Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.456.origin
Сетевая активность:
Подключается к:
- s####.####.cn
- ad####.####.cn
- k####.####.cn
- 1####.####.148:18080
- pi####.####.com
Запросы HTTP GET:
- ad####.####.cn/zip/WapPayLib_tg_v1.0.0.0.zip
Запросы HTTP POST:
- pi####.####.com/mstat/report/?index=####
- 1####.####.148:18080/dataEngine/api/querySmsFeeChannel
- k####.####.cn/D470F30AAB5F4EACADE0DFD5004BB705
- s####.####.cn/v2/report
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/files/mobclick_agent_cached_<Package>53
- <Package Folder>/databases/all_games.db
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/databases/sh.db-journal
- <Package Folder>/databases/jpush_local_notification.db-journal
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/files/jpush_stat_cache_history.json
- <Package Folder>/databases/uc_market_new.db-journal
- <Package Folder>/files/android_shell.jar
- <Package Folder>/shared_prefs/admainlib.xml
- <Package Folder>/shared_prefs/jpush_device_info.xml
- <Package Folder>/shared_prefs/JPushSA_Config.xml.bak
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml.bak
- <Package Folder>/databases/jpush_statistics.db-journal
- <Package Folder>/databases/dkgames.db-journal
- <Package Folder>/files/F_1496215269236_546515938.zip
- <Package Folder>/shared_prefs/Mawap.xml
- <Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml.bak
- <Package Folder>/databases/pri_tencent_analysis.db-journal
- <Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml
- <Package Folder>/shared_prefs/JPushSA_Config.xml
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml
- <Package Folder>/databases/cc/cc.db-journal
- <Package Folder>/databases/games.db-journal
- <Package Folder>/shared_prefs/rapitplaysp.xml
- <Package Folder>/databases/jpush_statistics.db
- <Package Folder>/shared_prefs/share.xml
- <Package Folder>/shared_prefs/inslib.xml
- <Package Folder>/databases/data.db
- <Package Folder>/files/jpush_stat_cache.json
- <Package Folder>/databases/data.db-journal
- <Package Folder>/databases/uc_market_new.db
- <Package Folder>/shared_prefs/common_shell34.xml
- <Package Folder>/files/libandroid_shell.so
- <Package Folder>/databases/cc/cc.db
- <Package Folder>/files/F_1496215269625_546634110.zip
- <Package Folder>/shared_prefs/myupdate.xml
- <Package Folder>/databases/sh.db
- <Package Folder>/databases/tencent_analysis.db-journal
- <Package Folder>/databases/jpush_local_notification.db
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/databases/dkgames.db
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
Может автоматически отправлять СМС-сообщения.
