Android.SmsSpy.5957

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

10690312394499: 5070593518954cd79cd533fd5465525bbcde####b30001
12114: HZSY#####

Загружает из Интернета следующие детектируемые угрозы:

Android.SmsSpy.5950

Отправляет данные получаемых СМС-сообщений на удалённый хост.

Сетевая активность:

Подключается к:

p####.####.com:8080
sm####.####.com
i####.####.com
newbyv####.com
1####.####.111:8001
mobil####.####.com
img####.####.com
p####.####.com
1####.####.com
i####.####.com:8081
newbyv####.com:10001
082####.####.com
i####.####.cn
json####.####.com
collec####.####.com
b####.####.com

Запросы HTTP GET:

082####.####.com/tuku/20161213pl03.png
i####.####.com/XinChangPing225/resources/avatars/17.png
json####.####.com/adplans/fef39f8a0a4c11e7bb779c37f405e458.js
b####.####.com/yyb30001.apk
img####.####.com/tuku/20170309zz18.jpg
i####.####.com/XinChangPing225/resources/avatars/10.png
i####.####.com/XinChangPing225/resources/avatars/15.png
img####.####.com/tuku/20170228ty27.jpg
1####.####.111:8001/APP/AppTask.aspx
img####.####.com/tuku/20170228ty8.jpg
img####.####.com/tuku/20170228ty5.jpg
i####.####.com/XinChangPing225/resources/avatars/6.png
i####.####.com/XinChangPing225/resources/avatars/9.png
img####.####.com/tuku/20170228ty24.jpg
img####.####.com/tuku/shikan2.jpg
i####.####.com/XinChangPing225/resources/avatars/31.png
img####.####.com/tuku/20170228ty11.jpg
p####.####.com/me/adpublish/exitPushByChannelNo?CHANNEL_NO=####
img####.####.com/tuku/20170228ty35.jpg
img####.####.com/tuku/20170228ty17.jpg
json####.####.com/adplans/fef50dfa0a4c11e7bb779c37f405e458.js
082####.####.com/tuku/20161213pl05.png
img####.####.com/tuku/20170228ty2.jpg
img####.####.com/tuku/20170228ty18.jpg
082####.####.com/tuku/20161213pl14.png
img####.####.com/tuku/20170228ty33.jpg
img####.####.com/tuku/20170228ty22.jpg
img####.####.com/tuku/20170228ty30.jpg
i####.####.com:8081/XinChangPing225/resources/avatars/18.png
json####.####.com/adplans/feec92be0a4c11e7bb779c37f405e458.js
img####.####.com/tuku/20170228ty19.jpg
img####.####.com/tuku/20170228ty7.jpg
img####.####.com/tuku/20170228ty26.jpg
i####.####.com/XinChangPing225/resources/avatars/12.png
img####.####.com/tuku/20170228ty21.jpg
img####.####.com/tuku/20170228ty3.jpg
img####.####.com/tuku/20170228ty28.jpg
img####.####.com/tuku/20170328sk01.jpg
img####.####.com/tuku/20170228ty15.jpg
i####.####.com/XinChangPing225/resources/avatars/16.png
img####.####.com/tuku/20170309zs27.jpg
img####.####.com/tuku/20170228ty6.jpg
082####.####.com/tuku/20161213pl06.png
img####.####.com/tuku/20170228ty34.jpg
img####.####.com/tuku/20170228ty12.jpg
i####.####.com/XinChangPing225/resources/avatars/13.png
img####.####.com/tuku/20170228ty29.jpg
json####.####.com/adpay/meiliwx_feikeali_0321.json
newbyv####.com/Application/Uploads/Global/58d5ebe97e40c.zip
img####.####.com/tuku/20170228ty13.jpg
img####.####.com/tuku/20170228ty1.jpg
img####.####.com/tuku/20170228ty16.jpg
i####.####.cn/iplookup/iplookup.php?format=####
img####.####.com/tuku/20170228ty38.jpg
082####.####.com/tuku/20161213pl12.png
i####.####.com/XinChangPing225/resources/avatars/2.png
img####.####.com/tuku/shikan49.jpg
img####.####.com/tuku/20170228ty31.jpg
json####.####.com/adplans/feed55160a4c11e7bb779c37f405e458.js
i####.####.com/XinChangPing225/resources/avatars/7.png
i####.####.com/XinChangPing225/resources/avatars/20.png
json####.####.com/adchannelversion/9.1.1.0325_ad_planlinkchannelanversio...
img####.####.com/tuku/20170228ty32.jpg
json####.####.com/adplans/fef467c70a4c11e7bb779c37f405e458.js
img####.####.com/tuku/20170228ty9.jpg
img####.####.com/tuku/20170309zs32.jpg
img####.####.com/tuku/20170309zs176.jpg
img####.####.com/shikan0036.jpg
1####.####.com/ic.asp
082####.####.com/tuku/20161213pl13.png
img####.####.com/tuku/20170228ty36.jpg
p####.####.com/me/publish/checkAppVersion?CHANNEL_NO=####&APP_VERSION=####
img####.####.com/tuku/20170228ty10.jpg
json####.####.com/adplans/fef2d2bc0a4c11e7bb779c37f405e458.js
img####.####.com//SPpaysp_member_bg.png
082####.####.com/tuku/20161213pl15.png
i####.####.com/XinChangPing225/resources/avatars/8.png
082####.####.com/tuku/20161213pl11.png
i####.####.com/XinChangPing225/resources/avatars/3.png
json####.####.com/adplans/feec13520a4c11e7bb779c37f405e458.js
img####.####.com/tuku/20170228ty39.jpg
img####.####.com/tuku/20170228ty20.jpg
082####.####.com/tuku/20161213pl04.png
img####.####.com/tuku/20170228ty23.jpg
082####.####.com/tuku/20161213pl08.png
img####.####.com/tuku/20170228ty25.jpg
082####.####.com/tuku/20161213pl10.png
082####.####.com/tuku/20161213pl02.png
json####.####.com/adplans/fef6a4030a4c11e7bb779c37f405e458.js
img####.####.com/tuku/20170228ty14.jpg
img####.####.com/tuku/20170228ty37.jpg

