Android.SmsSend.20548

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

12114516412: systemcGx1dG8yNTAwMjY2OTkxODc3NDM=

Сетевая активность:

Подключается к:

c####.####.com
l####.####.com
l####.####.com:9820
p####.####.cn
p####.####.com
p####.####.com:9000
w####.####.com

Запросы HTTP GET:

c####.####.com/20170710/tongyu-pay-lib-2156-ymt.apk
p####.####.com/sdkMis/getRdoUrl
p####.####.com/versionpatch?updVersion=####&crc32=####&version=####&imsi...
w####.####.com/rdo/order/invalid;jsessionid=C95C88D01CD5A6E4AB47066EA813...

Запросы HTTP POST:

l####.####.com/chnlt/ltpay/pytstart.do
l####.####.com:9820/chnlt/ltpay/pytstart.do
p####.####.cn/index.php/API
p####.####.com:9000/sdk_pools_pay_version

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/app_tongyu/####/tongyu-pay-lib.apk
<Package Folder>/databases/TestinAgent.db
<Package Folder>/databases/TestinAgent.db-journal
<Package Folder>/databases/mp.db
<Package Folder>/databases/mp.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/1496215277066_2128
<Package Folder>/files/####/1496215277188_2128
<Package Folder>/files/####/1496215277222_2128
<Package Folder>/files/####/1496215277294_2128
<Package Folder>/files/cp_block_201.dat
<Package Folder>/files/libyunsvc
<Package Folder>/files/plugin.apk
<Package Folder>/files/plugin.dex
<Package Folder>/files/second_block_201.dat
<Package Folder>/shared_prefs/3db355750bea842d8ee0cece950aa5ecd|account_file.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/CYCLE_PAY_PREF_NAME.xml
<Package Folder>/shared_prefs/CYCLE_UNIQUE_ID.xml
<Package Folder>/shared_prefs/DATE.xml
<Package Folder>/shared_prefs/LANG_SDK_PREF.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
<Package Folder>/shared_prefs/TDpref_game.xml
<Package Folder>/shared_prefs/TDpref_longtime.xml
<Package Folder>/shared_prefs/TDpref_longtime3.xml
<Package Folder>/shared_prefs/TDpref_longtime3.xml.bak
<Package Folder>/shared_prefs/TDpref_shorttime.xml
<Package Folder>/shared_prefs/TestinAgent.xml
<Package Folder>/shared_prefs/appstartone.xml
<Package Folder>/shared_prefs/appstarttwo.xml
<Package Folder>/shared_prefs/cpMsg.xml
<Package Folder>/shared_prefs/device_id.xml.xml
<Package Folder>/shared_prefs/port.xml
<Package Folder>/shared_prefs/port.xml.bak
<Package Folder>/shared_prefs/shareyuanlangfirst.xml
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/uuid.xml
<Package Folder>/shared_prefs/yunchao_sp.xml
<Package Folder>/shared_prefs/yunchao_sp.xml.bak
<SD-Card>/.tcookieid
<SD-Card>/Android/####/com.lyhtgh.pay.ltplugin.apk
<SD-Card>/com/####/uid.sys
<SD-Card>/lang_cyclesdk/cyclesdk.apk