Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 12114: HZSY#<IMSI>
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.247.origin
- Android.Triada.248.origin
Сетевая активность:
Подключается к:
- 6####.####.140
- collec####.####.com
- huangda####.com
- i####.####.com:10003
- l####.####.com
- p####.####.com
- re####.####.com
- re####.####.com:10002
- sm####.####.com
Запросы HTTP GET:
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- p####.####.com/cityjson?ie=####
- re####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sd...
- re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
Запросы HTTP POST:
- 6####.####.140/ando/v1/x/lv?app_id=####&r=####
- collec####.####.com/pay-data-collect/collectAppStartUserData.json
- i####.####.com:10003/v2/chis
- l####.####.com/sdk.php
- sm####.####.com/pay-sms-access//getAccessPayChannel.json
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_apCoreplugn/####/lol.so
- <Package Folder>/app_apCoreplugn/map.apk
- <Package Folder>/app_apCoreplugn/sm.apk
- <Package Folder>/app_plugin_dir/####/base-1.apk
- <Package Folder>/app_plugin_dir/####/base-1.dex
- <Package Folder>/cache/####/crash-1496215266684.log
- <Package Folder>/cache/####/crash-1496215285433.log
- <Package Folder>/cache/map.apk.apk
- <Package Folder>/cache/sm.apk.apk
- <Package Folder>/code-2382976/TpTHpeWwdg7udARL
- <Package Folder>/databases/UDyuXNvw06bGs7DSj_ttK8euQ9rvOfFw_-1nFsu6orRYX8UADuS7V3VsN1KQ=
- <Package Folder>/databases/UDyuXNvw06bGs7DSj_ttK8euQ9rvOfFw_-1nFsu6orRYX8UADuS7V3VsN1KQ=-journal
- <Package Folder>/databases/UDyuXNvw06bGs7DSj_ttK8euQ9rvOfFw_8wFFXxBFQdcV4Ji1KMvQ-Q==
- <Package Folder>/databases/UDyuXNvw06bGs7DSj_ttK8euQ9rvOfFw_8wFFXxBFQdcV4Ji1KMvQ-Q==-journal
- <Package Folder>/databases/UDyuXNvw06bGs7DSj_ttK8euQ9rvOfFw_Xsmhhx5N2DPSuazL
- <Package Folder>/databases/UDyuXNvw06bGs7DSj_ttK8euQ9rvOfFw_Xsmhhx5N2DPSuazL-journal
- <Package Folder>/databases/UDyuXNvw06bGs7DSj_ttK8euQ9rvOfFw_hspIVaYrTEs=-journal
- <Package Folder>/databases/UDyuXNvw06bGs7DSj_ttK8euQ9rvOfFw_jTM6UZ8IVgRAJxPr_oGciQ==
- <Package Folder>/databases/UDyuXNvw06bGs7DSj_ttK8euQ9rvOfFw_jTM6UZ8IVgRAJxPr_oGciQ==-journal
- <Package Folder>/databases/com.souying.pay.plugmain_sy_pay_record-journal
- <Package Folder>/databases/recordInfo-journal
- <Package Folder>/databases/sy_pay_record-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/-7B0nWPJkcs4ZY95dh6pxe9IpNOgO73h.new
- <Package Folder>/files/####/1496215267020_2107
- <Package Folder>/files/####/1496215267100_2107
- <Package Folder>/files/####/1496215267274_2107
- <Package Folder>/files/####/1496215267350_2107
- <Package Folder>/files/####/1496215285183_2400
- <Package Folder>/files/####/1496215285261_2400
- <Package Folder>/files/####/1496215285329_2400
- <Package Folder>/files/####/2QzOiucrBTsxI3jN
- <Package Folder>/files/####/3vrkZUg41Gsy37TSAidSHXZzL3F1zKZpa3j3QPe2A6Y=.new
- <Package Folder>/files/####/4J6Nm0WlKvkkkHO9iZH72Pc9dHuXwzQhaOLHMSzhUdg=.new
- <Package Folder>/files/####/CtqgwNc9VJOEc7KMXh0X8A==
- <Package Folder>/files/####/HaRLzjFk6il-KpONXPKLwI9crMDySCES.new
- <Package Folder>/files/####/O82i4fqvaAq2_m1HgzD8lIhNUmadQUtyfmbLHg==.new
