Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 12114: 苏州易N支付#<IMEI>#<IMSI>
Сетевая активность:
Подключается к:
- 5####.####.com
- pin####.####.com
- s####.####.cn
- 1####.####.230
- pi####.####.com
Запросы HTTP GET:
- pin####.####.com/
- 5####.####.com/sdkplugin/smssdk_v17.txt
- pin####.####.com/?s=####&k=####
Запросы HTTP POST:
- s####.####.cn/cn/reportErrorLog.do
- pi####.####.com/mstat/report/?index=####
- 1####.####.230/sdk/cn/rcmdapp.do
- s####.####.cn/cn/smsSdk.do
- 1####.####.230/sdk/wpay/phonebill/tool.do
- pin####.####.com/?s=####&k=####
- s####.####.cn/cn/payments.do
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/bx-sdk-libs/ui/loading5.png
- <Package Folder>/files/bx-sdk-libs/ui/logo.gif
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/files/bx-sdk-libs/ui/loading1.png
- <Package Folder>/files/bx-sdk-libs/ui/yes.gif
- <Package Folder>/shared_prefs/util_preference.xml
- <Package Folder>/databases/tencent_analysis.db
- <Package Folder>/files/bx-sdk-libs/smssdk/17.apk
- <Package Folder>/files/bx-sdk-libs/ui/loading11.png
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/wpay-plugin.xml
- <Package Folder>/files/bx-sdk-libs/ui/loading7.png
- <Package Folder>/files/bx-sdk-libs/ui/loading2.png
- <Package Folder>/files/bx-sdk-libs/ui/loading3.png
- <Package Folder>/files/bx-sdk-libs/ui/loading8.png
- <Package Folder>/shared_prefs/wiipay.xml
- <Package Folder>/shared_prefs/wiipay.xml.bak
- <Package Folder>/files/bx-sdk-libs/ui/loading4.png
- <Package Folder>/databases/pri_tencent_analysis.db-journal
- <Package Folder>/files/libwpay-core.so
- <Package Folder>/shared_prefs/plugin.xml
- <Package Folder>/databases/lepeng.db-journal
- <Package Folder>/files/bx-sdk-libs/ui/loading9.png
- <Package Folder>/files/bx-sdk-libs/ui/loading12.png
- <Package Folder>/files/bx-sdk-libs/ui/transparent_back.png
- <Package Folder>/files/bx-sdk-libs/201/65.apk
- <Package Folder>/files/bx-sdk-libs/ui/loading6.png
- <Package Folder>/files/bx-sdk-libs/ui/error.gif
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/files/bx-sdk-libs/ui/loading10.png
- <Package Folder>/databases/tencent_analysis.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/dif_xiaoshui.xml
Другие:
Запускает следующие shell-скрипты:
- logcat -d -s INFO
- <dexopt>
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
Может автоматически отправлять СМС-сообщения.
