Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Mixi.16.origin
Сетевая активность:
Подключается к:
- s####.####.com
- v####.####.com
- g####.####.com
- pi####.####.com
- 1####.####.225
- men####.####.com
Запросы HTTP GET:
- men####.####.com/service/appad/checkUpdate?appid=####&moblog=####
- men####.####.com/profile/profile?time=####&deviceid=####&model=####&manu...
- s####.####.com/cr/sdk/170417/goplaysdk_statistics_all_1704171.dat
- s####.####.com/cr/sdk/170417/des_V17041703Aj1so32.zip
- men####.####.com/feedback/checknews?deviceId=####&moblog=####
- v####.####.com/lottery/activity/config?deviceId=####&moblog=####
- men####.####.com/EvaluateService/config/sogouSdkJson
- men####.####.com/usercenter/navSummary/download?moblog=####
- men####.####.com/wzcx/mobile/activity/offlinepack?version=####&moblog=####
- men####.####.com/EvaluateService/iplist/json?moblog=####
- men####.####.com/trackchart/service/info?deviceId=####&moblog=####
- men####.####.com/EvaluateService/json?ver=####&uid=####&uvid=####&os=###...
- men####.####.com/EvaluateService/config/json
- v####.####.com/geometry/getLatestVersion/0/android-phone/sogoumap-phone/...
- v####.####.com/messagebox/box/version/json?deviceId=####&moblog=####
- g####.####.com/cr/sv/getRecord?eids=####&appKey=####&flag=####
- g####.####.com/cr/sv/getGoFile?name=####
- v####.####.com/style/getLatestVersion/0/android-phone/sogoumap-phone/shi...
- v####.####.com/geometry/data/0/android-phone/sogoumap-phone/shigh/0/0/05...
Запросы HTTP POST:
- g####.####.com/cr/sv/getEPList
- pi####.####.com/mstat/report/?index=####
- v####.####.com/style/special/0/android-phone/sogoumap-phone/shigh/0/1/0/...
- men####.####.com/location?v=####&uvid=####&d=####&p=####&
- men####.####.com/usercenter/device/bmsync/delete?deviceId=####&type=####...
- men####.####.com/CityPack/allcitypack?mapversion=####&moblog=####
- v####.####.com/pv.gif?uigs_productid=####&moblog=####
- men####.####.com/usercenter/workremind/setswitch?deviceId=####&remindTyp...
- 1####.####.225/dreport
Изменения в файловой системе:
Создает следующие файлы:
- /data/anr/traces.txt
- <Package Folder>/databases/com.sogou.map.mobile.android.history_result.db-journal
- <Package Folder>/databases/com.sogou.map.mobile.android.message_result.db
- <Package Folder>/shared_prefs/contilogin_pref.xml
- <Package Folder>/PreExcuModsInfo.txt
- <Package Folder>/files/etsb5wu2<System Property>4/5etsb5wu2<System Property>46
- <Package Folder>/ReadyHost.txt
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/.mta-wxop.xml.bak
- <Package Folder>/databases/line_favorite.db-journal
- <Package Folder>/files/u04J56qSh.jar
- <Package Folder>/files/<System Property>112.jar
- <Package Folder>/XmSmLockFile.txt
- <Package Folder>/code_cache/secondary-dexes/<Package>-1.apk.classes913979117.zip
- <Package Folder>/shared_prefs/SGLocSDK.xml
- <Package Folder>/shared_prefs/setting_pref.xml
- <Package Folder>/files/file_log.txt
- <Package Folder>/databases/wxop_tencent_analysis.db-journal
- <Package Folder>/databases/poi_favorite.db
- <Package Folder>/files/23<System Property>32/<Package>12x862
- <Package Folder>/shared_prefs/kv_pref.xml
- <Package Folder>/databases/line_favorite.db
- <Package Folder>/databases/pri_wxop_tencent_analysis.db-journal
- <Package Folder>/databases/com.sogou.map.mobile.android.message_result.db-journal
- <Package Folder>/databases/com.sogou.map.mobile.android.db
- <Package Folder>/shared_prefs/<Package>.push_service_setting.xml
- <Package Folder>/files/1495006132570_V17041703Aj1so32.so
- <Package Folder>/app_file_dex/MasterControl.jar
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/databases/poi_favorite.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/shared_prefs/Profiles.xml
- <Package Folder>/databases/com.sogou.map.mobile.android.history_result.db
- <Package Folder>/databases/com.sogou.map.mobile.android.db-journal
- <Package Folder>/shared_prefs/kv_pref.xml.bak
- <Package Folder>/files/us.k5FXnIog35Gd9iVJq5zMc6eE56Hq8
- <Package Folder>/shared_prefs/.mta-wxop.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/SM_FrameWork_Preference.xml
Другие:
Запускает следующие shell-скрипты:
- getenforce
- chmod 0771 <Package Folder>/.syslib-
- sh -c rm <Package Folder>/files/us.k5FXnIog35Gd9iVJq5zMc6eE56Hq8 > /dev/null 2>&1
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/u04J56qSh.jar > /dev/null 2>&1
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/us.k5FXnIog35Gd9iVJq5zMc6eE56Hq8 > /dev/null 2>&1
- sh -c rm -f <Package Folder>/files/u04J56qSh.dex > /dev/null 2>&1
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- rm -f <Package Folder>/files/u04J56qSh.dex
- chmod 0771 /data/data/####/.syslib-
- sh -c rm -f <Package Folder>/files/u04J56qSh.jar > /dev/null 2>&1
- rm -f <Package Folder>/files/u04J56qSh.jar
- /data/data/####/files/us.k5FXnIog35Gd9iVJq5zMc6eE56Hq8 -h c48756b39e9e402ca3e1026d88799eaa /data/data/####/.syslib-
- sh -c /system/usr/toolbox rm -f <Package Folder>/files/u04J56qSh.dex > /dev/null 2>&1
- sh -c rm <Package Folder>/files/u04J56qSh.dex > /dev/null 2>&1
- rm -f <Package Folder>/files/us.k5FXnIog35Gd9iVJq5zMc6eE56Hq8
- <error:2>
- sh <Package Folder>/files/us.k5FXnIog35Gd9iVJq5zMc6eE56Hq8 -h c48756b39e9e402ca3e1026d88799eaa <Package Folder>/.syslib-
- rm <Package Folder>/files/u04J56qSh.dex
- rm <Package Folder>/files/us.k5FXnIog35Gd9iVJq5zMc6eE56Hq8
- sh -c rm <Package Folder>/files/u04J56qSh.jar > /dev/null 2>&1
- rm <Package Folder>/files/u04J56qSh.jar
- sh -c rm -f <Package Folder>/files/us.k5FXnIog35Gd9iVJq5zMc6eE56Hq8 > /dev/null 2>&1
- <dexopt>
Может автоматически отправлять СМС-сообщения.
