Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 106912114: HZSY#<IMSI>
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony)
Сетевая активность:
Подключается к:
- 6####.####.140
- cser####.####.cn
- huangda####.com
- i####.####.com
- i####.####.com:10003
- l####.####.com
- p####.####.com
- re####.####.com
- re####.####.com:10002
- sm####.####.com
Запросы HTTP GET:
- 6####.####.140/ando/i/mon?k=####&d=####
- huangda####.com/resource!resource?resTypes=####&appid=####&channel=####&...
- i####.####.com/ando-res/ads/3/2/eff3c843-7d88-43f5-8d7e-c94c4a29226a/e1c...
- p####.####.com/cityjson?ie=####
- re####.####.com/v1/sdk/init?net_name=####&imei=####&package_name=####&sd...
- re####.####.com:10002/v1/sdk/init?net_name=####&imei=####&package_name=#...
Запросы HTTP POST:
- cser####.####.cn/channel/paymentHandle.action?v=####&requestId=####
- i####.####.com:10003/v2/chis
- l####.####.com/sdk.php
- sm####.####.com/pay-data-collect/collectAppStartUserData.json
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_apCoreplugn/####/lol.so
- <Package Folder>/app_apCoreplugn/map.apk
- <Package Folder>/app_apCoreplugn/sm.apk
- <Package Folder>/app_plugin_dir/####/base-1.apk
- <Package Folder>/app_plugin_dir/####/base-1.dex
- <Package Folder>/cache/####/crash-1501143401872.log
- <Package Folder>/cache/####/crash-1501143417931.log
- <Package Folder>/cache/####/crash-1501143423213.log
- <Package Folder>/cache/map.apk.apk
- <Package Folder>/cache/sm.apk.apk
- <Package Folder>/code-7830875/_J1Lx2UdX2sBf5NF
- <Package Folder>/databases/3j8_AJY9aHnzi1Dfv9gzcTms6SOlQr_X_8axqqyjvzVj9gLkSWStllA==
- <Package Folder>/databases/3j8_AJY9aHnzi1Dfv9gzcTms6SOlQr_X_8axqqyjvzVj9gLkSWStllA==-journal
- <Package Folder>/databases/3j8_AJY9aHnzi1Dfv9gzcTms6SOlQr_X_Da0nmOUiV0A=-journal
- <Package Folder>/databases/3j8_AJY9aHnzi1Dfv9gzcTms6SOlQr_X_mIsEBcH-Q6NuhB1U
- <Package Folder>/databases/3j8_AJY9aHnzi1Dfv9gzcTms6SOlQr_X_mIsEBcH-Q6NuhB1U-journal
- <Package Folder>/databases/3j8_AJY9aHnzi1Dfv9gzcTms6SOlQr_X_pCI6eCEf8HOAmlHbMtyOgxSlZsQ=
- <Package Folder>/databases/3j8_AJY9aHnzi1Dfv9gzcTms6SOlQr_X_pCI6eCEf8HOAmlHbMtyOgxSlZsQ=-journal
- <Package Folder>/databases/3j8_AJY9aHnzi1Dfv9gzcTms6SOlQr_X_qiu-TyPQjstPKhNbm76ptg==
- <Package Folder>/databases/3j8_AJY9aHnzi1Dfv9gzcTms6SOlQr_X_qiu-TyPQjstPKhNbm76ptg==-journal
- <Package Folder>/databases/com.souying.pay.plugmain_sy_pay_record-journal
- <Package Folder>/databases/recordInfo-journal
- <Package Folder>/databases/sy_pay_record-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/1501143401710_2118
- <Package Folder>/files/####/1501143401731_2118
- <Package Folder>/files/####/1501143401860_2118
- <Package Folder>/files/####/1501143402014_2118
- <Package Folder>/files/####/1501143417884_2274
- <Package Folder>/files/####/1501143417956_2274
- <Package Folder>/files/####/1501143418047_2274
- <Package Folder>/files/####/1501143423058_2407
