Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.54.origin
- Android.SmsSend.17428
- Android.Mixi.16.origin
Сетевая активность:
Подключается к:
- s####.####.com
- g####.####.com
- e####.####.com:9090
- 7j####.####.com
- c-h####.####.com
- u####.####.in
- e####.####.com
- a####.####.com
- i####.####.in
Запросы HTTP GET:
- s####.####.com/config/hz-hzv3.conf
- a####.####.com/Api/UnifiedAccess?PBindKey=####&data=ey####
- s####.####.com/cr/sdk/dynV17041701D/des_onlydyV17041701Dj1so32.zip
- e####.####.com/wapbill/sale_static_newcp.jsp?uid=####&Cptime=####&imei=#...
- e####.####.com:9090/sdkcp/plugUpdate.jsp?uid=####&plugVersion=####&imei=...
- e####.####.com/wapbill/Allfeecnf.jsp?uid=####&plmn=####&mcc=####&imei=##...
- 7j####.####.com/tdata_fZU284
- i####.####.in/img/4sdk1.png
- 7j####.####.com/tdata_ZSe996
- e####.####.com/sdkcp/user_visit_appcp.jsp?uid=####&Cptime=####&imei=####...
- s####.####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
- e####.####.com/sdkcp/push_msgcp_new.jsp?uid=####&comptime=####&imei=####...
- g####.####.com/cr/sv/getGoFile?name=####
- 7j####.####.com/tdata_yju115
- e####.####.com/sdkcp/pushAdwap_new.jsp?uid=####&comptime=####&model=####...
- g####.####.com/cr/sv/getRecord?eids=####&appKey=####&flag=####
Запросы HTTP POST:
- g####.####.com/cr/sv/getEPList
- a####.####.com/Api/AddActivate
- u####.####.in/rreg.php
- a####.####.com/Api/UnifiedAccess
- s####.####.com/api.php?format=####&t=####
- c-h####.####.com/api.php?format=####&t=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/init.pid
- /data/data/####/.gmpcache/la.so
- /data/data/####/files/na1l2t/ntmp22172276
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
- /data/data/####/app_lib/libmdat.so
- /data/data/####/cache/.gacache/gpay_jquery_6_1_classes.jar
- /data/data/####/files/baidu602DB8520H4/5baidu602DB8520H46
- /sdcard/backups/system/.timestamp
- /data/data/####/files/tdata_fZU284.jar
- /data/data/####/files/.ga/gpay_pay_event_4_6.ap
- /data/data/####/shared_prefs/shony_global.xml
- /data/data/####/cache/.gppacache/pay_wap_4_6.applet
- /data/data/####/databases/pushg.db-journal
- /data/data/####/app_mmxcache/####cf9b182a.dex
- /data/data/####/cache/.gpcacache/jquery_1_6.applet
- /data/data/####/cache/.gppacache/pay_uc_4_6.applet
- /sdcard/libs/####.db
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/__local_stat_cache.json
- /data/data/####/cache/.gppacache/pay_event_4_6.applet
- /data/data/####/files/__local_ap_info_cache.json
- /data/data/####/shared_prefs/shony_global.xml.bak
- /data/data/####/app_mmxcache/####cf9b182a.jar
- /data/data/####/cache/.gacache/gpay_pay_event_6_4_classes.jar
- /sdcard/backups/system/.confd
- /data/data/####/files/libcuid.so
- /data/data/####/files/run.pid
- /data/data/####/files/hftJcw46N.jar
- /data/data/####/databases/snowplowEvents.sqlite-journal
- /data/data/####/cache/.gacache/gpay_jquery_6_1_classes.dex
- /data/data/####/.gmpcache/gmpclasses.dex
- /data/data/####/databases/tmpd8.db-journal
- /data/data/####/files/.ga/gpay_jquery_1_6.ap
- /data/data/####/files/init_c1.pid
- /data/data/####/databases/fddata-journal
- /data/data/####/databases/fddata
- /data/data/####/databases/pushgdm.db-journal
- /data/data/####/files/cf9b182a7a1cd3db604ee116bb9584dd
- /data/data/####/files/tdata_fZU284
- /data/data/####/databases/xUtils_http_cookie.db
- /data/data/####/.gmpcache/gmpclasses.jar
- /data/data/####/files/.err.dex
- /data/data/####/files/push.pid
- /data/data/####/databases/pushsdk.db-journal
- /data/data/####/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml.bak
- /data/data/####/files/tdata_ZSe996.jar
- /sdcard/backups/.SystemConfig/.cuid2
- /data/data/####/files/.ga/gpay_pay_sms_4_6.ap
- /data/data/####/files/gdaemon_20161017
- /data/data/####/files/tdata_ZSe996
- /data/data/####/databases/xUtils_http_cookie.db-journal
- /data/data/####/files/.gmcache/api-plugin_1_105_.jar
- /data/data/####/cache/.gacache/gpay_pay_uc_6_4_classes.jar
- /data/data/####/databases/snowplowEvents.sqlite-shm
- /data/data/####/files/mo.apk
- /data/data/####/databases/snowplowEvents.sqlite-wal
- /data/data/####/files/.ga/gpay_pay_uc_4_6.ap
- /data/data/####/databases/snowplowEvents.sqlite
- /data/data/####/files/.ga/gpay_pay_wap_4_6.ap
- /data/data/####/files/tdata_yju115
- /data/data/####/files/.gmplc/pay.so
- /data/data/####/files/unsent_requests
- /data/data/####/files/23DB8520H32/####12x862
- /sdcard/Download/log.txt
- /sdcard/libs/com.getui.sdk.deviceId.db
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/.gmcache/api-plugin_1_105_.dex
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- /data/data/####/shared_prefs/ZYASDKPOIEJMFKL##@!!!.xml
- /data/data/####/databases/pushext.db-journal
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /data/data/####/files/.err.jar
- /sdcard/backups/system/.confd-journal
- /data/data/####/shared_prefs/a.xml
- /sdcard/system/tmp/local/tdata_ZSe996
- /data/data/####/cache/b.log
- /data/data/####/files/1492592592594_onlydyV17041701Dj1so32.so
- /sdcard/system/tmp/local/tdata_yju115
- /sdcard/libs/app.db
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/files/ow.apk
- /data/data/####/cache/.gacache/gpay_pay_wap_6_4_classes.jar
- /sdcard/system/tmp/local/tdata_fZU284
- /data/data/####/cache/.gacache/gpay_pay_sms_6_4_classes.jar
- /data/data/####/files/tdata_yju115.jar
- /sdcard/backups/.SystemConfig/.cuid
- /data/data/####/cache/.gppacache/pay_sms_4_6.applet
- /data/data/####/shared_prefs/a.xml.bak
- /data/data/####/files/Android-x86112.jar
- /data/data/####/files/aHR0cDovL2ltZy5hbW9iaS5pbi9pbWcvNHNkazEucG5n
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/app_lib/libmdat.so
Другие:
Запускает следующие shell-скрипты:
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 6ebdfe305d0249dc974a8fe2767606fa /data/data/####/.syslib-
- chmod 700 /data/data/####/files/gdaemon_20161017
- getenforce
- chmod 0771 /data/data/####/.syslib-
- cat /proc/cpuinfo
- chmod 777 /data/data/####/app_lib/libmdat.so
- /data/data/####/files/gdaemon_20161017 0 ####/com.igexin.sdk.PushService 25793 300 0
- ps logcat
- ps adbd
- chmod 775 /data/data/####/app_lib
Может автоматически отправлять СМС-сообщения.
