Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 106584211: 5fd3bec6c0a86a405181739134168226本条免费短信用于快速登录，请勿修改
Загружает из Интернета следующие детектируемые угрозы:
- Android.SmsSend.10124
Сетевая активность:
Подключается к:
- s####.####.com
- 1####.####.197:8080
- 7j####.####.com
- obf0c####.####.com
- w####.####.com
- 1####.####.195
- boo####.####.cn
- a####.####.com
Запросы HTTP GET:
- boo####.####.cn/pubres/book/4x1/41x0/410x2/410248029/410248029.jpg
- 1####.####.195/pubres/picture/show_img/xxsj.png
- 7j####.####.com/tdata_gOY640
- boo####.####.cn/pubres/book/4x4/44x2/442x0/442095726/442095726.jpg
- boo####.####.cn/pubres/book/4x4/44x1/441x3/441359242/441359242.jpg
- 1####.####.195/pubres/picture/show_img/cyyq.png
- boo####.####.cn/pubres/book/4x4/44x2/442x2/442278214/442278214.jpg
- boo####.####.cn/pubres/book/4x1/41x3/413x2/413277049/413277049.jpg
- obf0c####.####.com/visenvt9_9_20160808104730.zip
- boo####.####.cn/pubres/picture/show_img/xxsj.png
- boo####.####.cn/pubres/book/3x9/39x7/397x3/397310853/397310853.jpg
- boo####.####.cn/pubres/book/4x5/45x2/452x9/452935561/452935561.jpg
- boo####.####.cn//pubres/picture/show_img/xisnhufree.jpg
- boo####.####.cn/pubres/book/8x0/80x0/800x2/800247562/800247562.jpg
- boo####.####.cn/pubres/picture/show_img/khyx.png
- boo####.####.cn/pubres/picture/show_img/rxjs.png
- boo####.####.cn/pubres/picture/LoadingPage/-144134384758218647.jpg
- 7j####.####.com/tdata_KtX382
- w####.####.com/sso/p/logindata.jsp?e_l=####&purl=####
- boo####.####.cn/pubres/book/3x8/38x5/385x7/385734239/385734239.jpg
- boo####.####.cn/pubres/picture/show_img/xhkj.png
- boo####.####.cn/pubres/book/6x0/60x1/601x0/601077621/601077621.jpg
- boo####.####.cn/pubres/book/3x8/38x6/386x9/386963400/386963400.jpg
- 1####.####.195/pubres/picture/show_img/rxjs.png
- boo####.####.cn/pubres/book/3x9/39x4/394x5/394529205/394529205.jpg
- 1####.####.195/pubres/picture/show_img/kbly.png
- boo####.####.cn/pubres/book/4x5/45x0/450x4/450408449/450408449.jpg
- boo####.####.cn/pubres/picture/show_img/cyyq.png
- boo####.####.cn/pubres/book/4x1/41x1/411x9/411989744/411989744.jpg
- w####.####.com/r/p/myspacedata.jsp?vt=####
- boo####.####.cn/pubres/picture/show_img/amds.png
- boo####.####.cn/pubres/book/4x5/45x0/450x0/450052384/450052384.jpg
- boo####.####.cn/pubres/book/4x4/44x8/448x0/448095312/448095312.jpg
- 1####.####.195/pubres/picture/show_img/khyx.png
- boo####.####.cn/pubres/book/3x5/35x6/356x6/356685285/356685285.jpg
- boo####.####.cn/pubres/picture/show_img/mfcd.png
- boo####.####.cn/pubres/picture/show_img/xisnhufree.jpg
- boo####.####.cn/pubres/book/4x4/44x0/440x1/440153427/440153427.jpg
- boo####.####.cn/pubres/book/4x5/45x1/451x5/451563494/451563494.jpg
- 1####.####.195/pubres/apk/K101040_dzRecharge_v1.4.06.13427.apk
- 1####.####.197:8080/pubres/downloadzipv1/3x7/37x4/374x5/374566328/3-3745...
