Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 1069099903306: ####
Загружает из Интернета следующие детектируемые угрозы:
- Android.SmsSpy.5950
Отправляет данные получаемых СМС-сообщений на удалённый хост.
Предлагает установить сторонние приложения.
Сетевая активность:
Подключается к:
- p####.####.com:8080
- sm####.####.com
- mobil####.####.com
- img####.####.com
- p####.####.com
- i####.####.cc
- json####.####.com
- collec####.####.com
- b####.####.com
Запросы HTTP GET:
- img####.####.com/shikan0036.jpg
- img####.####.com/tuku/20170228ty29.jpg
- img####.####.com/tuku/20170228ty33.jpg
- img####.####.com/tuku/20170228ty22.jpg
- img####.####.com/tuku/20170228ty30.jpg
- img####.####.com/tuku/20170228ty36.jpg
- p####.####.com/me/publish/checkAppVersion?CHANNEL_NO=####&APP_VERSION=####
- img####.####.com/tuku/20170228ty13.jpg
- img####.####.com/tuku/20170228ty10.jpg
- img####.####.com/tuku/20170228ty1.jpg
- json####.####.com/adplans/feec92be0a4c11e7bb779c37f405e458.js
- json####.####.com/adplans/fef39f8a0a4c11e7bb779c37f405e458.js
- img####.####.com/tuku/20170228ty16.jpg
- img####.####.com/tuku/20170228ty7.jpg
- img####.####.com/tuku/20170228ty26.jpg
- img####.####.com/tuku/20170228ty38.jpg
- json####.####.com/adchannelversion/9.1.0.0424_ad_planlinkchannelanversio...
- img####.####.com/tuku/20170228ty21.jpg
- img####.####.com/tuku/20170228ty12.jpg
- img####.####.com/tuku/20170228ty27.jpg
- p####.####.com:8080/me/adpublish/exitPushByChannelNo?CHANNEL_NO=####
- img####.####.com/tuku/20170228ty3.jpg
- img####.####.com/tuku/20170228ty8.jpg
- img####.####.com/tuku/20170228ty5.jpg
- json####.####.com/adplans/feec13520a4c11e7bb779c37f405e458.js
- img####.####.com/tuku/20170228ty28.jpg
- json####.####.com/adplans/31fbd6b6289211e7bb779c37f405e458.js
- img####.####.com/tuku/shikan2.jpg
- img####.####.com/tuku/20170328sk01.jpg
- img####.####.com/tuku/20170228ty15.jpg
- img####.####.com/tuku/20170228ty20.jpg
- img####.####.com/tuku/20170228ty31.jpg
- img####.####.com/tuku/20170228ty23.jpg
- img####.####.com/tuku/20170228ty25.jpg
- img####.####.com/tuku/20170228ty11.jpg
- img####.####.com/tuku/20170228ty9.jpg
- json####.####.com/adpay/weiqianbao_wx_ali_0408.json
- img####.####.com/tuku/20170228ty6.jpg
- json####.####.com/adplans/3201f0a5289211e7bb779c37f405e458.js
- img####.####.com/tuku/20170228ty35.jpg
- img####.####.com/tuku/20170228ty24.jpg
- json####.####.com/adplans/31f72f43289211e7bb779c37f405e458.js
- img####.####.com/tuku/20170228ty17.jpg
- json####.####.com/adplans/fef50dfa0a4c11e7bb779c37f405e458.js
- img####.####.com/tuku/20170228ty32.jpg
- b####.####.com/yyb10004.apk
- img####.####.com/tuku/20170228ty2.jpg
- img####.####.com/tuku/shikan49.jpg
- img####.####.com/tuku/20170228ty34.jpg
- i####.####.cc/handao_img/app_img/video/jpg/shikan3.jpg
- img####.####.com/tuku/20170228ty14.jpg
- json####.####.com/adplans/fef467c70a4c11e7bb779c37f405e458.js
- img####.####.com/tuku/20170228ty18.jpg
- img####.####.com/tuku/20170228ty37.jpg
- img####.####.com/tuku/20170228ty39.jpg
- json####.####.com/adchannelversion/9999.99999.99999.0411.0_ad_planlinkch...
