Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 106575206321505460: dyl#<IMSI>,<IMEI>,6000090-1-1003-6_kh29s0271_-0
- 12114516412: systemcGx1dG8yNTAwMjY2OTkxODc3NDM=
Сетевая активность:
Подключается к:
- a####.####.cn
- a####.####.com
- and####.####.com
- and####.####.com:8077
- c####.####.com
- huangda####.com
- p####.####.cn
- p####.####.com
- w####.####.com
Запросы HTTP GET:
- a####.####.cn/ssp/api/getCfg.jhtm
- c####.####.com/20170715/tongyu-pay-lib-2159-ymt.apk
- huangda####.com/active!activeLog.action?provider=####&clickId=####&manu=...
- p####.####.com/sdkMis/getRdoUrl
- w####.####.com/rdo/order/invalid;jsessionid=672F9A3FE034D0C4E7F61E72AE94...
Запросы HTTP POST:
- a####.####.com/app_logs
- and####.####.com/record-plat/seq/query.do
- and####.####.com:8077/record-plat/seq/query.do
- p####.####.cn/index.php/API
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_tongyu/####/tongyu-pay-lib.apk
- <Package Folder>/app_workbench31912/apk.zip
- <Package Folder>/app_workbench37438/apk.zip
- <Package Folder>/app_workbench48716/apk.zip
- <Package Folder>/app_workbench54242/apk.zip
- <Package Folder>/app_workbench76506/apk.zip
- <Package Folder>/app_workbench93310/apk.zip
- <Package Folder>/cache/####/-658207981168452061
- <Package Folder>/cache/####/1511321729-1697802357
- <Package Folder>/cache/####/485438327954843277
- <Package Folder>/cache/sr.apk
- <Package Folder>/databases/Data_sync.db-journal
- <Package Folder>/databases/adshower.db-journal
- <Package Folder>/databases/mp.db
- <Package Folder>/databases/mp.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/libabc
- <Package Folder>/files/mobclick_agent_cached_<Package>1003
- <Package Folder>/files/noend.ini
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/PreferanceUtil.xml
- <Package Folder>/shared_prefs/PreferanceUtil.xml.bak
- <Package Folder>/shared_prefs/TestinAgent.xml
- <Package Folder>/shared_prefs/cpMsg.xml
- <Package Folder>/shared_prefs/device_id.xml.xml
- <Package Folder>/shared_prefs/dispatch_log.xml
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.tpservice/####/qsha_80001_5096.jar
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/qshp_3003_2257.zip
- <SD-Card>/Android/####/com.skymobi.pay.plugin.main.data
- <SD-Card>/Android/####/com.skymobi.pay.plugin.recordupload.data
- <SD-Card>/CrashLog/WyyyCrashLog_20170531072143_2200.log
- <SD-Card>/CrashLog/WyyyCrashLog_20170531072147_2392.log
- <SD-Card>/SystemChannel/systemLyChannel
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- cat /sys/block/mmcblk0/device/cid
- cat /sys/class/net/wlan0/address
