Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 106575206321505460: dyl#null,<IMEI>,6000098-1-214748-ssys_00613-0
- 10691009: @8DYL#null,<IMEI>,6000098-1-214748-ssys_00613-0
- 12114516412: systemcGx1dG8yNTAwMjY2OTkxODc3NDM=
Сетевая активность:
Подключается к:
- a####.####.cn
- col####.####.com
- huangda####.com
- i####.####.cn
- mo####.####.com
- p####.####.cn
- s####.####.com
- v####.####.cn
- z####.####.com
Запросы HTTP GET:
- a####.####.cn/video-app/server/userHelp.html
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- i####.####.cn/iplookup/iplookup.php?format=####
- v####.####.cn/FjQPv7dlKae6jPgR3KsVRpdTarro-AvatarMiddle
- z####.####.com/m/m151.mp4
Запросы HTTP POST:
- col####.####.com/pay-data-collect/collectAppStartUserData.json
- mo####.####.com/mobile-service/getOpenImsiMobilePhone.json
- p####.####.cn/index.php/API
- s####.####.com/pay-sms-access//uploadSmsDetailInfo.json?
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_apCoreplugn/####/23uiusfjc.bin
- <Package Folder>/app_apCoreplugn/sinner.apk
- <Package Folder>/app_apCoreplugn/sky.apk
- <Package Folder>/app_apCoreplugn/smap.apk
- <Package Folder>/app_apCoreplugn/sms.apk
- <Package Folder>/app_apCoreplugn/sqq.apk
- <Package Folder>/app_apCoreplugn/sweb.apk
- <Package Folder>/app_apCoreplugn/syl.apk
- <Package Folder>/app_plugin_dir/####/base-1.apk
- <Package Folder>/app_plugin_dir/####/base-1.dex
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/sinner.apk.apk
- <Package Folder>/cache/sky.apk.apk
- <Package Folder>/cache/smap.apk.apk
- <Package Folder>/cache/sms.apk.apk
- <Package Folder>/cache/sqq.apk.apk
- <Package Folder>/cache/sweb.apk.apk
- <Package Folder>/cache/syl.apk.apk
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/TestinAgent.db
- <Package Folder>/databases/TestinAgent.db-journal
- <Package Folder>/databases/com.core.main.pay.plugmain_sy_pay_record-journal
- <Package Folder>/databases/mp.db
- <Package Folder>/databases/mp.db-journal
- <Package Folder>/databases/recordInfo-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/xUtils_http_cookie.db
- <Package Folder>/databases/xUtils_http_cookie.db-journal
- <Package Folder>/files/mobclick_agent_cached_<Package>2147483647
- <Package Folder>/shared_prefs/CHECK_VERSION_TIME.xml
- <Package Folder>/shared_prefs/CONFIGS.xml
- <Package Folder>/shared_prefs/FIRST_ENTER_PLAY.xml
- <Package Folder>/shared_prefs/LOGIN_TIME.xml
- <Package Folder>/shared_prefs/PAY_STATUS.xml
- <Package Folder>/shared_prefs/PLAY_COUNT.xml
- <Package Folder>/shared_prefs/PROTOCOL_SHOW.xml
- <Package Folder>/shared_prefs/RECORD_INFOS.xml
- <Package Folder>/shared_prefs/RECORD_INFOS.xml.bak
- <Package Folder>/shared_prefs/SAFETIPS.xml
- <Package Folder>/shared_prefs/THIRD_STATUS_UPLOAD.xml
- <Package Folder>/shared_prefs/TestinAgent.xml
- <Package Folder>/shared_prefs/UPDATE_VERSION.xml
- <Package Folder>/shared_prefs/USER_EXTRA_INFO.xml
- <Package Folder>/shared_prefs/USER_OPEN_COUNT.xml
- <Package Folder>/shared_prefs/com.core.main.pay.plugmain_p_config.xml
- <Package Folder>/shared_prefs/com.souying.pay.xml
- <Package Folder>/shared_prefs/cpMsg.xml
- <Package Folder>/shared_prefs/device_id.xml.xml
- <Package Folder>/shared_prefs/getFlag.xml
- <Package Folder>/shared_prefs/plugins.installed.xml
- <Package Folder>/shared_prefs/plugins.serviceMapping.xml
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/signUpload.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml.bak
- <Package Folder>/shared_prefs/twc.xml
- <Package Folder>/shared_prefs/twc.xml.bak
- <Package Folder>/shared_prefs/umengEnable.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/userInfo.xml
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3001_2274.zip
- <SD-Card>/Android/####/-119364979
- <SD-Card>/Android/####/-125424024.tmp
- <SD-Card>/Android/####/-1260819636.tmp
- <SD-Card>/Android/####/-1268207648.tmp
- <SD-Card>/Android/####/-136292001.tmp
- <SD-Card>/Android/####/-1433934119.tmp
- <SD-Card>/Android/####/-147419963.tmp
- <SD-Card>/Android/####/-1741023183.tmp
- <SD-Card>/Android/####/-183924152.tmp
- <SD-Card>/Android/####/-185846556.tmp
- <SD-Card>/Android/####/-1928952030.tmp
- <SD-Card>/Android/####/-1952831884.tmp
- <SD-Card>/Android/####/-2082275344.tmp
- <SD-Card>/Android/####/-2099478909.tmp
- <SD-Card>/Android/####/-24037258.tmp
- <SD-Card>/Android/####/-381324218.tmp
- <SD-Card>/Android/####/-67389520.tmp
- <SD-Card>/Android/####/-678369030.tmp
- <SD-Card>/Android/####/-67970597.tmp
- <SD-Card>/Android/####/-781822830.tmp
- <SD-Card>/Android/####/-812369691.tmp
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1047061303.tmp
- <SD-Card>/Android/####/1122775634.tmp
- <SD-Card>/Android/####/1235034122.tmp
- <SD-Card>/Android/####/1323884823.tmp
- <SD-Card>/Android/####/1413924631
- <SD-Card>/Android/####/143246314
- <SD-Card>/Android/####/1470231709.tmp
- <SD-Card>/Android/####/1505132456.tmp
- <SD-Card>/Android/####/1510971595.tmp
- <SD-Card>/Android/####/1540288370.tmp
- <SD-Card>/Android/####/1582227920.tmp
- <SD-Card>/Android/####/1620296718.tmp
- <SD-Card>/Android/####/1898151556.tmp
- <SD-Card>/Android/####/1971445410.tmp
- <SD-Card>/Android/####/1978821443.tmp
- <SD-Card>/Android/####/2035494241.tmp
- <SD-Card>/Android/####/2060744266.tmp
- <SD-Card>/Android/####/298299142.tmp
- <SD-Card>/Android/####/316362759.tmp
- <SD-Card>/Android/####/334446035.tmp
- <SD-Card>/Android/####/365245048.tmp
- <SD-Card>/Android/####/582158801.tmp
- <SD-Card>/Android/####/617565282.tmp
- <SD-Card>/Android/####/911312921.tmp
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
Может автоматически отправлять СМС-сообщения.
