Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SkyMobi.6.origin
Сетевая активность:
Подключается к:
- s####.####.com
- l####.####.com:9820
- and####.####.com
- c####.####.com
- d####.####.net
- and####.####.com:8077
Запросы HTTP GET:
- d####.####.net/apkf/3rdapk2/M01/13/6C/wKhklVjwsaCARWV-AAQm7yY3ixc640.apk
- s####.####.com/chksdkupdate.php?sdkver=####&compver=####&mainver=####&ch...
- d####.####.net/apkf/3rdapk2/M01/0E/50/wKhklFhblTOAFDJdAADx6QcmZVE171.apk
- d####.####.net/apkf/3rdapk2/M01/0E/50/wKhklFhbmYeALjHcAACxpWlURyc965.apk
- c####.####.com/mainjarupdate/gamesdk/59810/empty14/10051/main.zip
- d####.####.net/apkf/3rdapk2/M01/0E/57/wKhklVhl8iuAPRONAASU16x8R3w033.apk
- s####.####.com/getdomain.php?chid=####&subchid=####
- and####.####.com/3rd-access-android/image/show.do?imageName=####
- s####.####.com/chksdkupdate.php?sdkver=####&compver=####&mainver=####&ex...
Запросы HTTP POST:
- l####.####.com:9820/chnlt/ltpay/pytstart.do
- and####.####.com/android/sms/netpay/prefetch.do
- and####.####.com/payment-adv-mis/adv/payment/getAdvInfo.do
- and####.####.com:8077/query-plat/cap/query.do
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/app_workbench51590/apk.zip
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.Pc1914
- /data/data/####/shared_prefs/excl_lb_kxqp.xml
- /data/data/####/.zmvmp_1787_257774/classes.dex
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.Oe2370
- /sdcard/.####/game_res/conveying
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.NO1914
- /data/data/####/shared_prefs/uuid.xml
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.Fb1897
- /data/data/####/shared_prefs/first.xml
- /data/data/####/.zmvmp_2356_319438/libzmvmpcls.2356.729319472.so
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.new.apk.temp
- /data/data/####/.zmvmp_2471_323018/libkxqpzmvmpinf.2471.729323018.so
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.Km2394
- /data/data/####/databases/Data_sync.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/appstarttwo.xml
- /data/data/####/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
- /data/data/####/app_workbench79912/apk.zip
- /data/data/####/.zmvmp_1897_263052/libzmvmpcls.1897.729263065.so
- /data/data/####/shared_prefs/mainplugin_query.xml
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.JY1897
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.oL1897
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.new.apk
- /data/data/####/.zmvmp_2370_319511/libkxqpzmvmpinf.2370.729319511.so
- /data/data/####/shared_prefs/excl_lb_lbmain.xml
- /sdcard/Android/data/com.skymobi.pay.app/zyfadv/response.data
- /data/data/####/shared_prefs/excl_lb_chInfo.xml
- /data/data/####/shared_prefs/excl_lb_platform.xml.bak
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.No2370
- /data/data/####/.zmvmp_1823_259013/libkxqpzmvmpinf.1823.729259014.so
- /data/data/####/app_workbench23960/apk.zip
- /data/data/####/.zmvmp_2394_319887/classes.dex
- /data/data/####/.zmvmp_1946_264173/libkxqpzmvmpinf.1946.729264173.so
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.new.apk.temp
- /data/data/####/.zmvmp_2471_323018/classes.dex
- /data/data/####/files_main/key_AppPluginCapInfo
- /data/data/####/.zmvmp_1946_264173/libzmvmpcls.1946.729264194.so
- /data/data/####/shared_prefs/excl_lb_kxqpChannal.xml
- /data/data/####/.zmvmp_2394_319887/libzmvmpcls.2394.729319991.so
- /data/data/####/.zmvmp_2370_319511/libzmvmpcls.2370.729319537.so
- /data/data/####/shared_prefs/excl_lb_extractInfo.xml.bak
- /data/data/####/shared_prefs/appstartone.xml
- /data/data/####/zyfadv/response.data
- /data/data/####/app_workbench85212/apk.zip
- /data/data/####/.zmvmp_1849_259899/classes.dex
- /data/data/####/.zmvmp_1823_259013/classes.dex
- /sdcard/com/android/system/uid.sys
- /data/data/####/shared_prefs/excl_lb_kxqpVersion.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.new.apk
- /data/data/####/.zmvmp_2356_319438/libkxqpzmvmpinf.2356.729319438.so
- /data/data/####/.zmvmp_2370_319511/classes.dex
- /data/data/####/shared_prefs/excl_lb_extractInfo.xml
- /data/data/####/shared_prefs/excl_lb_gameInfo.xml
- /data/data/####/.zmvmp_1897_263052/classes.dex
- /data/data/####/databases/database-journal
- /data/data/####/.zmvmp_1914_263439/libkxqpzmvmpinf.1914.729263439.so
- /sdcard/.####/apk/main.zip.dload
- /data/data/####/app_workbench79686/apk.zip
- /data/data/####/.zmvmp_1849_259899/libkxqpzmvmpinf.1849.729259899.so
- /data/data/####/shared_prefs/BOOT_SMS_SENT_TIME.xml
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.lm2370
