Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 12114: HZSY#<IMSI>
Загружает на исполнение код следующих детектируемых угроз:
- Android.SmsSend.11672
Загружает из Интернета следующие детектируемые угрозы:
- Android.SmsSend.11672
Сетевая активность:
Подключается к:
- and####.####.com:8077
- col####.####.com
- dynami####.####.com
- i####.####.cn
- i####.####.com
- mmys####.####.com
- prcha####.####.com
- tra####.####.cn
Запросы HTTP GET:
- i####.####.cn/6aea29e456a047e084863fc79ca78b9f.png
- i####.####.com/5535b6dad1084980b5c99426617c7fc4.png
- mmys####.####.com/mmys-cps/qryVideoChannelContentList.service?rv=####&pi...
- tra####.####.cn/traffic-server/plug!plugSwitch.action?&appId=####&channe...
Запросы HTTP POST:
- and####.####.com:8077/record-plat/seq/query.do
- col####.####.com/stats.service
- dynami####.####.com/dynamicpay//getSyFormalChannels.json?
- prcha####.####.com/prc-has/getImsiMobilePhone.json
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_workbench60098/apk.zip
- <Package Folder>/app_workbench65624/apk.zip
- <Package Folder>/cache/####/03650f813f90c509be7d36197e755d26.0.tmp
- <Package Folder>/cache/####/03650f813f90c509be7d36197e755d26.1.tmp
- <Package Folder>/cache/####/3c7ebe1a368725093676f2c5d8c824f4.0.tmp
- <Package Folder>/cache/####/3c7ebe1a368725093676f2c5d8c824f4.1.tmp
- <Package Folder>/cache/####/497f9fa97cdac105a1cbbcb328a2f490.0.tmp
- <Package Folder>/cache/####/497f9fa97cdac105a1cbbcb328a2f490.1.tmp
- <Package Folder>/cache/####/50d904ccf6938c03d24ee06694dab02b.0.tmp
- <Package Folder>/cache/####/50d904ccf6938c03d24ee06694dab02b.1.tmp
- <Package Folder>/cache/####/574d1ebaeb9bc7b72726b90733ca812d.0.tmp
- <Package Folder>/cache/####/574d1ebaeb9bc7b72726b90733ca812d.1.tmp
- <Package Folder>/cache/####/67c5e97895ac1fae4d9d773c8700043b.0.tmp
- <Package Folder>/cache/####/67c5e97895ac1fae4d9d773c8700043b.1.tmp
- <Package Folder>/cache/####/6be17683a0644938715577244bb7222a.0.tmp
- <Package Folder>/cache/####/6be17683a0644938715577244bb7222a.1.tmp
- <Package Folder>/cache/####/77b3b3eaaee0a2d6aa5df9f8b35ad91b.0.tmp
- <Package Folder>/cache/####/77b3b3eaaee0a2d6aa5df9f8b35ad91b.1.tmp
- <Package Folder>/cache/####/91112f5100bb83dffcc908270ce70b36.0.tmp
- <Package Folder>/cache/####/91112f5100bb83dffcc908270ce70b36.1.tmp
- <Package Folder>/cache/####/91d104f26d0bafba42ad6fe209a2e088.0.tmp
- <Package Folder>/cache/####/91d104f26d0bafba42ad6fe209a2e088.1.tmp
- <Package Folder>/cache/####/99dc5b42c9ab86cf69001da9947ca1da.0.tmp
- <Package Folder>/cache/####/99dc5b42c9ab86cf69001da9947ca1da.1.tmp
- <Package Folder>/cache/####/a73a90ec334e634607644fda298ed266.0.tmp
- <Package Folder>/cache/####/a73a90ec334e634607644fda298ed266.1.tmp
- <Package Folder>/cache/####/b93375bd4de155a8b39b5c24e1f4ad41.0.tmp
- <Package Folder>/cache/####/b93375bd4de155a8b39b5c24e1f4ad41.1.tmp
- <Package Folder>/cache/####/e93a1609b0a51e4cac6b3894422865b1.0.tmp
- <Package Folder>/cache/####/e93a1609b0a51e4cac6b3894422865b1.1.tmp
- <Package Folder>/cache/####/ee4c57d57086ed953ee1686f63bacdf0.0.tmp
- <Package Folder>/cache/####/ee4c57d57086ed953ee1686f63bacdf0.1.tmp
- <Package Folder>/cache/####/f9ba1910b208d65bb92b242c81e2e5b4.0.tmp
- <Package Folder>/cache/####/f9ba1910b208d65bb92b242c81e2e5b4.1.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/Data_sync.db-journal
- <Package Folder>/databases/p_db
- <Package Folder>/databases/p_db-journal
- <Package Folder>/databases/recommend_app-journal
- <Package Folder>/databases/statistics_db
- <Package Folder>/databases/statistics_db-journal
- <Package Folder>/databases/sy_pay_record-journal
- <Package Folder>/databases/sy_video-journal
- <Package Folder>/databases/sy_video_data_cache-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/OriginClasses.jar
- <Package Folder>/files/####/busybox
- <Package Folder>/files/####/libinst.so
- <Package Folder>/files/####/nail
- <Package Folder>/files/####/sub_nail
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/config_ad.xml
- <Package Folder>/shared_prefs/ds_configer.xml
- <Package Folder>/shared_prefs/p_config.xml
- <Package Folder>/shared_prefs/plugin_record_app_info.xml
- <Package Folder>/shared_prefs/pt.xml
- <Package Folder>/shared_prefs/recommend.xml
- <Package Folder>/shared_prefs/time.xml
- <Package Folder>/shared_prefs/uuid.xml
- <SD-Card>/Android/####/com.skymobi.pay.plugin.main.apk
- <SD-Card>/Android/####/com.skymobi.pay.plugin.recordupload.apk
- <SD-Card>/SYPAYFILENAME/####/ISDELSMS
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.main.apk
- chmod 666 /storage/emulated/0/Android/data/com.skymobi.pay.newsdk/plugins/com.skymobi.pay.plugin.recordupload.apk
- rm -f <Package Folder>/files/.tmp/.rooted
- sh -c <Package Folder>/files/.tmp/busybox rm -f <Package Folder>/files/.tmp/.rooted