- <Package Folder>/files/####/1501143423118_2407
- <Package Folder>/files/####/1501143423256_2407
- <Package Folder>/files/####/297b1e22-1e93-4ba5-9590-44d2c71dd6b4.pic
- <Package Folder>/files/####/3AGdGUpWm4RPP8oxRlUK3Q==.new
- <Package Folder>/files/####/8fvgg5aoTxjNoytu.new
- <Package Folder>/files/####/94e522b7-774f-4053-9947-6c2bd699061b.pic.temp
- <Package Folder>/files/####/989f2714-233c-4224-affb-d7b6f6da46e7.pic.temp
- <Package Folder>/files/####/9yC4EmhxJxnM3eGnJzrLGxThEDHD78TT.new
- <Package Folder>/files/####/CWtjcRk040wqRiWXGrXKj77gnIk=.new
- <Package Folder>/files/####/D-YkrPHqEl5RtQ9jSzv64g==.new
- <Package Folder>/files/####/JivdLmsbjaRLxrO_eM8GJVYGEa8=
- <Package Folder>/files/####/JivdLmsbjaRLxrO_eM8GJVYGEa8=.new
- <Package Folder>/files/####/KjDYSvis7-1-7HgqnZ2CPfAvG-jis4VrhwNXqQ==.new
- <Package Folder>/files/####/N2EmTm-pILcPYGJlP6kwaa5C7oq3DG4MsLZ1uA==.new
- <Package Folder>/files/####/QC_mzAGpAqSC4nUMgNqaAYYAE9bzljv6MHuBQRxSP0o=.new
- <Package Folder>/files/####/QTt-blDx6M8t-fTKJ_45USM9kRojEaLD
- <Package Folder>/files/####/QTt-blDx6M8t-fTKJ_45USM9kRojEaLD.new
- <Package Folder>/files/####/QZIIy88QEv0gN_jpY-HP9aRNzYlW-fCWpcJqJ3ptEUQ=.new
- <Package Folder>/files/####/Ri1SA-XOjuOG62OL671ZX90B5YfXA_eD.new
- <Package Folder>/files/####/Ry7KpNdjJmfYUyyxPdPr1aejr6g=.new
- <Package Folder>/files/####/TX0wYc7ci3qbzTKIkt5oRyvie7A=
- <Package Folder>/files/####/UgT-rENWSxXedLJKaMdxvKk200L4bGtPmPLntn9O1xE=.new
- <Package Folder>/files/####/UombWPoPF193N-kJmZwTrOKxguNvvjL9.new
- <Package Folder>/files/####/UxWsaRuCHnBYNE1kF29cQ5iYNku7c3v8068SJA==.new
- <Package Folder>/files/####/V86TZUZebaM785ux.zip
- <Package Folder>/files/####/XYKCRF-fx5ds1olq-vB3PVuPRgw=.new
- <Package Folder>/files/####/_yTSabBaUno75RdppAP36w==
- <Package Folder>/files/####/aCK6Vv7uBTZD2zpDGc39Il8-ZdxdpbTgsrKUrUJMTjI=.new
- <Package Folder>/files/####/bfb0bb0d-7233-4fe1-8cf9-3d9df7506a5a.pic
- <Package Folder>/files/####/c6f485ee-aced-40ab-bdef-a2b2bf8ca392.pic.temp
- <Package Folder>/files/####/d83d094d-4fa3-492d-85f2-4ddebbe7901c.pic.temp
- <Package Folder>/files/####/dFVqZzOoCGwpf5AQB6p-rnn3jvc=.temp
- <Package Folder>/files/####/dddc66a9-e8ec-4726-800b-b36f205a0523.pic.temp
- <Package Folder>/files/####/f5c35b3f-0db3-4026-82b8-20cf04ff195c.pic.temp
- <Package Folder>/files/####/hbipuw_f.zip
- <Package Folder>/files/####/j5kUX92_jIKeg0HpDhpf6Q==
- <Package Folder>/files/####/o43p56WDxQkEq3zawH3LcxDwKJ-ek0oZ.new
- <Package Folder>/files/####/ottOYj_gRFa9DDva
- <Package Folder>/files/####/owH4Yu4xZqrHXz1T7IK3VeRRO5bvy6xm.new
- <Package Folder>/files/####/plus.jar
- <Package Folder>/files/####/qpCR_Kz7TXWi7hc0r6Nkm3x7_at2Z6Eh.new
- <Package Folder>/files/####/runner_info.prop
- <Package Folder>/files/####/sUwjyje5efMnAgiGO2Ry-0lygKbrr_th.new
- <Package Folder>/files/####/tWsXs3ZjCXNEqdXrzPYnAQ==
- <Package Folder>/files/####/tWsXs3ZjCXNEqdXrzPYnAQ==.new
