954c66a9a935dffd3.0.tmp
- /data/data/####/cache/volley/-1291835252-1471392581
- /sdcard/Android/data/####/files/imageCache/ddbffc739c228adba3932686ad49f9170d6e991c6e02e236e60f7eacba922d4d.0.tmp
- /sdcard/Android/data/####/files/imageCache/daebe096b5b2eeb65e58322f91e4ad92115814cc57bc69e81cbb11caaefa1a1d.0.tmp
- /sdcard/Android/data/####/files/imageCache/d4a25a86a17c8b7ed905e43a181669b50f13e738382c25fcf6d67ae1d4dd6144.0.tmp
- /sdcard/Android/data/####/files/imageCache/98953689803527766d331b8b910571dd6939bd37528d0d3452ca1af4fabc7eee.0.tmp
- /sdcard/Android/data/####/files/imageCache/c269c46196a2a665cedb319fc5b54bfa3f6dffdd267af858ea50479a5962d2bc.0.tmp
- /sdcard/Android/data/####/files/imageCache/536260879362142b98d1b11bc70a785916b054d41d68ce62ba3cb9fc0fb6eabb.0.tmp
- /sdcard/Android/data/####/files/imageCache/2246d97acd28f21c96db64b573336fd1c952da0c9b87627cd2da6c355716192a.0.tmp
- /sdcard/Android/data/####/files/imageCache/c4e3924cd1deeda735b7f7c17e4e29d1f0fef96ace4365bea892cba2c5cc31ee.0.tmp
- /sdcard/Android/data/####/files/imageCache/8e78156aefcb923a6324ad06c538d179e117f6d38d3d64c5336887a553f6c3d5.0.tmp
- /data/data/####/cache/volley/-1291835252-1471392582
- /sdcard/Android/data/####/files/imageCache/ae4061788d03d51b17aebc63386a5ea9c282894929b72b850a3ddab448a624d8.0.tmp
- /sdcard/Android/data/####/files/imageCache/39129506e7d395d1a2eb3b1163c5440e1036e880b72d0b6ee283b09993592bf7.0.tmp
- /sdcard/Android/data/####/files/imageCache/f7ab94bfc2e6c07444904698d71a0989dc800a5faef6da6a01b467c044de4790.0.tmp
- /sdcard/Android/data/####/files/imageCache/journal.tmp
- /sdcard/Android/data/####/files/imageCache/91d7a9806c3ade32cdb22d4489f56537246cef2c6918b4035a93b2105a4e9cec.0.tmp
- /sdcard/Android/data/####/files/imageCache/5fc1ac2e269fa1031da47526396d68d430d45e775e5a2d4a1c46283d5dda9396.0.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/cache/volley/791647108-1390952178
- /sdcard/Android/data/####/files/imageCache/b4c59705ea4c066dc914bd64465a13bd326a4039d9ce6b3ab40795e24546cd2b.0.tmp
- /data/data/####/shared_prefs/com.souying.pay.xml
- /sdcard/Android/data/####/files/imageCache/c0b510dd532fe75b2933a4684851c44ae0868c6c945990ae9b9eba05b8cb9cd5.0.tmp
- /sdcard/Android/data/####/files/imageCache/c510cc6fa2bb0656de3c347f1657fda252003c7a28550f89786be35c96e23f8e.0.tmp
- /data/data/####/shared_prefs/kuaiboPreference.xml
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/dalvik-cache/base-1.dex
- /data/data/####/shared_prefs/sy_pay_config.xml
- /data/data/####/shared_prefs/com.souying.pay.plugmain_p_config.xml
- /sdcard/Android/data/####/files/imageCache/692cb85cad23f0816635dca1c9b879a8bac3d3633704d75bc09dd17cf891b539.0.tmp
Другие:
Запускает следующие shell-скрипты:
- cat /proc/version
Может автоматически отправлять СМС-сообщения.