Запросы HTTP POST:

newbyv####.com:10001/api/v1/phones
mobil####.####.com/mobile-service/getOpenImsiMobilePhone.json
newbyv####.com/api/v1/phones
p####.####.com:8080/me/publish/activate
p####.####.com:8080/me/publish/spinfo
collec####.####.com/pay-data-collect/collectAppStartUserData.json
sm####.####.com/pay-sms-access//getAccessPayChannel.json
p####.####.com/me/publish/spinfo
sm####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
collec####.####.com/pay-data-collect/uploadChannelNormalData.json

Изменения в файловой системе:

Создает следующие файлы:

/sdcard/MlVideo/images/-405214908
/sdcard/MlVideo/images/-409832513
/sdcard/MlVideo/images/782972427
/sdcard/MlVideo/images/242024090
/sdcard/MlVideo/images/188459872
/sdcard/MlVideo/images/238330006
/sdcard/MlVideo/images/309743779
/sdcard/MlVideo/images/211547897
/data/data/####/shared_prefs/umeng_general_config.xml
/sdcard/MlVideo/images/185689309
/sdcard/MlVideo/images/741853851
/sdcard/MlVideo/images/771406523
/data/data/####/files/ota/elf/58d5ebe97e40c.zip
/sdcard/MlVideo/images/181071704
/sdcard/MlVideo/images/209700855
/sdcard/MlVideo/images/1111631533
/sdcard/MlVideo/images/166463344
/data/data/####/files/ota/version
/sdcard/MlVideo/images/303279132
/data/data/####/shared_prefs/com.souying.pay.xml
/data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/dalvik-cache/base-1.dex
/sdcard/MlVideo/images/-406138429
/sdcard/MlVideo/images/740930330
/sdcard/MlVideo/images/244794653
/sdcard/MlVideo/images/240177048
/sdcard/MlVideo/images/-304561782
/sdcard/MlVideo/images/213394939
/data/data/####/cache/sms.apk.apk
/data/data/####/files/permmgr/libsu.so
/data/data/####/files/noend.ini
/data/data/####/shared_prefs/tab_planconfig.xml
/sdcard/MlVideo/images/2135703093
/data/data/####/shared_prefs/fangan_aliyunconfig.xml
/sdcard/MlVideo/files/user_id
/data/data/####/files/mobclick_agent_cached_####9110325
/sdcard/MlVideo/images/767712439
/sdcard/MlVideo/images/787590032
/sdcard/MlVideo/images/182918746
/sdcard/MlVideo/images/784819469
/data/data/####/shared_prefs/tiyan_numconfig.xml
/sdcard/MlVideo/images/-2135252657
/sdcard/MlVideo/images/210624376
/sdcard/MlVideo/update/b30001.apk
/sdcard/MlVideo/images/742777372
/data/data/####/app_apCoreplugn/smp.apk
/sdcard/MlVideo/images/183842267
/sdcard/MlVideo/images/-403367866
/sdcard/MlVideo/images/212471418
/data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk
/data/data/####/databases/recordInfo-journal
/sdcard/MlVideo/images/237406485
/sdcard/MlVideo/images/187536351
/sdcard/MlVideo/images/181995225
/data/data/####/shared_prefs/com.souying.pay.plugmain_p_config.xml
/sdcard/MlVideo/images/241100569
/sdcard/MlVideo/images/769559481
/data/data/####/files/ota/installer