- <Package Folder>/files/####/udIo3_o5ZqA8wWgnSwgzg3GF2bs=
- <Package Folder>/files/####/zo5ZqY-20cgpAgfXYzpsF7vkLbw=.temp
- <Package Folder>/files/rdata_comyvznyxpn
- <Package Folder>/files/rdata_comyvznyxpn.new
- <Package Folder>/files/yy.dt
- <Package Folder>/shared_prefs/3c5820da2bf30a14f0fd4d99457381ce6|account_file.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/TDpref_game.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml
- <Package Folder>/shared_prefs/TDpref_longtime3.xml
- <Package Folder>/shared_prefs/TDpref_longtime3.xml.bak
- <Package Folder>/shared_prefs/TDpref_shorttime.xml
- <Package Folder>/shared_prefs/com.souying.pay.plugmain_p_config.xml
- <Package Folder>/shared_prefs/com.souying.pay.xml
- <Package Folder>/shared_prefs/plugins.installed.xml
- <Package Folder>/shared_prefs/plugins.serviceMapping.xml
- <Package Folder>/shared_prefs/pretw.xml
- <Package Folder>/shared_prefs/pretw.xml.bak
- <Package Folder>/shared_prefs/sdk.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml
- <Package Folder>/shared_prefs/sy_pay_config.xml.bak
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/twc.xml
- <Package Folder>/shared_prefs/twc.xml.bak
- <Package Folder>/shared_prefs/zzconfig.xml
- <SD-Card>/.armsd/####/0a09b878-def0-432d-9d72-ff64afb6cb74.res
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/6179f644-35b6-472d-84aa-d710fe1f6091.res
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/aaeba86c-47cc-43e4-a8e1-b34ce1213d18.res
- <SD-Card>/.armsd/####/d56f267d-d895-4047-bdb7-e6659f86542a.res
- <SD-Card>/.armsd/####/fcfad397-8803-4e0e-ada0-c04a28746f0d.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
- <SD-Card>/.tcookieid
- <SD-Card>/.twservice/####/tw
- <SD-Card>/.twservice/tkddbp_3001_2275.zip
- <SD-Card>/CrashLog/WyyyCrashLog_20170727081657_2274.log
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.no.ppw/code-7830875/_J1Lx2UdX2sBf5NF -p com.no.ppw -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- <error:2>
- cat /proc/version
- cat /sys/block/mmcblk0/device/cid
- getprop
- sh <Package Folder>/code-7830875/_J1Lx2UdX2sBf5NF -p <Package> -c com.yvzn.yxpn.bwcqug.a.a.d.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
Загружает динамические библиотеки:
- cocos2dcpp
Использует следующие алгоритмы для шифрования данных:
- DES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- DES
- DES-CBC-PKCS5Padding
Осуществляет доступ к информации о геолокации
Осуществляет доступ к информации о сети
Осуществляет доступ к информации о телефоне (номер, imei и тд.)
Осуществляет доступ к информации об установленных приложениях
Осуществляет доступ к информации о запущенных приложениях
Добавляет задания в системный планировщик
Отрисовывает собственные окна поверх других приложений
Парсит информацию из смс сообщений
Осуществляет доступ к информации об отправленых/принятых смс