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.apk
- /data/data/####/files/classes.dex
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.apk
- /data/data/####/app_workbench29486/apk.zip
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_main/key_ServerPluginInfo
- /data/data/####/shared_prefs/excl_lb_platform.xml
- /data/data/####/.zmvmp_1823_259013/libzmvmpcls.1823.729259058.so
- /data/data/####/shared_prefs/excl_lb_domain.xml
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.HP2394
- /data/data/####/.zmvmp_1914_263439/libzmvmpcls.1914.729263473.so
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
- /data/data/####/shared_prefs/excl_lb_updateInfo.xml
- /data/data/####/.platformcache/tmp/main/main2.jar
- /data/data/####/.zmvmp_2394_319887/libkxqpzmvmpinf.2394.729319888.so
- /data/data/####/.zmvmp_2471_323018/libzmvmpcls.2471.729323031.so
- /data/data/####/.zmvmp_1849_259899/libzmvmpcls.1849.729259929.so
- /data/data/####/.zmvmp_1946_264173/classes.dex
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.apk.temp
- /sdcard/.####/game_res/verinfo.cfg
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.Sl2370
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.eW2394
- /data/data/####/.zmvmp_1897_263052/libkxqpzmvmpinf.1897.729263052.so
- /data/data/####/.zmvmp_2356_319438/classes.dex
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.lL1914
- /data/data/####/.zmvmp_1914_263439/classes.dex
- /data/data/####/shared_prefs/zhangpay_sms_info.xml
- /sdcard/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk
- /data/data/####/.zmvmp_1787_257774/libzmvmpcls.1787.729257884.so
- /data/data/####/files_main/key_ServerPluginInfo
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.AI1914
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.HQ1897
- /data/data/####/shared_prefs/excl_lb_soUpdate.xml
- /data/data/####/shared_prefs/BOOT_SMS_INFO.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/user.sys
- /data/data/####/.platformcache/tmp/main/lib_main/tmp.Fd2394
- /data/data/####/app_workbench85438/apk.zip
- /data/data/####/.zmvmp_1787_257774/libkxqpzmvmpinf.1787.729257774.so
Другие:
Запускает следующие shell-скрипты:
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.apk
- /system/bin/dexopt --dex 27 43 40 122456 /data/data/####/app_workbench85212/apk.zip 1252156949 -467306285 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.apk
- /system/bin/dexopt --dex 27 41 40 122456 /data/data/####/app_workbench85438/apk.zip 1252156948 -467306285 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- chmod 777 /storage/emulated/0/.####/apk/main.zip.dload
- /system/bin/dexopt --dex 27 43 40 122456 /data/data/####/app_workbench51590/apk.zip 1252156916 -467306285 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 43 40 122456 /data/data/####/app_workbench29486/apk.zip 1252156918 -467306285 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 68 40 80704 /data/data/####/app_workbench23960/apk.zip 1252156918 -2103829846 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 47 40 80704 /data/data/####/app_workbench85438/apk.zip 1252156948 -2103829846 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 48 40 427204 /data/data/####/app_workbench79912/apk.zip 1252156948 1965759370 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 41 40 256040 /data/data/####/.platformcache/tmp/main/main2.jar 1196846525 -1457148364 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /sy
- /system/bin/dexopt --dex 27 42 40 353956 /storage/emulated/0/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk 1192341958 -1604353612 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/f
- chmod 755 /data/data/####/.platformcache/tmp/main/main2.jar
- /system/bin/dexopt --dex 27 49 40 427204 /data/data/####/app_workbench79686/apk.zip 1252156950 1965759370 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 49 40 80704 /data/data/####/app_workbench85212/apk.zip 1252156949 -2103829846 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/fra
- /system/bin/dexopt --dex 27 41 40 353956 /storage/emulated/0/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk 1192341958 -1604353612 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/f
- chmod 777 /storage/emulated/0/.####/apk
- /system/bin/dexopt --dex 27 43 40 353956 /storage/emulated/0/Android/data/com.lyhtgh.pay/plugins/com.lyhtgh.pay.ltplugin.apk 1192341958 -1604353612 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/f
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