- boo####.####.cn/pubres/book/3x5/35x3/353x4/353462882/353462882.jpg
- boo####.####.cn/pubres/book/6x0/60x0/600x3/600341890/600341890.jpg
- 1####.####.195/pubres/picture/show_img/xhkj.png
- boo####.####.cn/pubres/book/4x1/41x1/411x6/411656447/411656447.jpg
- boo####.####.cn/pubres/book/4x4/44x6/446x6/446679086/446679086.jpg
- 1####.####.195/pubres/picture/show_img/mfcd.png
- boo####.####.cn/pubres/book/4x4/44x9/449x0/449071253/449071253.jpg
- boo####.####.cn/pubres/picture/show_img/smlx.png
- boo####.####.cn//pubres/picture/show_img/banner720288.jpg
- boo####.####.cn/pubres/picture/show_img/720-288.jpg
- boo####.####.cn/pubres/picture/show_img/kbly.png
- boo####.####.cn//pubres/picture/show_img/720-288.jpg
- boo####.####.cn/pubres/book/4x4/44x2/442x3/442325378/442325378.jpg
- 1####.####.195/pubres/picture/show_img/smlx.png
- boo####.####.cn/pubres/book/4x5/45x3/453x1/453136127/453136127.jpg
- boo####.####.cn/pubres/book/3x5/35x9/359x1/359196184/359196184.jpg
- boo####.####.cn/pubres/book/4x1/41x3/413x4/413493528/413493528.jpg
- 1####.####.195/pubres/picture/show_img/amds.png
- boo####.####.cn/pubres/book/3x6/36x9/369x2/369281349/369281349.jpg
- boo####.####.cn/pubres/picture/show_img/banner720288.jpg
- w####.####.com/r/407146487/407146500.htm?cm=####&vt=####
Запросы HTTP POST:
- s####.####.com/api.php?format=####&t=####
- 1####.####.195/asg/portal.do
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/ishugui.shareInfo.xml.bak
- <Package Folder>/files/init.pid
- <Package Folder>/files/run.pid
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/shared_prefs/ishugui.shareInfo.xml
- <Package Folder>/databases/pushext.db-journal
- <Package Folder>/databases/intercept_pad.db-journal
- <Package Folder>/files/libprocmox_v1_3.so
- <Package Folder>/databases/ishugui.db-journal
- <Package Folder>/shared_prefs/Cookies<IMSI>.xml
- <Package Folder>/databases/tmpd8.db-journal
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/files/gdaemon_20151105
- <Package Folder>/shared_prefs/conf_sp_name.xml
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/pushg.db-journal
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/push.pid
- <Package Folder>/files/mobclick_agent_cached_<Package>30701
Другие:
Запускает следующие shell-скрипты:
- chmod 700 /data/data/####/files/gdaemon_20151105
- /data/data/####/files/libprocmox_v1_3.so /data/data/#### /data/app-lib/####-1 #### http://1####.####.195:80/asg/admin/callback/index.jsp?apiVersion=1.3.07.01&os=android18&screen=600x752&model=Generic+Android-x86&channelCode=K1
- /data/data/####/files/gdaemon_20151105 0 ####/com.igexin.sdk.PushService 24131 300 0
- sh <Package Folder>/files/libprocmox_v1_3.so <Package Folder> /data/app-lib/<Package>-1 <Package> http://1####.####.195:80/asg/admin/callback/index.jsp?apiVersion=1.3.07.01&os=android18&screen=600x752&model=Generic+<System Property>&channelCode=K101040&i
- chmod 700 <Package Folder>/files/gdaemon_20151105
- sh <Package Folder>/files/gdaemon_20151105 0 <Package>/com.igexin.sdk.PushService 24131 300 0
- <dexopt>
Может автоматически отправлять СМС-сообщения.
