Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 1069099903306: ####
Отправляет данные получаемых СМС-сообщений на удалённый хост.
Сетевая активность:
Подключается к:
- sm####.####.com
- i####.####.com
- 1####.####.111
- p####.####.com
- i####.####.com:8081
- 1####.####.111:8001
- collec####.####.com
Запросы HTTP GET:
- 1####.####.111/APP/AppTask.aspx
- i####.####.com/XinChangPing225/resources/avatars/13.png
- i####.####.com/20170323/5b3d6f6a-4dcb-4d0b-bb34-df8ce965b891-%E5%A4%A9%E...
- i####.####.com/XinChangPing225/resources/avatars/44.png
- p####.####.com/userPermission-apiRest/sys/app/91195699/4/app_0002.service
- i####.####.com/20170413/8e11cac6-8113-497c-8819-d00767c61fa3-??4####
- i####.####.com/20170316/63430ec0-89e0-4442-b03c-56fb014dbaca-%E5%B7%AE%E...
- i####.####.com/20170418/a00f0a27-d280-437c-9043-e8b86074d333-????????1####
- p####.####.com/userPermission-apiRest/sys/app/91195699/4/app_0003.service
- 1####.####.111/APP/VersionCheck.aspx
- i####.####.com/20170220/33a5e48d-1a5c-4c69-8213-2b14451d3708-%E7%A9%B6%E...
- i####.####.com/XinChangPing225/resources/avatars/16.png
- i####.####.com/qt/1014/jx/j3.jpg
- i####.####.com/XinChangPing225/resources/avatars/59.png
- i####.####.com/20170316/55a3e690-e484-4f8c-9f38-14122896190e-%E5%87%84%E...
- i####.####.com/20170323/6bf69341-9e54-488f-84a3-3e50ecd18191-%E5%88%97%E...
- p####.####.com/userPermission-apiRest/video/canals/4835/gain_0008.service
- i####.####.com/qt/1018/jx/tiyan27.jpg
- 1####.####.111/GetMobile/MatchingMobile.aspx?IMSI=####&IMEI=####&TimeSta...
- 1####.####.111:8001/GetMobile/MatchingMobile.aspx?IMSI=####&IMEI=####&Ti...
- i####.####.com/20170317/75adc9d0-5372-4d0a-84fc-1622149548cf-%E6%9C%AA%E...
- 1####.####.111/APP/GetFeePoint.aspx
- i####.####.com/20170112/0e5f5728-eba3-4f41-8979-827ff6e08761-16.jpg
- i####.####.com/qt/1018/jx/tiyan28.jpg
- i####.####.com/XinChangPing225/resources/avatars/28.png
- i####.####.com/20170413/acf05cbe-ee42-4635-8333-fe59c050430f-HND-090%20%...
- i####.####.com/XinChangPing225/resources/avatars/110.png
- i####.####.com/20170317/43e16c31-db3f-426a-802c-e8f74b25b999-juy00078jp%...
- p####.####.com/userPermission-apiRest/video/canals/91195699/4/5/gain_000...
- p####.####.com/userPermission-apiPay/pay/api/91195699/4/pay_001.api
- i####.####.com/20170220/076c8a70-b5da-438a-a1af-ac5f839be359-%E6%9C%89%E...
- i####.####.com/20170314/7ff33263-fda3-492c-b2f3-d6e27f77c048-%E7%8F%BE%E...
- i####.####.com/qt/1014/jx/j1.jpg
- i####.####.com/XinChangPing225/resources/avatars/45.png
- i####.####.com/qt/1014/jx/j4.jpg
- i####.####.com/qt/1014/jx/j2.jpg
- i####.####.com:8081/XinChangPing225/resources/avatars/159.png
- p####.####.com/userPermission-apiRest/video/user/ue_0002.service?cellMod...
- p####.####.com/userPermission-apiRest/video/user/91195699/4/368227033642...
- i####.####.com/XinChangPing225/resources/avatars/46.png
Запросы HTTP POST:
- sm####.####.com/pay-sms-access//uploadOpenPayOrderResult.json?
