Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 12114: HZSY#<IMSI>
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Triada.247.origin
- Android.Triada.248.origin
Отправляет данные получаемых СМС-сообщений на удалённый хост.
Сетевая активность:
Подключается к:
- 1####.####.227
- 6####.####.140
- cser####.####.cn
- huangda####.com
- i####.####.com
- i####.####.com:10003
- l####.####.com
- mobil####.####.com
- p####.####.com
- re####.####.com
- sm####.####.com
Запросы HTTP GET:
- 6####.####.140/ando/i/mon?k=####&d=####
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.com/ando-res/ads/27/1/a35bc83b-9bc9-40ec-ba09-35ad6fe13d58/5e...
- p####.####.com/cityjson?ie=####
- re####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sd...
Запросы HTTP POST:
- 1####.####.227/shop/shop_upload_log
- cser####.####.cn/channel/paymentHandle.action?v=####&requestId=####
- i####.####.com:10003/v2/chis
- l####.####.com/sdk.php
- mobil####.####.com/mobile-service/getOpenImsiMobilePhone.json
- sm####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_apCoreplugn/####/lol.so
- <Package Folder>/app_apCoreplugn/map.apk
- <Package Folder>/app_apCoreplugn/sm.apk
- <Package Folder>/app_plugin_dir/####/base-1.apk
- <Package Folder>/app_plugin_dir/####/base-1.dex
- <Package Folder>/cache/####/crash-1496215267770.log
- <Package Folder>/cache/map.apk.apk
- <Package Folder>/cache/sm.apk.apk
- <Package Folder>/code-6532848/sJ-RVz2nu-rXSq35
- <Package Folder>/databases/NkWy49sgmxbdgy8p_gvfXPU6C4I0b1eW_Uo294UIYm8PBgqnK
- <Package Folder>/databases/NkWy49sgmxbdgy8p_gvfXPU6C4I0b1eW_Uo294UIYm8PBgqnK-journal
- <Package Folder>/databases/NkWy49sgmxbdgy8p_gvfXPU6C4I0b1eW_V1Xz6NQvftBDHJAn_qtM7NMRNe8=
- <Package Folder>/databases/NkWy49sgmxbdgy8p_gvfXPU6C4I0b1eW_V1Xz6NQvftBDHJAn_qtM7NMRNe8=-journal
- <Package Folder>/databases/NkWy49sgmxbdgy8p_gvfXPU6C4I0b1eW_YEHsDAQs8pWmqoFxzwqrjw==
- <Package Folder>/databases/NkWy49sgmxbdgy8p_gvfXPU6C4I0b1eW_YEHsDAQs8pWmqoFxzwqrjw==-journal
- <Package Folder>/databases/NkWy49sgmxbdgy8p_gvfXPU6C4I0b1eW_ZjuSzHfR6-c=-journal
- <Package Folder>/databases/NkWy49sgmxbdgy8p_gvfXPU6C4I0b1eW_y2sQnbuvzDSArZk4yFJcNg==
- <Package Folder>/databases/NkWy49sgmxbdgy8p_gvfXPU6C4I0b1eW_y2sQnbuvzDSArZk4yFJcNg==-journal
- <Package Folder>/databases/com.souying.pay.plugmain_sy_pay_record-journal
- <Package Folder>/databases/recordInfo-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/09f33560-0d51-4b49-a41d-c6c6b10bb154.pic.temp
- <Package Folder>/files/####/1496215267657_2143
- <Package Folder>/files/####/1496215267669_2143
- <Package Folder>/files/####/1496215267756_2143
- <Package Folder>/files/####/1496215267848_2143
- <Package Folder>/files/####/20DdeJE98LcbhMzrwYoXdeAmOHo=
- <Package Folder>/files/####/23s6wXsdh4qJqI_FFwto82LGMTZ8ChAi9Z3F2uT76Ng=.new
- <Package Folder>/files/####/2Ve9GgkSFjl4UgXJvAJmV6fMNb0OqeTgnvW0pw==.new
- <Package Folder>/files/####/2gXtGneqdqVNkr9mx4bAecoU4z3_oNwB.new
- <Package Folder>/files/####/39fa8f1b-27f2-44dc-9bc4-ca55376a04fb.pic.temp
- <Package Folder>/files/####/6004991b-3a45-4507-b8dc-548440db6fea.pic.temp
- <Package Folder>/files/####/7KN0litIWf65PO59DBBz58DwAhA=.new
- <Package Folder>/files/####/7a32693b-1d87-4e56-97be-a2398bc47ada.pic
- <Package Folder>/files/####/89437440-a4d9-45a1-94d3-3050bbb462c5.pic.temp
- <Package Folder>/files/####/BAXefZSxb81PJr5u7nAwR6oC74-sqfs_GxNSD_IYa1U=.new
- <Package Folder>/files/####/BblRrNt_vS5-hHsqZWL7Gg==
- <Package Folder>/files/####/BblRrNt_vS5-hHsqZWL7Gg==.new
- <Package Folder>/files/####/Ddcf1KXlPAuzfz7XvDtJVDMowWY=.temp
- <Package Folder>/files/####/FMTxE5E1kf8ZmWoIV1alQRHZGRgJ_LLt
- <Package Folder>/files/####/FMTxE5E1kf8ZmWoIV1alQRHZGRgJ_LLt.new
- <Package Folder>/files/####/Fs4CJqa4LS-PP4U3.zip
