Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.332.origin
Сетевая активность:
Подключается к:
- s####.####.com
- 2####.####.123
- g####.####.net
- s####.####.com:9090
- g####.####.net:8080
- 1####.####.174
- t####.####.cn
- 2####.####.123:95
Запросы HTTP GET:
- 1####.####.174/tone/6c88354a-2fe0-4bd8-9a3b-72c43f82a04c.jpg
- 1####.####.174/tone/f55308ed-a558-428e-a0eb-1cd86d2ac0f2.png
- 1####.####.174/tone/d71b0cdc-dd45-4cd2-81ca-3d69b0130134.jpg
- t####.####.cn/public/ringmaker01/n17/2017/05/2017%E5%B9%B405%E6%9C%8815%...
- 1####.####.174/tone/57a22bcc-677a-4afd-afe5-270b26901ce2.jpg
- 1####.####.174/tone/d97cb99e-23c5-47eb-ad36-1699fe5a09f6.jpg
- 1####.####.174/tone/ef2f295d-b679-459c-94d2-9f4a678c0010.jpg
- 1####.####.174/tone/93884bf9-75a3-4b88-8107-23ddedd7f905.jpg
- 1####.####.174/tone/3264e381-b51d-486a-a61c-cf8dbd0d8410.jpg
- 1####.####.174/tone/7e55938e-985f-4a1b-82d6-3db1092925ef.jpg
- 1####.####.174/tone/6bdc4706-fb4e-4c00-b7c4-487d34b1d704.jpg
- 1####.####.174/tone/f42c06ff-be57-4cf6-b492-65cb04a34a80.jpg
- t####.####.cn/public/ringmaker01/n16/2017/02/2017%E5%B9%B402%E6%9C%8816%...
- 1####.####.174/tone/619d9ee6-58f7-48e2-ae91-bb75015898aa.jpg
- 1####.####.174/tone/18657545-3753-4895-a7e6-02d7cde12da1.jpg
- 1####.####.174/tone/c1eeff28-d7c5-450e-9aff-5ec81567cb46.apk
- 1####.####.174/tone/7d3dcf2e-2536-4f6b-b8f8-6f946cbff139.jpg
Запросы HTTP POST:
- g####.####.net:8080/migusdk/verification/checkSdkUpdate
- 2####.####.123/sdkServer/1.0/user/query
- 2####.####.123/sdkServer/1.0/cp/query
- 1####.####.174/User/PlayTotal?ts=####&sig=MDB####
- s####.####.com:9090/fcc/ws
- 1####.####.174/Other/Splash?ts=####&sig=MUF####
- s####.####.com/zfservices/advert/query
- 1####.####.174/home/BannerSitf?ts=####&sig=MkU####
- 1####.####.174/home/dataList?ts=####&sig=NTg####
- 2####.####.123:95/sdkServer/checksmsinitreturn
- 1####.####.174/home/dataList?ts=####&sig=OTk####
- s####.####.com/fcc/ws
- g####.####.net/migusdk/verification/checkSdkUpdate
- 1####.####.174/User/PlayTotal?ts=####&sig=MTM####
- 2####.####.123/sdkServer/checksmsinitreturn
- 1####.####.174/User/AppActive?ts=####&sig=RjZ####
- g####.####.net/migusdk/tl/initcttl
- 1####.####.174/home/dataList?ts=####&sig=NTY####
- 1####.####.174/home/banner?ts=####&sig=MDg####
- 1####.####.174/Other/ApkUpd?ts=####&sig=QTM####
- 2####.####.123/sdkServer/1.0/crbt/open/check
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/volley/1782681301301781078
- <Package Folder>/cache/picasso-cache/d42a7df06fc7add9cd14c913762efbb1.1.tmp
- <Package Folder>/files/mg20irid.dat
- <Package Folder>/databases/<Package>.Resident.db-journal
- <Package Folder>/cache/picasso-cache/143c521ad7b6bd3026227a4d9bf6969f.1.tmp
- <Package Folder>/cache/volley/-5138927391818454589
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/cache/picasso-cache/9b2afafb039e148d802c0c2c133b5a3c.0.tmp
- <Package Folder>/files/tmp/mg20dss.dat
- <Package Folder>/cache/volley/-6805229811303896638
- <Package Folder>/app_lib/libmiguED.so