- collec####.####.com/pay-data-collect/collectAppStartUserData.json
- sm####.####.com/pay-sms-access//getAccessPayChannel.json
- collec####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
- sm####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
- sm####.####.com/mobile-service/getOpenImsiMobilePhone.json
- collec####.####.com/pay-data-collect/uploadChannelNormalData.json
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/cache/picasso-cache/2faf9ad018b9461ff319bd133988beeb.1.tmp
- /data/data/####/cache/picasso-cache/99a5f5763003667660716f02e7e796e0.0.tmp
- /data/data/####/cache/picasso-cache/8485e5d32e115a67226e908311a49dc5.1.tmp
- /data/data/####/cache/picasso-cache/f5873d76537b5e517ed04ec3e2be11e1.0.tmp
- /data/data/####/cache/picasso-cache/01446cbbed88f58acadbf43ed545c3c8.1.tmp
- /data/data/####/shared_prefs/pay_config.xml
- /data/data/####/cache/picasso-cache/bcb13692df67e68fe05c11ab79ebe790.0.tmp
- /data/data/####/cache/picasso-cache/89b02c4ea529db2f828a1cb18575e54a.1.tmp
- /data/data/####/cache/picasso-cache/a65560b87aa6d7eb9f8a3bd8c31704db.1
- /data/data/####/cache/image_cache/v2.ols100.1/78/KzWmZIUSuWdUeayubzY-xJd0KKM.-490989322.tmp
- /data/data/####/cache/picasso-cache/b4429ffe240925687e2e430db35a7d84.1
- /data/data/####/cache/picasso-cache/89d2360f2015974ca48bf806422dc90e.1.tmp
- /data/data/####/cache/picasso-cache/ba2be4441429737e06a4399d207c2429.0.tmp
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk
- /data/data/####/app_apCoreplugn/sm.apk
- /data/data/####/cache/picasso-cache/journal.tmp
- /data/data/####/cache/picasso-cache/92e774639b7a581a3e90c85c1f62684d.1.tmp
- /data/data/####/cache/picasso-cache/49e9b6890c787923628fe7bfc627bb85.1.tmp
- /data/data/####/cache/.cache/1493299520146
- /data/data/####/cache/picasso-cache/46fd20481bc7b7e82a3f960f09177715.1.tmp
- /data/data/####/shared_prefs/pz_sharedpre_cmreaderlogininfo.xml
- /data/data/####/cache/picasso-cache/92e774639b7a581a3e90c85c1f62684d.0.tmp
- /data/data/####/cache/picasso-cache/62bd79c9915bb4f98fe950fb85810827.1.tmp
- /data/data/####/app_apCoreplugn/ZIP/plugin-20170330-2.1.9.bin
- /data/data/####/cache/image_cache/v2.ols100.1/92/928MYgYqSB1GDV2qw2KK8nag4dM.-1911390220.tmp
- /data/data/####/cache/picasso-cache/ed556172ab765dd6cbbf68a9fdf9212f.1.tmp
- /data/data/####/cache/picasso-cache/99a5f5763003667660716f02e7e796e0.1.tmp
- /data/data/####/cache/picasso-cache/c790dada9a5ab3a465cba1e8d2c2a13e.1
- /data/data/####/cache/picasso-cache/8485e5d32e115a67226e908311a49dc5.0.tmp
- /data/data/####/app_apCoreplugn/map.apk
- /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/dalvik-cache/base-1.dex
- /data/data/####/cache/map.apk.apk
- /data/data/####/cache/picasso-cache/e1182eb9f1eeaf195bbcb0bf89fc2b85.1.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/91/69T_Qm0TBzONGBBiOJPBglyjgsA.-1068628586.tmp
- /data/data/####/cache/picasso-cache/79f85feaba92b6a4c06f39f164909b96.0.tmp
- /data/data/####/cache/picasso-cache/ed556172ab765dd6cbbf68a9fdf9212f.0.tmp
- /data/data/####/cache/picasso-cache/c790dada9a5ab3a465cba1e8d2c2a13e.0.tmp
- /data/data/####/cache/picasso-cache/810414a7d91c5dcd08821ffc2f28d482.0.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/64/r5OtRYd04fhp_jNGiMiAbzbkWfA.774863421.tmp
- /data/data/####/shared_prefs/com.souying.pay.xml
- /data/data/####/databases/recordInfo-journal
- /data/data/####/cache/image_cache/v2.ols100.1/36/S8KjSunw5iTl0qkgif_eSrLMU3I.-1287867376.tmp
- /data/data/####/cache/picasso-cache/ba2be4441429737e06a4399d207c2429.1.tmp
- /data/data/####/shared_prefs/com.souying.pay.plugmain_p_config.xml
- /data/data/####/cache/picasso-cache/8fc8113afeb01c3cb6d5e0cf9d7285f8.1.tmp
- /data/data/####/cache/picasso-cache/62bd79c9915bb4f98fe950fb85810827.0.tmp
- /data/data/####/cache/picasso-cache/b4429ffe240925687e2e430db35a7d84.0
- /data/data/####/cache/.cache/1493299503104
- /data/data/####/cache/image_cache/v2.ols100.1/83/9YEVtRR76YjlvHCYW-lwVYiIRyw.-250331822.tmp
