Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SkyMobi.5.origin
Сетевая активность:
Подключается к:
- h####.####.com
- i####.####.com
- pi####.####.com
- and####.####.com
- f####.####.com
- w####.####.com
- d####.####.net
- l####.####.com
- m####.####.com
- and####.####.com:8077
- ping####.####.com
- a####.####.com
- b####.####.com
Запросы HTTP GET:
- i####.####.com/28/4/47373916_1_1.jpg?v=####
- a####.####.com/2339/m/static/base/styles/public_83fb756.css
- b####.####.com/group1/M00/00/04/ChM3JFeWyCeAMVL6AABXFYsHb98529.JPG
- i####.####.com/52/4/24573940_1_1.jpg?v=####
- d####.####.net/apkf/3rdapk2/M01/0C/74/wKhklFggLLiAJT70AAAkOW2094g958.apk
- i####.####.com/16/0/35982928_1_0.jpg?v=####
- i####.####.com/44/4/40455340_11.jpg?v=####
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&ep=####&et=####&ja...
- b####.####.com/group1/M00/00/00/ChM0-lkJf3mABVD4AAGLvDJ37ZI354.png
- l####.####.com/base/scripts/--/jquery.js,util/oo.js,util/json2.js,util/t...
- ping####.####.com/pingd?dm=####&pvi=####&si=####&url=####&arg=####&ty=##...
- a####.####.com/2339/m/static/page/index/index_9270fbf.js
- w####.####.com/r/378609775/index.htm?cm=####
- i####.####.com/61/5/1487908673981.jpg
- i####.####.com/36/4/5118308_1_0_180180.jpg?v=####
- w####.####.com/r/p/lyxy.jsp?ln=####&t1=####&cm=####
- a####.####.com/public/blackword_list/1?callback=####&_=####
- pi####.####.com/h5/stats.js
- i####.####.com/30/6/1482465479518.jpg
- d####.####.net/apkf/3rdapk2/M01/13/6C/wKhklVjwsaCARWV-AAQm7yY3ixc640.apk
- b####.####.com/group1/M00/00/08/ChM3JFgphJOAfVwBAABKEoDdw0M541.jpg
- b####.####.com/group1/M00/00/08/ChM3JFgphIGAax9sAABe-bWRr58234.jpg
- l####.####.com/base/styles/--/normalize.css,level/level.css
- i####.####.com/4/4/20108676_1_1.jpg?v=####
- i####.####.com/13/5/19048909_1_0.jpg?v=####
- i####.####.com/30/6/38632094_1_0.jpg?v=####
- a####.####.com/2339/m/static/page/index/index_8706ffd.css
- i####.####.com/55/7/1482465487159.jpg
- i####.####.com/8/0/1206088_1_0.jpg?v=####
- i####.####.com/48/0/47862384_1_1.jpg?v=####
- i####.####.com/26/2/17545498_1_0.jpg?v=####
- i####.####.com/48/0/21861296_1_1.jpg?v=####
- f####.####.com/qvod/handao_img/newsp/zuan_1.mp4
- i####.####.com/10/2/19563594_1_1.jpg?v=####
- i####.####.com/59/3/1452150023355.jpg
- i####.####.com/54/6/20286006_1_0_180180.jpg?v=####
- w####.####.com/r/378609775/378609778/index.htm?cm=####
- i####.####.com/47/7/31030703_1_0_180180.jpg?v=####
- d####.####.net/apkf/3rdapk2/M01/0F/ED/wKhklFi3kP6AenV0AAK1r2oCKfQ234.apk
- i####.####.com/9/1/15794569_1_0.jpg?v=####
- a####.####.com/channel/prop?_id=####&callback=####&_=####
- a####.####.com/2339/m/static/page/index/tmpl_beee10f.js
- d####.####.net/apkf/3rdapk2/M01/0F/82/wKhklFiFqJKAOnnKAACb3YsVzOg199.apk
- b####.####.com/group1/M00/00/0B/ChM3JFkUABmAanBTAAJAJt3vuCs728.png
- i####.####.com/57/1/23737081_1_0.jpg?v=####
- i####.####.com/12/4/18646284_1_1.jpg?v=####
- i####.####.com/10/2/34625290_1_1_180180.jpg?v=####
- m####.####.com/course/504703.html?cm=####
- b####.####.com/group1/M00/00/00/ChM0-lkJf4KAKL3OAAQ2hH9WU04493.png
- m####.####.com/?union=####
- h####.####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&et=####&ja=####&ln...
