Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.73.origin
- Android.Sprovider.6.origin
- Android.SmsSend.17428
- Android.Xiny.90.origin
- Android.Mixi.16.origin
Сетевая активность:
Подключается к:
- s####.####.com
- we####.com:8081
- g####.####.com
- e####.####.com:9090
- i####.####.com
- c####.com
- 4####.####.241
- p####.####.com
- woo####.com:7077
- pus####.####.com:9898
- e####.####.com
Запросы HTTP GET:
- s####.####.com/cr/sdk/dynV17041701D/des_onlydyV17041701Dj1so32.zip
- e####.####.com/wapbill/sale_static_newcp.jsp?uid=####&Cptime=####&imei=#...
- e####.####.com:9090/sdkcp/push_msgcp_new.jsp?uid=####&comptime=####&imei...
- 4####.####.241/admin201506/uploadApkFile/20170322/790201206.png
- i####.####.com/a/3907f1092e70226c90275bf42603b8552
- e####.####.com/sdkcp/pushAdwap_new.jsp?uid=####&comptime=####&model=####...
- c####.com/
- e####.####.com/sdkcp/user_visit_appcp.jsp?uid=####&Cptime=####&imei=####...
- s####.####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
- g####.####.com/cr/sv/getRecord?eids=####&appKey=####&flag=####
- e####.####.com/sdkcp/plugUpdate.jsp?uid=####&plugVersion=####&imei=####&...
- g####.####.com/cr/sv/getGoFile?name=####
- e####.####.com/wapbill/Allfeecnf.jsp?uid=####&plmn=####&mcc=####&imei=##...
Запросы HTTP POST:
- g####.####.com/cr/sv/getEPList
- woo####.com:7077/sdk/nsd.action?b=####
- we####.com:8081/sm/sr/rt/ry
- pus####.####.com:9898/bsph/api/count.shtml
- p####.####.com/api/q/a/3907f1092e70226c90275bf42603b8552
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/886a9ed33f2124778b08ceb857ae2287
- /data/data/####/shared_prefs/####s.xml
- /data/data/####/.gmpcache/la.so
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/100/1001/1492592585713.apk
- /data/data/####/databases/snowplowEvents.sqlite-journal
- /sdcard/test
- /data/data/####/files/na1l2t/ntmp20612164
- /data/data/####/app_mmxcache/####886a9ed3.jar
- /data/data/####/files/.ga/gpay_pay_sms_4_6.ap
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s
- /data/data/####/shared_prefs/SSPPrefe.xml.bak
- /data/data/####/shared_prefs/au.xml
- /data/data/####/shared_prefs/SSPPrefe.xml
- /sdcard/error_log/2017-04-19Push_Log.txt
- /data/data/####/cache/.gacache/gpay_jquery_6_1_classes.jar
- /data/data/####/files/mpush_gateway_preferences_file
- /data/data/####/shared_prefs/td_pefercen_profile.xml.bak
- /data/data/####/files/mpush_version_preferences_file
- /sdcard/.tcookieid
- /data/data/####/cache/.gacache/gpay_pay_uc_6_4_classes.jar
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/.gppacache/pay_event_4_6.applet
- /data/data/####/shared_prefs/shony_global.xml
- /data/data/####/shared_prefs/20160218.xml
- /data/data/####/files/zmplane
- /data/data/####/files/zuoyian2DB8520H4/5zuoyian2DB8520H46
- /data/data/####/shared_prefs/Q2hhbm5lbElES2V5MjAxNjEyMjcxODU3.xml
- /data/data/####/shared_prefs/PSSDK.xml
- /data/data/####/app_ttmp/t.jar
- /data/data/####/shared_prefs/PSSDK.xml.bak
- /data/data/####/databases/mpush_game.db-journal
- /data/data/####/files/.ga/gpay_jquery_1_6.ap
- /data/data/####/cache/.gppacache/pay_wap_4_6.applet
- /data/data/####/shared_prefs/a.xml
- /data/data/####/files/mo.apk
- /data/data/####/databases/bdownloaders.db-journal
- /data/data/####/files/.ga/gpay_pay_uc_4_6.ap
- /data/data/####/shared_prefs/20160121.xml
- /data/data/####/shared_prefs/20160218.xml.bak
- /data/data/####/cache/b.log
- /data/data/####/cache/.gacache/gpay_pay_wap_6_4_classes.jar
- /data/data/####/files/200/1001/110011Copy.data
- /data/data/####/files/hftJcw46N.jar
- /data/data/####/files/1492592583994_onlydyV17041701Dj1so32.so
- /data/data/####/cache/.gppacache/pay_sms_4_6.applet
- /data/data/####/cache/.gpcacache/jquery_1_6.applet
- /data/data/####/cache/.gppacache/pay_uc_4_6.applet
- /data/data/####/files/ow.apk
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/native_service
- /data/data/####/databases/swith1014.db-journal
- /data/data/####/databases/snowplowEvents.sqlite
- /data/data/####/files/.ga/gpay_pay_wap_4_6.ap
- /data/data/####/shared_prefs/TD_app_pefercen_profile.xml.bak
- /data/data/####/shared_prefs/duspf6030945.xml
- /data/data/####/files/.gmcache/api-plugin_1_105_.jar
- /data/data/####/shared_prefs/pref_file.xml
- /data/data/####/files/200/1001/170419090300567.apk
- /data/data/####/files/.gmplc/pay.so
- /data/data/####/cache/.gacache/gpay_pay_sms_6_4_classes.jar
- /data/data/####/shared_prefs/tdid.xml
- /data/data/####/shared_prefs/td_pefercen_profile.xml
- /data/data/####/cache/volley/-1374709506-1794387268
- /data/data/####/files/.ga/gpay_pay_event_4_6.ap
- /data/data/####/shared_prefs/pref_file.xml.bak
- /data/data/####/files/unsent_requests
- /data/data/####/cache/.gacache/gpay_pay_event_6_4_classes.jar
- /data/data/####/files/23DB8520H32/####12x862
- /sdcard/APPMarket/AdvSDK/ICON/admin201506/uploadApkFile/20170322/790201206.png.tmp
- /data/data/####/shared_prefs/3907f1092e70226c90275bf42603b8552|account_file.xml
- /data/data/####/files/200/1001/2017032117911
- /data/data/####/files/Android-x86112.jar
- /data/data/####/.gmpcache/gmpclasses.jar
Другие:
Запускает следующие shell-скрипты:
- getenforce
- chmod 0771 /data/data/####/.syslib-
- cat /proc/cpuinfo
- .hulu
- logcat -d -v time
- .hulu -c id
- sh
- ps logcat
- ps adbd
- /data/data/####/files/us.908GhK3z1XIE6J7u3B4nRKlfEI88s -h 3d70f0cbdb7a48c9a27bdb4723db31a4 /data/data/####/.syslib-
Может автоматически отправлять СМС-сообщения.