- /data/data/####/shared_prefs/plugins.serviceMapping.xml
- /data/data/####/cache/picasso-cache/6cb0fb1ae804d2ac9bcb3874a69f2982.0.tmp
- /data/data/####/cache/picasso-cache/8fc8113afeb01c3cb6d5e0cf9d7285f8.0.tmp
- /data/data/####/cache/picasso-cache/a65560b87aa6d7eb9f8a3bd8c31704db.0.tmp
- /data/data/####/cache/picasso-cache/a0e48425f9342ed55de17de8c6ec2e23.1.tmp
- /data/data/####/cache/picasso-cache/02668d3e0333b60f6a5214e77b816c8d.0
- /data/data/####/cache/picasso-cache/02668d3e0333b60f6a5214e77b816c8d.1
- /data/data/####/shared_prefs/plugins.installed.xml
- /data/data/####/cache/picasso-cache/972dcc64ff06d136396a7cc63bfcc685.1.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/94/SqtBkzqZfBEm7KBn6IU_en5W8eo.1900528708.tmp
- /data/data/####/cache/picasso-cache/01446cbbed88f58acadbf43ed545c3c8.0.tmp
- /data/data/####/databases/com.souying.pay.plugmain_sy_pay_record-journal
- /data/data/####/cache/picasso-cache/79f85feaba92b6a4c06f39f164909b96.1.tmp
- /data/data/####/cache/picasso-cache/bcb13692df67e68fe05c11ab79ebe790.1
- /data/data/####/cache/picasso-cache/49e9b6890c787923628fe7bfc627bb85.0.tmp
- /data/data/####/cache/picasso-cache/5762e642e303047ab3ba2b013327b200.1.tmp
- /data/data/####/shared_prefs/sy_pay_config.xml.bak
- /data/data/####/cache/image_cache/v2.ols100.1/7/SgTQcJyBWfaS1-gQNGwNhSnCBLs.1842893084.tmp
- /data/data/####/cache/picasso-cache/581ef184e967c8c1a3e36c0899f8a723.1.tmp
- /data/data/####/cache/picasso-cache/e1182eb9f1eeaf195bbcb0bf89fc2b85.0.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/63/AkxASjxzAkp8dzTwXkD8Qa21jMA.946776386.tmp
- /data/data/####/cache/picasso-cache/89d2360f2015974ca48bf806422dc90e.0.tmp
- /data/data/####/shared_prefs/sy_pay_config.xml
- /data/data/####/cache/picasso-cache/972dcc64ff06d136396a7cc63bfcc685.0.tmp
- /data/data/####/cache/picasso-cache/581ef184e967c8c1a3e36c0899f8a723.0.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/40/rygWXy8kOja7t7QL_uOyxb5rq_o.701858038.tmp
- /data/data/####/cache/.cache/1493299504037
- /data/data/####/cache/picasso-cache/53c7a22c408f8c079da66f91aa5b4e36.0
- /data/data/####/cache/picasso-cache/53c7a22c408f8c079da66f91aa5b4e36.1
- /data/data/####/cache/image_cache/v2.ols100.1/52/5Bw9MyPhA1FmxAEb9ZJewtkS2Pc.1148564601.tmp
- /data/data/####/cache/image_cache/v2.ols100.1/96/IcE9ZstB8xiLUrsDIsjfjZIo0yk.1950134100.tmp
- /data/data/####/cache/.cache/1493299504939
- /data/data/####/cache/picasso-cache/6cb0fb1ae804d2ac9bcb3874a69f2982.1.tmp
- /data/data/####/cache/sm.apk.apk
- /data/data/####/cache/picasso-cache/cff3e4a2bd05a0d2b67a46136a3120e0.0.tmp
- /data/data/####/cache/picasso-cache/89b02c4ea529db2f828a1cb18575e54a.0.tmp
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk
- /data/data/####/cache/picasso-cache/f5873d76537b5e517ed04ec3e2be11e1.1.tmp
- /data/data/####/cache/picasso-cache/a0e48425f9342ed55de17de8c6ec2e23.0.tmp
- /data/data/####/shared_prefs/ty_config.xml
- /data/data/####/cache/picasso-cache/46fd20481bc7b7e82a3f960f09177715.0.tmp
- /data/data/####/cache/picasso-cache/cff3e4a2bd05a0d2b67a46136a3120e0.1.tmp
- /data/data/####/cache/picasso-cache/810414a7d91c5dcd08821ffc2f28d482.1.tmp
- /data/data/####/cache/picasso-cache/2faf9ad018b9461ff319bd133988beeb.0.tmp
- /data/data/####/cache/picasso-cache/5762e642e303047ab3ba2b013327b200.0.tmp
- /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/dalvik-cache/base-1.dex
- /data/data/####/cache/picasso-cache/a5d99bbf6537ac00549231ad28e91049.1
- /data/data/####/cache/picasso-cache/a5d99bbf6537ac00549231ad28e91049.0
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 55 40 55320 /data/data/####/app_plugin_dir/com.souying.sysms/1.0_1/base-1.apk 1249861473 21642890 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext
- /system/bin/dexopt --dex 27 55 40 265840 /data/data/####/app_plugin_dir/com.souying.pay.plugmain/1.0_100/base-1.apk 1249861500 -178983397 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/f
- cat /proc/version
Может автоматически отправлять СМС-сообщения.
