Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 10698000036592: 3fed20cf-98a5-499a-b701-501f71e12e3b-1495006109699,点击发送直接注册
- 10698000036592: 997a3112-8ee6-4a8f-af22-699489b24216-1495006149944,点击发送直接注册
Сетевая активность:
Подключается к:
- t####.####.com
- i####.####.com:8000
- c####.####.com
- wap####.####.com
- l####.####.com
- a####.####.com
- pass####.####.com
Запросы HTTP GET:
- wap####.####.com/static/appsapi/conf/config.txt?cdnversion=####&tpl=####...
- pass####.####.com/wp/api/login/history?item=####&token=####&clientfrom=#...
- t####.####.com/tb/client/logsync2.js?t=####
- i####.####.com:8000/
Запросы HTTP POST:
- a####.####.com/app_logs
- pass####.####.com/v2/sapi/getdpass
- pass####.####.com/v2/sapi/smsgetlogin
- c####.####.com/c/s/switch
- l####.####.com/sdk.php
- c####.####.com/c/s/inpv
- c####.####.com/c/s/pluginsconfig
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/plugins/BdSocialShareSdk.xml
- <Package Folder>/databases/ice.tbhp
- <Package Folder>/shared_prefs/bids.xml.bak
- <Package Folder>/shared_prefs/settings.xml
- <Package Folder>/files/tmp/BdSocialShareSdk/jar/social_share_sdk.jar
- <Package Folder>/shared_prefs/mobclick_agent_header_<Package>.xml
- <Package Folder>/shared_prefs/bids.xml
- <Package Folder>/files/tmp/baobaosdk/plugin.xml
- <Package Folder>/databases/baidu_tieba.db-journal
- <Package Folder>/shared_prefs/tiebahelper.xml
- <Package Folder>/files/tmp/dqsdk/jar/dqsdk.jar
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/plugins/baobaosdk.xml
- <Package Folder>/shared_prefs/adp_feature_switch.xml
- <Package Folder>/shared_prefs/adp_feature_switch.xml.bak
- <Package Folder>/files/wappass.baidu.com-passport-login.html
- <Package Folder>/files/tmp/hao123/plugin.xml
- <Package Folder>/files/plugins/libs/dqsdk.jar
- <Package Folder>/files/tmp/baobaosdk/jar/baobaosdk.jar
- <Package Folder>/files/tmp/dqsdk/plugin.xml
- <Package Folder>/files/plugins/libs/baobaosdk.jar
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/shared_prefs/sapi_system.xml
- <Package Folder>/shared_prefs/mobclick_agent_state_<Package>.xml.bak
- <Package Folder>/databases/tbhp_cache.db-journal
- <Package Folder>/files/plugins/libs/hao123.jar
- <Package Folder>/files/tmp/hao123/jar/hao123.jar
- <Package Folder>/shared_prefs/settings.xml.bak
- <Package Folder>/databases/ice.tbhp-journal
- <Package Folder>/files/stat/stat44f94582Writing.log
- <Package Folder>/files/plugins/libs/social_share_sdk.jar
- <Package Folder>/files/tmp/BdSocialShareSdk/plugin.xml
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/plugins/hao123.xml
- <Package Folder>/files/plugins/dqsdk.xml
- <Package Folder>/shared_prefs/common_settings.xml
- <Package Folder>/shared_prefs/sapi_system.xml.bak
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- getprop net.dns2
- getprop net.dns1
- <dexopt>
- getprop ro.miui.ui.version.name
Может автоматически отправлять СМС-сообщения.
