Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 1069028900588: 1#<IMSI>#njjy
Сетевая активность:
Подключается к:
- 1####.####.136
- 1####.####.136:8222
- 1####.####.87
- 1####.####.87:8220
- 1####.####.com
- 2####.####.140:8080
- 7x####.####.com
- a####.####.com
- d####.####.com
- g####.####.net
- g####.####.net:8080
- i####.####.com
- ojtgd####.####.com
- p####.####.com
- sd####.####.com
- t####.cn
- w####.####.com:7758
Запросы HTTP GET:
- 1####.####.com/ic.asp
- a####.####.com/loc/?cl=####&wl=####&output=####
- d####.####.com/egsb/startup/queryConfiguration?channelId=####&contentId=...
- i####.####.com/a/315432f0c34a6005ff1c18a57a27f742e
- t####.cn/ajax/imsi.ashx?imsi=####
Запросы HTTP POST:
- 1####.####.136/spfee/api/resource/sdk/sdkinfo
- 1####.####.136:8222/qianya/sdk/confignanjing.txt
- 1####.####.87/spfee/api/sdk/phone/simcard
- 1####.####.87:8220/spfee/api/sdk/task/load
- 2####.####.140:8080/migusdk/tl/enclog
- 7x####.####.com/confignanjing.txt
- g####.####.net/migusdk/verification/checkSdkUpdate
- g####.####.net:8080/migusdk/tl/tcttl
- ojtgd####.####.com/classes.jar
- p####.####.com/api/statis/315432f0c34a6005ff1c18a57a27f742e/game-D9D62A7...
- sd####.####.com/behaviorLogging/eventLogging/accept?
- w####.####.com:7758/normandie/QueryConfigPolicy
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_td-cache/td_database_push
- <Package Folder>/app_td-cache/tdandroidgame
- <Package Folder>/cache/temp.dex (deleted)
- <Package Folder>/databases/talkingdata_app.db
- <Package Folder>/databases/talkingdata_app.db-journal
- <Package Folder>/files/####/libmiguED.so
- <Package Folder>/files/MiguPay.Sdk30.Lib_12003003_43efb5b963adb1ee861394bf563737f6_BN202.cod
- <Package Folder>/files/MiguPay.Sdk30.Lib_12003003_43efb5b963adb1ee861394bf563737f6_BN202.dat
- <Package Folder>/files/libmgRun_04.22.05_01.so
- <Package Folder>/files/mgAS.dat
- <Package Folder>/files/mgSS.dat
- <Package Folder>/files/mgid.dat
- <Package Folder>/files/sdk_prefs
- <Package Folder>/files/talkingdata_app_process_preferences_file
- <Package Folder>/files/talkingdata_app_version_preferences_file
- <Package Folder>/shared_prefs/315432f0c34a6005ff1c18a57a27f742e|account_file.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/pref_file.xml
- <Package Folder>/shared_prefs/td_pefercen_profile.xml
- <Package Folder>/shared_prefs/td_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/temp.dex
- <SD-Card>/.tcookieid
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- cat /proc/cpuinfo
- cat /sys/class/net/wlan0/address