- <Package Folder>/databases/cc/cc.db
- <Package Folder>/cache/volley/-513897358-577202632
- <Package Folder>/cache/picasso-cache/d42a7df06fc7add9cd14c913762efbb1.0.tmp
- <Package Folder>/cache/volley/21334103241363127624
- <Package Folder>/cache/picasso-cache/b06e821f39c42e4e207c3418adcfc2d0.1.tmp
- <Package Folder>/files/MiguPay.Sdk20.Lib_12002100_DDF8C0A058919AC984E73F334438F269_AE200.dat
- <Package Folder>/databases/<Package>.Resident2.db
- <Package Folder>/shared_prefs/JPushSA_Config.xml.bak
- <Package Folder>/files/jpush_stat_cache.json
- <Package Folder>/files/sdk_prefs
- <Package Folder>/cache/picasso-cache/5bc08853dc100171f897ccb42ec54747.1.tmp
- <Package Folder>/cache/picasso-cache/fb2bc9f858f1b7f4a8fa4e1eed6d8290.0.tmp
- <Package Folder>/cache/volley/-423271214-1026730028
- <Package Folder>/cache/volley/17826842451329888981
- <Package Folder>/cache/volley/1392761058-1892708223
- <Package Folder>/cache/picasso-cache/c3455c7cc0150c6cdc7cd018e6e19dab.1.tmp
- <Package Folder>/cache/volley/-875892963-371216061
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/mg20dss.dat
- <Package Folder>/.rom1734228504.jar
- <Package Folder>/cache/volley/17827257532066940457
- <Package Folder>/files/tmp/MiguPay.Sdk20.Lib_12002100_DDF8C0A058919AC984E73F334438F269_AE200.dat
- <Package Folder>/shared_prefs/JPushSA_Config.xml
- <Package Folder>/files/mg20css.dat
- <Package Folder>/databases/cc/cc.db-journal
- <Package Folder>/cache/picasso-cache/c3455c7cc0150c6cdc7cd018e6e19dab.0.tmp
- <Package Folder>/cache/picasso-cache/143c521ad7b6bd3026227a4d9bf6969f.0.tmp
- <Package Folder>/cache/picasso-cache/fb2bc9f858f1b7f4a8fa4e1eed6d8290.1.tmp
- <Package Folder>/cache/picasso-cache/eede301ee424e322461a7150c971b9aa.0.tmp
- <Package Folder>/cache/picasso-cache/5bc08853dc100171f897ccb42ec54747.0.tmp
- <Package Folder>/cache/volley/-1119236208659330502
- <Package Folder>/cache/picasso-cache/b06e821f39c42e4e207c3418adcfc2d0.0.tmp
- <Package Folder>/cache/picasso-cache/eede301ee424e322461a7150c971b9aa.1.tmp
- <Package Folder>/databases/<Package>.Resident2.db-journal
- <Package Folder>/cache/volley/1782682850-1526861379
- <Package Folder>/jacruntime.dex
- <Package Folder>/shared_prefs/biosConfig.xml
- <Package Folder>/cache/picasso-cache/9b2afafb039e148d802c0c2c133b5a3c.1.tmp
- <Package Folder>/files/appsdkmg0_.jar
- <Package Folder>/.rom1456778575.jar
- <Package Folder>/shared_prefs/null.xml
- <Package Folder>/files/tmp/mg20css.dat
- <Package Folder>/shared_prefs/biosConfig.xml.bak
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml
- <Package Folder>/cache/volley/1782725685-1761128686
- <Package Folder>/cache/picasso-cache/journal.tmp
- <Package Folder>/databases/<Package>.Resident.db
- <Package Folder>/cache/volley/1782678446-1777522736
- <Package Folder>/shared_prefs/com.qxtimes.library.music.tools.SharedPreferencesUtils.xml
- <Package Folder>/files/mobclick_agent_cached_<Package>317
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
Может автоматически отправлять СМС-сообщения.