- <Package Folder>/files/####/Qi08on-kRl3XTWWQs1JOzdb9g9S5P8h5.new
- <Package Folder>/files/####/QkDTb5rWfAyJa3pV82cERcMlJTKu-ppH1OBIls1P648=.new
- <Package Folder>/files/####/Qv999tMdOQJqlDV5lXosrGQc6q0=
- <Package Folder>/files/####/Qv999tMdOQJqlDV5lXosrGQc6q0=.new
- <Package Folder>/files/####/RzFCKeUaArjRrdKucmyEm7uEcsReZYrP
- <Package Folder>/files/####/RzFCKeUaArjRrdKucmyEm7uEcsReZYrP.new
- <Package Folder>/files/####/UWDWeifBQzkhZaTKwuDij-4CSpw=
- <Package Folder>/files/####/ZZ8MRaKiqBqxguOtPqFXU9em8s_02Xh-1cA1dg==.new
- <Package Folder>/files/####/aSeoCu0QHaa7Q7Q4L7cvMNYcpjXfQ7k2.new
- <Package Folder>/files/####/agNHYi0X--aBl5vtFHKs8A==.new
- <Package Folder>/files/####/cxaJSGEX119zCvTm.zip
- <Package Folder>/files/####/dfNdLip29xHrP7DFEkdUYzrbFl7G_XR0.new
- <Package Folder>/files/####/gtmLD36OdsJqji1UJUEEgh1NtM6Q_PvX.new
- <Package Folder>/files/####/hbipuw_f.zip
- <Package Folder>/files/####/ixbGlDe6Q3s3Z1VSk29U34PZGwk=
- <Package Folder>/files/####/ixbGlDe6Q3s3Z1VSk29U34PZGwk=.new
- <Package Folder>/files/####/jYK9Bd4BG6CdmfnpMLjnqw==.new
- <Package Folder>/files/####/kDA2Q_k51_0nkh9oA3Fg8BnkdzDGCoKm.new
- <Package Folder>/files/####/p3dzvijnuB4WmFZDqctFscWzk2cyUWpXHf8fgw==.new
- <Package Folder>/files/####/plus.jar
- <Package Folder>/files/####/qJNJXcmebkfTXkSJAENrfQ==
- <Package Folder>/files/####/qJNJXcmebkfTXkSJAENrfQ==.new
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/svOorE2LULmQPhtUXmVgng==
- <Package Folder>/files/####/uaoAVx2DOd3koeK8-ZKP0XpBs5M=.new
- <Package Folder>/files/####/x-r3szGotWbdixa-7SqWg9xJzMs=.new
- <Package Folder>/files/####/yQ-EEwGvDaPtxEnPOgneUzShvgg=
- <Package Folder>/files/####/z--aOjp1i_GXLo4N3R-XuwQqhITImd1oBUGApiJB1dM=.new
- <Package Folder>/files/noend.ini
- <Package Folder>/files/rdata_comyvznyxpn
- <Package Folder>/files/rdata_comyvznyxpn.new
- <Package Folder>/shared_prefs/3db355750bea842d8ee0cece950aa5ecd|account_file.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/TDpref_game.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml.bak
- <Package Folder>/shared_prefs/TDpref_longtime3.xml
- <Package Folder>/shared_prefs/TDpref_longtime3.xml.bak
- <Package Folder>/shared_prefs/TDpref_shorttime.xml
- <Package Folder>/shared_prefs/com.souying.pay.plugmain_p_config.xml
- <Package Folder>/shared_prefs/com.souying.pay.xml
- <Package Folder>/shared_prefs/dispatch_log.xml
- <Package Folder>/shared_prefs/plugins.installed.xml
- <Package Folder>/shared_prefs/plugins.serviceMapping.xml
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/pretw.xml.bak
- <Package Folder>/shared_prefs/sdk.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml.bak
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/twc.xml
- <Package Folder>/shared_prefs/twc.xml.bak
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.tcookieid
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3001_2257.zip
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.mmp.pmm/code-2382976/TpTHpeWwdg7udARL -p com.mmp.pmm -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
- getprop
- sh <Package Folder>/code-2382976/TpTHpeWwdg7udARL -p <Package> -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
