Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SmsSpy.408.origin
Сетевая активность:
Подключается к:
- c####.####.com
- xy####.####.com:81
- xy####.####.com
- t####.####.com
Запросы HTTP GET:
- c####.####.com/get_flow?ui=####&avc=####&da=####&product_id=####&b=####&...
- xy####.####.com/AppInfoExist.aspx?packagename=####&appsign=####&appkey=#...
- c####.####.com/user?ui=####&avc=####&da=####&b=####&c=####&n=####&l=####...
- t####.####.com/request_act?ap=####&n=####
- xy####.####.com/req.aspx?appkey=####&key=####
- c####.####.com/app_settings?ui=####&avc=####&da=####&b=####&c=####&n=###...
Запросы HTTP POST:
- xy####.####.com/WCCache/CacheList.aspx
- xy####.####.com/AdUnitApp.aspx
- xy####.####.com:81/AppAdConfig.aspx
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/shared_prefs/Setting_snspt.xml
- /data/data/####/app_cmnraw/sdk_pay_union
- /data/data/####/app_cmnraw/sdk_pay_general
- /data/data/####/app_cmnraw/config.xml
- /data/data/####/shared_prefs/signinfo.xml
- /data/data/####/shared_prefs/ep.xml
- /data/data/####/app_cmnraw/sdk_pay_cmcc
- /data/data/####/shared_prefs/signal.xml
- /data/data/####/app_cmninfo/cmnupdate
- /data/data/####/files/libyummy.so
- /data/data/####/app_cmnraw/sdk_base
- /data/data/####/app_cmnraw/sdk_pay_dep
- /sdcard/Android/data/####/cache/####.ep.dex
- /data/data/####/shared_prefs/payInfo.xml
- /data/data/####/app_cmninfo/66da30dd7287a5e70f2f6c326c7342f4
- /data/data/####/shared_prefs/cmnpay.xml
- /data/data/####/shared_prefs/core_noin_Pref.xml.bak
- /data/data/####/app_cmnraw/sdk_pay_others
- /data/data/####/shared_prefs/core_noin_Pref.xml
- /data/data/####/files/cmn_game_config
- /data/data/####/app_cmnraw/sdk_pay_base
- /data/data/####/shared_prefs/Setting_snspt_Link.xml
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 46 40 138080 /data/data/####/app_cmnraw/sdk_pay_dep 1212245831 -564757964 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
- /system/bin/dexopt --dex 27 61 40 346908 /storage/emulated/0/Android/data/####/cache/####.ep.dex 1223392032 1722651151 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bounc
- /system/bin/dexopt --dex 27 43 40 44020 /data/data/####/app_cmnraw/sdk_base 1212245808 -962069506 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/
- /system/bin/dexopt --dex 27 47 40 53148 /data/data/####/app_cmnraw/sdk_pay_general 1212245815 -365032351 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /
- /system/bin/dexopt --dex 27 42 40 57608 /data/data/####/app_cmnraw/sdk_pay_base 1212245812 964857207 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syst
- /system/bin/dexopt --dex 27 48 40 6972 /data/data/####/app_cmnraw/sdk_pay_others 1212245821 -1742880032 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /s
- /system/bin/dexopt --dex 27 44 40 57608 /data/data/####/app_cmnraw/sdk_pay_base 1212245812 964857207 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syst
- /system/bin/dexopt --dex 27 49 40 12400 /data/data/####/app_cmnraw/sdk_pay_union 1212245825 1630135096 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sy
- /system/bin/dexopt --dex 27 47 40 12400 /data/data/####/app_cmnraw/sdk_pay_union 1212245825 1630135096 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sy
- /system/bin/dexopt --dex 27 46 40 6972 /data/data/####/app_cmnraw/sdk_pay_others 1212245821 -1742880032 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /s
- /system/bin/dexopt --dex 27 43 40 77856 /data/data/####/app_cmnraw/sdk_pay_cmcc 1212245820 1140728943 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
- /system/bin/dexopt --dex 27 41 40 44020 /data/data/####/app_cmnraw/sdk_base 1212245808 -962069506 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/
- /system/bin/dexopt --dex 27 45 40 77856 /data/data/####/app_cmnraw/sdk_pay_cmcc 1212245820 1140728943 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
- /system/bin/dexopt --dex 27 45 40 53148 /data/data/####/app_cmnraw/sdk_pay_general 1212245815 -365032351 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /
- /system/bin/dexopt --dex 27 44 40 138080 /data/data/####/app_cmnraw/sdk_pay_dep 1212245831 -564757964 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sys
Может автоматически отправлять СМС-сообщения.