- a####.####.com/2339/m/static/pkg/base_0fa99ab.js
- b####.####.com/group1/M00/00/09/ChM3JFgz5yWARKgjAAFZjVv2gkE922.jpg
- d####.####.net/apkf/3rdapk2/M01/11/F8/wKhklVjkZD6AChDMAAP3wtpPkhM733.apk
- i####.####.com/51/3/22740019_1_1.jpg?v=####
- i####.####.com/1/1/1203265_1.jpg?v=####
- i####.####.com/47/7/49682607_1_1.jpg?v=####
- a####.####.com/public/blackword_list/0?callback=####&_=####
- i####.####.com/36/4/14890660_11.jpg?v=####
- b####.####.com/group1/M00/00/0B/ChM3JFkJf5WAbOTrAAEHLgVo8VU780.png
- w####.####.com/r/p/index.jsp?vt=####&cm=####
- i####.####.com/12/4/45380940_1_0.jpg?v=####
- i####.####.com/1/1/22881601_1_1.jpg?v=####
- i####.####.com/5/5/16770245_11.jpg?v=####
- i####.####.com/9/1/18701001_1_0.jpg?v=####
- i####.####.com/13/5/2047693_1_1.jpg?v=####
- b####.####.com/group1/M00/00/09/ChM3JFgz5OKAGeCaAAFlhmB50Fs280.jpg
- i####.####.com/13/5/36229389_1_1.jpg?v=####
- a####.####.com/t/font_qrktvih5p2wklnmi.ttf?t=####
- a####.####.com/2339/m/static/base/styles/theme/logo_7f47006.png
- b####.####.com/group1/M00/00/08/ChM3JFgphISAViF5AADcylQhmNE306.jpg
- i####.####.com/49/1/18791665_1_0.jpg?v=####
- i####.####.com/63/7/14797119_1_1.jpg?v=####
- b####.####.com/group1/M00/00/08/ChM3JFgphJiACwYDAAwHbIsLTxU256.gif
- i####.####.com/55/7/40916599_1_0.jpg?v=####
- h####.####.com/hm.js?a97087b####
Запросы HTTP POST:
- and####.####.com/record-plat/record/upload.do
- and####.####.com/record-collect/record/upload.do
- and####.####.com/query-plat/conf/common/query.do
- and####.####.com/record-plat/seq/query.do
- and####.####.com/zm-adv-mis/recommwall/active/query.do
- and####.####.com/zm-adv-mis/push/active/query.do
- and####.####.com/video-plat/new/column/query.do
- and####.####.com/zm-adv-mis/recommwall/list/query.do
- and####.####.com/zm-adv-mis/adv/list/query.do
- and####.####.com:8077/query-plat/cap/query.do
- and####.####.com/zm-adv-mis/push/list/query.do
- and####.####.com/android/sms/netpay/prefetch.do
- and####.####.com/zm-adv-mis/folder/active/query.do
- and####.####.com/record-plat/msg/strategy/query.do
- and####.####.com/video-plat/plugin/query.do
- and####.####.com/zm-adv-mis/folder/list/query.do
- and####.####.com/zm-adv-mis/advplugin/query.do
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/SkyAdver_file/NotifyBarAdvResponse
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/cache/image_manager_disk_cache/d76ce66ccdec5535cdde063ceb80dae0c14c9d75a40b7664ecd0c50f30a25546.0.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/SkyAdver_file/reqseq
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yijiesdk.new.apk
- /data/data/####/databases/Data_sync.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/ACCOUNT_SYSTEM_ACCOUNT_INFO.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/plugin.info
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.zhongzhisdk.new.apk.temp
- /data/data/####/app_PayImgs/531A5C15C029D8B07E6B4307444783BD
- /data/data/####/files/libabc
- /data/data/####/shared_prefs/pref_recomm.xml.bak
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.data
- /data/data/####/shared_prefs/pref_folder.xml.bak
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/paypush_preference.xml.bak
- /sdcard/Android/data/com.skymobi.pay.zmvideo/assets/video.mp4
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.new.data
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/reqseq
- /data/data/####/shared_prefs/ntf_idpadv.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/PushDataServerTime
- /data/data/####/cache/image_manager_disk_cache/5fb0db671ad746bf64982eb667e7ebb0b1143ba78801bf8f920e70e06ce005d5.0.tmp
- /data/data/####/files_main/key_AppPluginCapInfo
- /data/data/####/cache/webviewCacheChromium/f_000011
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.advert.new.data.temp
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.zhongzhisdk.new.apk
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/image_manager_disk_cache/5b67f3233ec5f54bd24868d6c0a217a66b151fe827edc4ac2e377b6c6ce48ba9.0.tmp
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/shared_prefs/plugin_record_app_info.xml
- /data/data/####/shared_prefs/pref_advert.xml
- /data/data/####/cache/image_manager_disk_cache/f8326f95a261689a5377af131ffccf522962b4208468da669f6052efdbb2db93.0.tmp
- /data/data/####/shared_prefs/pref_folder.xml
- /data/data/####/app_workbench59634/apk.zip
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/shared_prefs/paypush_preference.xml
- /sdcard/Android/data/.nomedia
- /data/data/####/cache/image_manager_disk_cache/ab4626134a9884ea3a407b1626026da68ffe958b57fd7af7d112940b62eeeb55.0.tmp
- /data/data/####/shared_prefs/data.xml
- /data/data/####/databases/cc/cc.db-journal
