Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SmsSend.18686
- Android.SmsSend.18687
- Tool.SMSSend.533
- Android.SmsSpy.6069
Сетевая активность:
Подключается к:
- 1####.####.34:19000
- d####.####.com
- 1####.####.57:10001
- p####.####.com
- p####.####.com:7820
- a####.####.com:8088
- d####.####.com:8080
- apm-col####.####.com
- p####.####.cc
- a####.####.com
Запросы HTTP GET:
- d####.####.com/upload/plugin/net.tt.plugin.yiyou_p20170510140657
- d####.####.com/upload/plugin/net.tt.plugin.mysdk_p20170511154835
- a####.####.com:8088/earth/enable?deviceid=####&version=####&imsi=####
- d####.####.com/upload/plugin/net.tt.plugin.anou_p20170510173035
- p####.####.com/?igtcmd=####&nativePayCmd=####&iccid=####&price=####&imsi...
- d####.####.com:8080/upload/plugin/net.tt.plugin.yufeng_p20170510172955
- p####.####.com/openicon?appid=####&channelid=####
- p####.####.com/?igtcmd=####&order=####&state=####&paymsg=####&fingerprin...
- p####.####.com/openplg?appid=####&channelid=####
- p####.####.com/cityjson?ie=####
- d####.####.com/upload/plugin/net.tt.plugin.zhongzhi_p20170510172902
- d####.####.com/upload/plugin/net.tt.plugin.yuanyu_p20170427134503
- d####.####.com/upload/plugin/net.tt.plugin.taiku_p20170510173018
- 1####.####.57:10001/v1/order/get?app_vername=####&phone=####&imei=####&p...
- p####.####.com/?igtcmd=####&iccid=####&imsi=####&imei=####&order=####&um...
Запросы HTTP POST:
- p####.####.cc/index.php/MC/HB
- 1####.####.34:19000/v2/chis
- p####.####.com/
- apm-col####.####.com/cpi/crash
- p####.####.com:7820/
- p####.####.cc/index.php/MC/RP
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/Plugin/net.tt.plugin.damai/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.damai/Signature/Signature_0.key
- /data/data/####/files/8abf6b60337506765c9598469956dc26.apk
- /data/data/####/Plugin/net.tt.plugin.mysdk/dalvik-cache/base-1.dex
- /data/data/####/Plugin/net.tt.plugin.yiyou/apk/base-1.apk
- /data/data/####/shared_prefs/ShareFiles.xml
- /data/data/####/files/net.tt.plugin.taiku.apk
- /data/data/####/files/splash.dat
- /data/data/####/Plugin/net.tt.plugin.zhongzhi/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.anou/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.yiyou/dalvik-cache/base-1.dex
- /data/data/####/Plugin/net.tt.plugin.zhongzhi/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.mysdk.apk
- /data/data/####/Plugin/net.tt.plugin.yuanyu/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.anou/Signature/Signature_0.key
- /data/data/####/files/mobclick_agent_cached_####
- /data/data/####/Plugin/net.tt.plugin.damai/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.anou.apk
- /data/data/####/Plugin/net.tt.plugin.anou/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.yufeng
- /data/data/####/files/net.tt.plugin.yuanyu.apk
- /data/data/####/files/net.tt.plugin.anou
- /data/data/####/Plugin/net.tt.plugin.yufeng/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.zhongzhi.apk
- /data/data/####/files/net.tt.plugin.yiyou.apk
- /data/data/####/Plugin/net.tt.plugin.taiku/apk/base-1.apk
- /data/data/####/Plugin/net.tt.plugin.taiku/dalvik-cache/base-1.dex
- /data/data/####/files/net.tt.plugin.zhongzhi
- /data/data/####/Plugin/net.tt.plugin.yufeng/apk/base-1.apk
- /sdcard/com.zckj.files/u.apk
- /data/data/####/Plugin/net.tt.plugin.mysdk/Signature/Signature_0.key
- /sdcard/Sonnenblume/res.apk.u
- /data/data/####/files/net.tt.plugin.mysdk
- /data/data/####/files/net.tt.plugin.yuanyu
- /data/data/####/shared_prefs/third_info.xml
- /data/data/####/files/net.tt.plugin.yufeng.apk
- /data/data/####/Plugin/net.tt.plugin.taiku/Signature/Signature_0.key
- /data/data/####/files/net.tt.plugin.yiyou
- /data/data/####/Plugin/net.tt.plugin.taiku/lib/tmp.Kp2151
- /data/data/####/shared_prefs/game_state_file.xml
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
- /data/data/####/Plugin/net.tt.plugin.yufeng/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.mysdk/apk/base-1.apk
- /data/data/####/files/net.tt.plugin.damai.apk
- /data/data/####/shared_prefs/userinfo_file.xml
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/Plugin/net.tt.plugin.zhongzhi/Signature/Signature_0.key
- /data/data/####/Plugin/net.tt.plugin.yiyou/Signature/Signature_0.key
- /data/data/####/files/net.tt.plugin.taiku
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 79 40 282068 /data/data/####/Plugin/net.tt.plugin.yiyou/apk/base-1.apk 0 -1826296197 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /syste
- /system/bin/dexopt --dex 27 80 40 250096 /data/data/####/Plugin/net.tt.plugin.mysdk/apk/base-1.apk 0 -1387118692 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /syste
- /system/bin/dexopt --dex 27 68 40 204480 /data/data/####/Plugin/net.tt.plugin.anou/apk/base-1.apk 0 361608946 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/f
- /system/bin/dexopt --dex 27 40 40 2947752 /data/data/####/files/8abf6b60337506765c9598469956dc26.apk 2179072 1959543360 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar
- /system/bin/dexopt --dex 27 70 40 172292 /data/data/####/Plugin/net.tt.plugin.yufeng/apk/base-1.apk 0 1974962180 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /syste
- chmod -R 755 /data/data/####/Plugin
- /system/bin/dexopt --dex 27 50 40 123764 /data/data/####/Plugin/net.tt.plugin.yufeng/data/net.tt.plugin.yufeng/files/mj.apk 1225747527 1829278891 45 /system/framework/core.jar /system/framework/core-junit.jar /system/
- /system/bin/dexopt --dex 27 63 40 398600 /data/data/####/Plugin/net.tt.plugin.damai/apk/base-1.apk 0 -942305813 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system
- /system/bin/dexopt --dex 27 46 40 477372 /storage/emulated/0/com.zckj.files/u.apk 0 -1595531788 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/framework.jar /sy
- /system/bin/dexopt --dex 27 64 40 128600 /data/data/####/Plugin/net.tt.plugin.zhongzhi/apk/base-1.apk 0 -1607311582 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /sy
- /system/bin/dexopt --dex 27 55 40 246200 /data/data/####/Plugin/net.tt.plugin.taiku/apk/base-1.apk 0 1326277547 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system
Может автоматически отправлять СМС-сообщения.
