Android.SmsSend.20351

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

1069028900588: 1#<IMSI>#njjy

Сетевая активность:

Подключается к:

1####.####.com
2####.####.140
2####.####.140:8080
a####.####.com
auto####.com
auto####.com:9000
bwse####.####.com
bwse####.####.com:8220
d####.####.com
g####.####.net
g####.####.net:8080
ojtgd####.####.com
s####.####.com
s####.####.com:8351
sd####.####.com
small####.####.cn
t####.cn
tcpse####.####.com
tcpse####.####.com:28000
w####.####.com:7758

Запросы HTTP GET:

1####.####.com/ic.asp
a####.####.com/loc/?cl=####&wl=####&output=####
auto####.com/spfee/images/confignanjing.txt
auto####.com:9000/spfee/images/confignanjing.txt
bwse####.####.com/qianya/sdk/confignanjing.txt
bwse####.####.com:8220/qianya/sdk/confignanjing.txt
d####.####.com/egsb/otherPay/querySMSLimitMoney
s####.####.com/download//moduleVersion/marketing100_20170630174728458.jar
t####.cn/ajax/imsi.ashx?imsi=####
tcpse####.####.com/server_info
tcpse####.####.com:28000/server_info

Запросы HTTP POST:

2####.####.140/migusdk/tl/enclog
2####.####.140:8080/migusdk/tl/enclog
a####.####.com/app_logs
g####.####.net/migusdk/tl/tcttl
g####.####.net:8080/migusdk/verification/checkSdkUpdate
ojtgd####.####.com/classes.jar
s####.####.com:8351/user/getInfoFromSDK
sd####.####.com/behaviorLogging/eventLogging/accept?
small####.####.cn/twentyfourhours/webroot/?act=####
w####.####.com:7758/normandie/QueryConfigPolicy

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/2093.dex
<Package Folder>/2216.dex
<Package Folder>/cache/####/classes.dex
<Package Folder>/cache/2093.dex (deleted)
<Package Folder>/cacheclasses.jar
<Package Folder>/cacheguard1
<Package Folder>/cacheguard2
<Package Folder>/cachelibJniManager.so
<Package Folder>/files/####/1eca20b9035bf22fd3cb7e2a0ad8ce1d.zip
<Package Folder>/files/####/classes.jar
<Package Folder>/files/####/config.json
<Package Folder>/files/####/e5c580ea7acf956c1b5792d9d872e8c5.zip
<Package Folder>/files/####/guard1
<Package Folder>/files/####/guard2
<Package Folder>/files/####/libJniManager.so
<Package Folder>/files/####/libmiguED.so
<Package Folder>/files/####/plugin.xml
<Package Folder>/files/.imprint
<Package Folder>/files/ED.ini
<Package Folder>/files/MiguPay.Sdk30.Lib_12003031_85676173d2f977a1be990c1de9017b56_BN202.cod
<Package Folder>/files/MiguPay.Sdk30.Lib_12003031_85676173d2f977a1be990c1de9017b56_BN202.dat
<Package Folder>/files/libmgRun_04.22.09_01.so
<Package Folder>/files/mgAS.dat
<Package Folder>/files/mgSS.dat
<Package Folder>/files/mgid.dat
<Package Folder>/files/mobclick_agent_cached_<Package>5
<Package Folder>/files/playerData
<Package Folder>/files/sdk_prefs
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/cache.xml
<Package Folder>/shared_prefs/global.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<SD-Card>/Download/####/ShareData.txt
<SD-Card>/Download/####/deviceId
<SD-Card>/Download/####/miguLog_1496232153474
<SD-Card>/Download/####/miguLog_1496232153475
<SD-Card>/Download/####/miguLog_1496232153480
<SD-Card>/Download/####/miguLog_1496232173763
<SD-Card>/Download/####/miguLog_1496232173765
<SD-Card>/Download/####/miguLog_1496232173772
<SD-Card>/Download/####/sdk_prefs.txt
<SD-Card>/cmgame/####/marketing_101.jar
<SD-Card>/cmgame/####/pushDB.txt
<SD-Card>/cmgame/####/pushTime.txt
<SD-Card>/cmgame/####/pushTotal.txt