- /data/data/####/cache/image_manager_disk_cache/5d2142df72211827533323f163d6ae6becd321b23aa358edb570a0788c6936e6.0.tmp
- /data/data/####/shared_prefs/mainplugin_query.xml
- /data/data/####/shared_prefs/BOOT_SMS_SENT_TIME.xml
- /data/data/####/app_workbench65160/apk.zip
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_main/key_ServerPluginInfo
- /data/data/####/cache/image_manager_disk_cache/4ef7f0581215cb748b33fe01d23c9cc78bab36e4e832932706c52399eee99096.0.tmp
- /sdcard/Android/data/com.skymobi.pay.zmvideo/plugins/com.skymobi.pay.zmvideo.plugin.jar
- /data/data/####/files/mobclick_agent_cached_####1305
- /data/data/####/app_workbench70686/apk.zip
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/LatestPushIndex
- /data/data/####/app_workbench32004/apk.zip
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yijiesdk.new.apk.temp
- /data/data/####/databases/cc/cc.db
- /sdcard/Android/data/com.skymobi.pay.zmvideo/data.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.data
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.new.data.temp
- /data/data/####/files/3754c3ba0a7e1f887f5ae6303b906a50.apk
- /data/data/####/shared_prefs/mainplugin_query.xml.bak
- /data/data/####/cache/image_manager_disk_cache/04a6055cc9de18774482d04049cfafb29e85d90346b903e8daa9698ef5b10bc8.0.tmp
- /sdcard/Android/data/com.skymobi.pay.newsdk/files_adv/####/SkyAdver_file/NotifyBarAdvResponse
- /data/data/####/cache/image_manager_disk_cache/journal.tmp
- /data/data/####/files_main/key_ServerPluginInfo
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.push.new.data
- /data/data/####/app_PayImgs/5A0C98FA35D82BC7E418646B07304289
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.data
- /data/data/####/shared_prefs/BOOT_SMS_INFO.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/user.sys
- /data/data/####/app_workbench42830/apk.zip
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/SkyAdver_file/PushDataServerTime
- /data/data/####/SkyAdver_file/LatestPushIndex
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.data
- /data/data/####/cache/image_manager_disk_cache/2666bad6004c3d482ee86083c1f2ee3af0aefb90f5f65501929795e6a8564701.0.tmp
- /data/data/####/shared_prefs/pref_recomm.xml
- /sdcard/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.smspay.new.data.temp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 52 40 94816 /data/data/####/app_workbench65160/apk.zip 1252157204 -264446213 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framew
- /system/bin/dexopt --dex 27 98 40 102120 /storage/emulated/0/android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.zhongzhisdk.apk 1245148595 620116018 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framewor
- /system/bin/dexopt --dex 27 49 40 129872 /data/data/####/app_workbench70686/apk.zip 1252157204 591524218 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framew
- /system/bin/dexopt --dex 27 90 40 102120 /storage/emulated/0/android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.zhongzhisdk.apk 1245148595 620116018 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framewor
- /system/bin/dexopt --dex 27 40 40 1277392 /data/data/####/files/3754c3ba0a7e1f887f5ae6303b906a50.apk 2179072 -2144747102 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.ja
- /system/bin/dexopt --dex 27 92 40 17056 /storage/emulated/0/android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yijiesdk.apk 1229753698 832928151 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bo
- /system/bin/dexopt --dex 27 100 40 17056 /storage/emulated/0/android/data/com.skymobi.pay.newsdk/files_sms/plugins/com.newpay.spsdk.smspay.yijiesdk.apk 1229753698 832928151 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/b
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.zmvideo/plugins/com.skymobi.pay.zmvideo.plugin.jar
- /system/bin/dexopt --dex 27 44 40 1952028 /storage/emulated/0/Android/data/com.skymobi.pay.zmvideo/plugins/com.skymobi.pay.zmvideo.plugin.jar 1249802083 -1651174093 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycas
- /system/bin/dexopt --dex 27 93 40 618728 /data/data/####/app_workbench32004/apk.zip 1252157208 1597167270 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/frame
- /system/bin/dexopt --dex 27 53 40 540224 /data/data/####/app_workbench59634/apk.zip 1252157205 1715135955 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/frame
- /system/bin/dexopt --dex 27 81 40 541712 /data/data/####/app_workbench32004/apk.zip 1252157207 -349942904 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/frame
- /system/bin/dexopt --dex 27 94 40 349240 /data/data/####/app_workbench42830/apk.zip 1252157208 -1220698994 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/fram
Может автоматически отправлять СМС-сообщения.