- img####.####.com/tuku/20170309zs176.jpg
- img####.####.com/tuku/20170228ty19.jpg
Запросы HTTP POST:
- p####.####.com:8080/me/publish/spinfo
- mobil####.####.com/mobile-service/getOpenImsiMobilePhone.json
- collec####.####.com/pay-data-collect/collectAppStartUserData.json
- p####.####.com/me/publish/spinfo
- p####.####.com/me/publish/activate
- sm####.####.com/pay-sms-access//getAccessPayChannel.json
- collec####.####.com/pay-data-collect/uploadChannelNormalData.json
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/MlVideo/images/240177048
- /sdcard/MlVideo/images/184765788
- /sdcard/MlVideo/images/-409832513
- /sdcard/MlVideo/images/-304561782
- /sdcard/MlVideo/images/213394939
- /data/data/####/shared_prefs/fef467c70a4c11e7bb779c37f405e458config.xml
- /sdcard/MlVideo/images/183842267
- /sdcard/MlVideo/images/188459872
- /data/data/####/shared_prefs/tab_planconfig.xml
- /sdcard/MlVideo/images/215241981
- /sdcard/MlVideo/images/242947611
- /data/data/####/databases/cc/cc.db
- /data/data/####/shared_prefs/fangan_aliyunconfig.xml
- /sdcard/MlVideo/images/243871132
- /sdcard/MlVideo/images/216165502
- /data/data/####/shared_prefs/fef39f8a0a4c11e7bb779c37f405e458config.xml
- /sdcard/MlVideo/images/242024090
- /data/data/####/shared_prefs/price_infoconfig.xml
- /data/data/####/shared_prefs/plant_id_fileconfig.xml
- /sdcard/MlVideo/images/244794653
- /data/data/####/databases/cc/cc.db-journal
- /sdcard/MlVideo/images/211547897
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/MlVideo/images/185689309
- /sdcard/MlVideo/images/181995225
- /sdcard/MlVideo/images/182918746
- /sdcard/MlVideo/files/user_id
- /sdcard/MlVideo/images/-405214908
- /sdcard/MlVideo/images/245718174
- /data/data/####/files/mobclick_agent_cached_####1569229166
- /sdcard/MlVideo/images/186612830
- /sdcard/MlVideo/images/212471418
- /sdcard/MlVideo/images/-408908992
- /sdcard/MlVideo/images/-404291387
- /sdcard/MlVideo/images/900378086
- /sdcard/MlVideo/images/210624376
- /sdcard/MlVideo/images/239253527
- /sdcard/MlVideo/images/241100569
- /sdcard/MlVideo/images/180148183
- /sdcard/MlVideo/images/181071704
- /sdcard/MlVideo/images/-403367866
- /sdcard/MlVideo/images/209700855
- /sdcard/MlVideo/update/b10004.apk
- /sdcard/MlVideo/images/1367498509
- /sdcard/MlVideo/images/214318460
- /sdcard/MlVideo/images/1111631533
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /sdcard/MlVideo/images/-407985471
- /sdcard/MlVideo/images/187536351
- /sdcard/MlVideo/images/166463344
- /sdcard/MlVideo/images/217089023
- /sdcard/MlVideo/images/237406485
- /sdcard/MlVideo/images/238330006
- /sdcard/MlVideo/images/208777334
- /data/data/####/shared_prefs/activate.xml
- /sdcard/MlVideo/images/-406138429
- /sdcard/MlVideo/images/-402444345
- /sdcard/MlVideo/images/-534874688
- /data/data/####/shared_prefs/feec92be0a4c11e7bb779c37f405e458config.xml
- /data/data/####/shared_prefs/user_idconfig.xml
- /data/data/####/shared_prefs/fef50dfa0a4c11e7bb779c37f405e458config.xml
Другие:
Запускает следующие shell-скрипты:
- cat /proc/version
Может автоматически отправлять СМС-сообщения.
