Android.SmsSend.20276

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

1069028900588: 1#<IMSI>#njjy

Сетевая активность:

Подключается к:

1####.####.com
2####.####.140
2####.####.140:8080
7x####.####.com
a####.####.com
bwse####.####.com
bwse####.####.com:8220
d####.####.com
g####.####.net
g####.####.net:8080
sd####.####.com
small####.####.cn
t####.cn
w####.####.com:7758

Запросы HTTP GET:

1####.####.com/ic.asp
a####.####.com/loc/?cl=####&wl=####&output=####
d####.####.com/egsb/startup/queryConfiguration?channelId=####&contentId=...
t####.cn/ajax/imsi.ashx?imsi=####

Запросы HTTP POST:

2####.####.140/migusdk/tl/enclog
2####.####.140:8080/migusdk/tl/enclog
7x####.####.com/classes.jar
bwse####.####.com/spfee/api/sdk/phone/configuration
bwse####.####.com:8220/qianya/sdk/confignanjing.txt
g####.####.net/migusdk/verification/checkSdkUpdate
g####.####.net:8080/migusdk/tl/tcttl
sd####.####.com/behaviorLogging/eventLogging/accept?
small####.####.cn/twentyfourhours/webroot/?act=####
w####.####.com:7758/normandie/QueryConfigPolicy

Изменения в файловой системе:

Создает следующие файлы:

/data/anr/traces.txt
<Package Folder>/2091.dex
<Package Folder>/2244.dex
<Package Folder>/2357.dex
<Package Folder>/2402.dex
<Package Folder>/cache/####/classes.dex
<Package Folder>/cache/2091.dex (deleted)
<Package Folder>/cache/2244.dex (deleted)
<Package Folder>/cache/2357.dex (deleted)
<Package Folder>/cacheclasses.jar
<Package Folder>/cacheguard1
<Package Folder>/cacheguard2
<Package Folder>/cachelibJniManager.so
<Package Folder>/files/####/classes.jar
<Package Folder>/files/####/config.json
<Package Folder>/files/####/e5c580ea7acf956c1b5792d9d872e8c5.zip
<Package Folder>/files/####/guard1
<Package Folder>/files/####/guard2
<Package Folder>/files/####/libJniManager.so
<Package Folder>/files/####/libmiguED.so
<Package Folder>/files/####/plugin.xml
<Package Folder>/files/ED.ini
<Package Folder>/files/MiguPay.Sdk30.Lib_12003022_9b71bb40aaac4f7d8d553cfe7a8d79e0_BN202.cod
<Package Folder>/files/MiguPay.Sdk30.Lib_12003022_9b71bb40aaac4f7d8d553cfe7a8d79e0_BN202.dat
<Package Folder>/files/libmgRun_04.22.08_01.so
<Package Folder>/files/mgAS.dat
<Package Folder>/files/mgSS.dat
<Package Folder>/files/mgid.dat
<Package Folder>/files/sdk_prefs
<Package Folder>/shared_prefs/GameConfig.xml
<Package Folder>/shared_prefs/GameConfig.xml.bak
<Package Folder>/shared_prefs/GameInit.xml
<Package Folder>/shared_prefs/RoadData.xml
<Package Folder>/shared_prefs/UserCar.xml
<Package Folder>/shared_prefs/UserCar.xml.bak
<Package Folder>/shared_prefs/UserConfig.xml
<Package Folder>/shared_prefs/UserConfig.xml.bak
<Package Folder>/shared_prefs/cache.xml
<Package Folder>/shared_prefs/cnzz.xml
<Package Folder>/shared_prefs/day_sign.xml
<Package Folder>/shared_prefs/dle_cfg_cmn.xml
<Package Folder>/shared_prefs/dle_cfg_cmn.xml.bak
<Package Folder>/shared_prefs/dle_loc_cfg_v2.xml
<Package Folder>/shared_prefs/dle_loc_cfg_v2.xml.bak
<Package Folder>/shared_prefs/global.xml
<Package Folder>/shared_prefs/global.xml.bak
<Package Folder>/shared_prefs/task_01.xml
<SD-Card>/.dRace/####/errorlog.txt
<SD-Card>/Android/####/unull
<SD-Card>/Download/####/ShareData.txt
<SD-Card>/Download/####/deviceId
<SD-Card>/Download/####/sdk_prefs.txt
<SD-Card>/cmgame/####/pushDB.txt
<SD-Card>/cmgame/####/pushTime.txt
<SD-Card>/cmgame/####/pushTotal.txt