Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SkyMobi.5.origin
- Android.Packed.21014
- Android.SkyMobi.6.origin
Сетевая активность:
Подключается к:
- shipins####.####.com
- i####.####.com
- d####.####.cn
- 1####.####.56:9039
- 1####.####.238:8977
- d####.####.com
- w####.####.com
- 1####.####.238
- d####.####.net
- 1####.####.56
- m####.####.com
- and####.####.com:8077
Запросы HTTP GET:
- w####.####.com/r/378609775/378609778/index.htm?cm=####
- d####.####.net/apkf/3rdapk2/M01/12/AC/wKhklFjnP1mAEi5xAAHa2qk3eyA095.apk
- 1####.####.56/gamesit/jysdk/initsdk?os_info=####&os_model=####&net_info=...
- 1####.####.56//gamesit/xysdk/init
- shipins####.####.com/senbanner/aa8.aaa
- 1####.####.238/dex/ldsource.bin
- shipins####.####.com/senbanner/aa6.aaa
- d####.####.net/apkf/3rdapk2/M01/0F/82/wKhklFiFqJKAOnnKAACb3YsVzOg199.apk
- w####.####.com/r/p/index.jsp?vt=####&cm=####
- 1####.####.56:9039/gamesit/jysdk/inix
- d####.####.net/apkf/3rdapk2/M01/0F/9D/wKhklVikI5uAbla-AAFuAL13kqM523.apk
- 1####.####.238:8977/dex/version.txt
- i####.####.com/service/getIpInfo2.php?ip=####
- 1####.####.238/dex/version.txt
- m####.####.com/course/504703.html?cm=####
- d####.####.net/apkf/3rdapk2/M01/0F/9C/wKhklFikE3WAcmiCAAC8lUhlgeI264.apk
- shipins####.####.com/senbanner/aa7.aaa
- w####.####.com/r/p/lyxy.jsp?ln=####&t1=####&cm=####
- shipins####.####.com/senbanner/aa5.aaa
- w####.####.com/r/378609775/index.htm?cm=####
Запросы HTTP POST:
- d####.####.com/wmserver/WMUpdate
- d####.####.com/wimipay/getPhoneUrl
- and####.####.com:8077/android/sms/netpay/prefetch.do
- d####.####.cn/wmwkupdate/WMADUpdate
- d####.####.com/mmsdk/mmsdk?func=####&appkey=####&channel=####&code=####
Изменения в файловой системе:
Создает следующие файлы:
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.zhongzhisdk.new.apk
- /data/data/####/files/28419B5C4AA334C3655D5AF1901AB735.jar
- /data/data/####/databases/utopay.db-journal
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.zhongzhisdk.new.apk.temp
- /data/data/####/shared_prefs/####_preferences.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yjiammsdk.strong.new.apk
- /data/data/####/databases/database-journal
- /sdcard/Android/data/####/cache/52fkmfpo9g962wf2na2yu8ukp.tmp
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/shared_prefs/lxdMoblieAgent_config_####.xml
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/shared_prefs/lxdMoblieAgent_upload_####.xml
- /data/data/####/shared_prefs/phoneInfo.xml
- /data/data/####/shared_prefs/lxdMoblieAgent_sys_config.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/shared_prefs/Wimipay_System.xml
- /data/data/####/shared_prefs/lxdMoblieAgent_event_####.xml
- /sdcard/Android/data/####/cache/5ve23t7waq03n8osza24aeuyp.tmp
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.hssdk.new.apk
- /data/data/####/databases/paycard
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.hssdk.new.apk.temp
- /data/data/####/shared_prefs/lxdMoblieAgent_upload_####.xml.bak
- /data/data/####/shared_prefs/version.dat.xml
- /data/data/####/shared_prefs/jmsdk.dat.xml.bak
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yjiammsdk.strong.new.apk.temp
- /data/data/####/shared_prefs/BOOT_SMS_SENT_TIME.xml
- /data/data/####/shared_prefs/jmsdk.dat.xml
- /data/data/####/files/actlxd0
- /data/data/####/shared_prefs/zhangpay_sms_info.xml
- /data/data/####/app_workbench96430/apk.zip
- /sdcard/Android/data/com.skymobi.pay.newsdk/user.sys
- /data/data/####/shared_prefs/zhangpay_share.xml.bak
- /data/data/####/databases/utopay.db
- /data/data/####/files/evnlxd1
- /data/data/####/shared_prefs/util_preference.xml
- /data/data/####/databases/Data_sync.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/databases/lepeng.db-journal
- /data/data/####/shared_prefs/lxdMoblieAgent_state_####.xml
- /data/data/####/apzmc.jar
- /data/data/####/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
- /data/data/####/shared_prefs/pref_recomm.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.data
- /data/data/####/shared_prefs/BOOT_SMS_INFO.xml
- /data/data/####/app_workbench01956/apk.zip
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_1
- /sdcard/Android/data/####/cache/4vl9l92hyuet2im36nwrdrmtc.tmp
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/shared_prefs/plugin_record_app_info.xml
- /data/data/####/databases/paycard-journal
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yjiammsdk.new.apk.temp
- /data/data/####/shared_prefs/pref_recomm.xml.bak
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
- /data/data/####/hunt.conf
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yjiammsdk.new.apk
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data
- /data/data/####/shared_prefs/STORE.xml
- /data/data/####/xufxj.jar
- /data/data/####/shared_prefs/zhangpay_share.xml
- /sdcard/Android/data/####/cache/2lu3roj5o1e92sa0kfebocivf.tmp
- /data/data/####/app_dex/classes.jar
- /data/data/####/cache/webviewCacheChromium/index
Другие:
Запускает следующие shell-скрипты:
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.data
- /system/bin/dexopt --dex 27 109 40 237700 /data/data/####/app_dex/classes.jar 1251300539 1411752382 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fra
- /system/bin/dexopt --dex 27 47 40 125612 /data/data/####/app_workbench01956/apk.zip 1251699079 -1981879824 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framew
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/dexopt --dex 27 74 40 530536 /data/data/####/app_workbench96430/apk.zip 1251699080 -683154818 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewo
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
- /system/bin/dexopt --dex 27 40 40 1144 /data/data/####/apzmc.jar 1244551753 -965382089 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.jar /s
- /system/bin/dexopt --dex 27 69 40 90372 /data/data/####/app_workbench96430/apk.zip 1251699080 -610927233 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framewor
- /system/bin/dexopt --dex 27 41 40 3019628 /data/data/####/xufxj.jar 1244550934 -1504723162 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.ja
- /system/bin/dexopt --dex 27 51 40 152720 /data/data/####/files/28419B5C4AA334C3655D5AF1901AB735.jar 1221022929 1779125709 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data
Может автоматически отправлять СМС-сообщения.