- <Package Folder>/files/####/G3KTpKnuS5FbosGZVYelMiNX3FU=.new
- <Package Folder>/files/####/NZP7m9HRuxCLRLmOtH2t1eIPcmI=.new
- <Package Folder>/files/####/Q-Mf0XvpSMLFj5AHkks_B0uRpUm9CQlN.new
- <Package Folder>/files/####/REBVusvVP8vxsCoxUyP78Q==
- <Package Folder>/files/####/REBVusvVP8vxsCoxUyP78Q==.new
- <Package Folder>/files/####/Rhl8TGGUvlK2f7gtUUt-I1Q300nXxlUo.new
- <Package Folder>/files/####/S461EzPTmtQ8XmQhXkKgCUc0cbf-vXNs.new
- <Package Folder>/files/####/ZZY-lnLUpar8WSab.new
- <Package Folder>/files/####/__ojuHO-MYqRR2Tti4vIZg==
- <Package Folder>/files/####/aQUMen5q16PwIgBYk4wmowHluy_vFBNOPpnZ4w==.new
- <Package Folder>/files/####/bFz980Th9O2NvyqMX5Ozpg==
- <Package Folder>/files/####/bFz980Th9O2NvyqMX5Ozpg==.new
- <Package Folder>/files/####/bQCi-bfpbmBnyS4CGCfzGCD0qFrG-Xj9.new
- <Package Folder>/files/####/d93d2981-e760-4f7a-92cb-d22915511b84.pic
- <Package Folder>/files/####/df31c3d8-e541-4b84-8d76-8be965b2f73e.pic.temp
- <Package Folder>/files/####/eusk4yFlwSB5CGOxZW0J3N3f-dc=.temp
- <Package Folder>/files/####/f3b9de2d-0a8a-45e7-8ba3-8d74d8523eba.pic.temp
- <Package Folder>/files/####/fNFoTVOa5UFJZ4ZW9si4u-7yoFtf5uQK5UtxFN-Pu28=.new
- <Package Folder>/files/####/hTtvghcp5cex2tT8iPGBy_CXA48=
- <Package Folder>/files/####/hbipuw_f.zip
- <Package Folder>/files/####/jHGqiwhkKIOMULzifTgwdA==
- <Package Folder>/files/####/l3Xj3pEAtitXBzsu
- <Package Folder>/files/####/o4ovqjGN49QDraqeBLMLGm-RBI4=
- <Package Folder>/files/####/o4ovqjGN49QDraqeBLMLGm-RBI4=.new
- <Package Folder>/files/####/plus.jar
- <Package Folder>/files/####/runner_info.prop
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/svvPL9YMpHFQkiwm6jrgWPIn_mS_1dan.new
- <Package Folder>/files/####/tWIAdDJeNxcZZh2BY4rwZsbEK-sDeSde89wAR-dp68U=.new
- <Package Folder>/files/####/xGc5aSuR7qXVjnhgrcwqbpoD4z0U9ObQpZSUvQ==.new
- <Package Folder>/files/####/y-yu1a1-Zji7cuwfrHwln1llS2Ww5s76.new
- <Package Folder>/files/rdata_comyvznyxpn
- <Package Folder>/files/rdata_comyvznyxpn.new
- <Package Folder>/shared_prefs/3db355750bea842d8ee0cece950aa5ecd|account_file.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/TDpref_game.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml
- <Package Folder>/shared_prefs/TDpref_longtime3.xml
- <Package Folder>/shared_prefs/TDpref_longtime3.xml.bak
- <Package Folder>/shared_prefs/TDpref_shorttime.xml
- <Package Folder>/shared_prefs/com.souying.pay.plugmain_p_config.xml
- <Package Folder>/shared_prefs/com.souying.pay.xml
- <Package Folder>/shared_prefs/plugins.installed.xml
- <Package Folder>/shared_prefs/plugins.serviceMapping.xml
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/pretw.xml.bak
- <Package Folder>/shared_prefs/sdk.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml.bak
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/twc.xml
- <Package Folder>/shared_prefs/twc.xml.bak
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.armsd/####/44d0afe7-4ac0-40aa-a89f-5dcb2fef0e3f.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/5c41a0bf-58c4-4214-afd7-a4dafc50d5f8.res
- <SD-Card>/.armsd/####/8c96fb79-dd76-4e9b-bc7e-dbe0af50c3b3.res
- <SD-Card>/.armsd/####/988a8166-8b98-4e56-9bd3-64130a32b138.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/a5de9616-3797-491d-87e9-5dfb2053091a.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/.tcookieid
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/tkddbp_3001_2275.zip
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.ab.ab/code-6532848/sJ-RVz2nu-rXSq35 -p com.ab.ab -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <dexopt>
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
- getprop
- sh <Package Folder>/code-6532848/sJ-RVz2nu-rXSq35 -p <Package> -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