/sdcard/MlVideo/images/768635960
/sdcard/MlVideo/images/307896737
/data/data/####/shared_prefs/plugins.serviceMapping.xml
/sdcard/MlVideo/images/1367498509
/sdcard/MlVideo/images/744624414
/sdcard/MlVideo/images/897030991
/data/data/####/files/ota/libsu.so
/sdcard/MlVideo/images/900378086
/data/data/####/shared_prefs/price_infoconfig.xml
/data/data/####/app_apCoreplugn/sms.apk
/data/data/####/databases/cc/cc.db-journal
/data/data/####/shared_prefs/plugins.installed.xml
/sdcard/MlVideo/images/770483002
/sdcard/MlVideo/images/245718174
/data/data/####/app_apCoreplugn/ZIP/plugin-20170302-2.1.8.6.3.bin
/data/data/####/databases/com.souying.pay.plugmain_sy_pay_record-journal
/sdcard/MlVideo/images/-408908992
/sdcard/MlVideo/images/785742990
/data/data/####/files/ota/daemon
/data/data/####/shared_prefs/phoneId.xml
/data/data/####/shared_prefs/dispatch_log.xml
/sdcard/MlVideo/images/-269411362
/sdcard/MlVideo/images/215241981
/data/data/####/files/ota/krdem
/sdcard/MlVideo/images/214318460
/data/data/####/hunt.conf
/sdcard/MlVideo/images/811601578
/sdcard/MlVideo/images/789437074
/sdcard/MlVideo/images/-402444345
/data/data/####/files/ota/busybox
/data/data/####/shared_prefs/sy_pay_config.xml
/data/data/####/shared_prefs/user_idconfig.xml
/sdcard/MlVideo/images/208777334
/sdcard/MlVideo/images/184765788
/data/data/####/shared_prefs/sy_pay_config.xml.bak
/data/data/####/files/dump
/sdcard/MlVideo/images/306973216
/sdcard/MlVideo/images/242947611
/data/data/####/databases/cc/cc.db
/sdcard/MlVideo/images/186612830
/sdcard/MlVideo/images/308820258
/sdcard/MlVideo/images/216165502
/sdcard/MlVideo/images/746471456
/data/data/####/shared_prefs/plant_id_fileconfig.xml
/data/data/####/cache/smp.apk.apk
/sdcard/MlVideo/images/841154250
/data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk
/sdcard/MlVideo/images/243871132
/sdcard/MlVideo/images/-404291387
/sdcard/MlVideo/images/790360595
/sdcard/MlVideo/images/772330044
/sdcard/MlVideo/images/239253527
/sdcard/MlVideo/images/788513553
/sdcard/MlVideo/images/180148183
/sdcard/MlVideo/images/743700893
/sdcard/MlVideo/images/304202653
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/sdcard/MlVideo/images/-407985471
/sdcard/MlVideo/images/217089023
/data/data/####/shared_prefs/activate.xml
/data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/dalvik-cache/base-1.dex
/data/data/####/files/ota/package

Присваивает атрибут 'исполняемый' для следующих файлов:

/data/data/####/files/ota/libsu.so
/data/data/####/files/ota/elf/58d5ebe97e40c.zip

Другие:

Запускает следующие shell-скрипты:

cat /proc/version

Может автоматически отправлять СМС-сообщения.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней