Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 155933424821: 京东平板节来袭！全场12期免息
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- l####.####.com
Запросы HTTP POST:
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- /system/app/service.apk
- /system/lib/liblocSDK6a.so
- /system/lib/libnativeLoad.so
- <Package Folder>/files/####/133A0D8
- <Package Folder>/files/####/133A0D9
- <Package Folder>/files/####/1496212849171
- <Package Folder>/files/####/1496212849279
- <Package Folder>/files/####/1496212849289
- <Package Folder>/files/####/1496212849481
- <Package Folder>/files/####/1496212904007
- <Package Folder>/files/####/1496212906805
- <Package Folder>/files/####/1496212909478
- <Package Folder>/files/####/dcim.cfg
- <Package Folder>/files/####/firll.dat
- <Package Folder>/files/####/kb1496222371
- <Package Folder>/files/####/kb1496495977
- <Package Folder>/files/####/kb1496497354
- <Package Folder>/files/####/kb1496544647
- <Package Folder>/files/####/kb1496587471
- <Package Folder>/files/####/kb1496692648
- <Package Folder>/files/####/kb1496693282
- <Package Folder>/files/####/kb1496699618
- <Package Folder>/files/####/kb1497019469
- <Package Folder>/files/####/ofl.config
- <Package Folder>/files/####/ofl_location.db
- <Package Folder>/files/####/ofl_location.db-journal
- <Package Folder>/files/####/ofl_statistics.db
- <Package Folder>/files/####/ofl_statistics.db-journal
- <Package Folder>/files/0.cfg
- <Package Folder>/files/1.cfg
- <Package Folder>/files/2.cfg
- <Package Folder>/files/3.cfg
- <Package Folder>/files/4.cfg
- <Package Folder>/files/5.cfg
- <Package Folder>/files/6.cfg
- <Package Folder>/files/8.cfg
- <Package Folder>/files/9.cfg
- <Package Folder>/files/dtl.dat
- <Package Folder>/files/kworker
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/mark0
- <Package Folder>/files/mark100
- <Package Folder>/files/mark300
- <Package Folder>/files/ptg
- <Package Folder>/files/pwa
- <Package Folder>/files/qmi
- <Package Folder>/files/status
- <Package Folder>/files/sync
- <Package Folder>/filestestvoice
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/baidu/####/conlts.dat
- <SD-Card>/baidu/####/ller.dat
- <SD-Card>/baidu/####/ls.db
- <SD-Card>/baidu/####/ls.db-journal
- <SD-Card>/baidu/####/yoh.dat
- <SD-Card>/baidu/####/yol.dat
- <SD-Card>/baidu/####/yom.dat
- <SD-Card>/test.0
Другие:
Запускает следующие shell-скрипты:
- <su-internal:request>
- <su-internal:result>
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/.PowerDetectService
- chmod 644 /system/app/service.apk
- chmod 644 /system/lib/liblocSDK6a.so
- chmod 644 /system/lib/libnativeLoad.so
- chmod 6777 <Package Folder>/files/kworker
- chmod 6777 <Package Folder>/files/nmea
- chmod 6777 <Package Folder>/files/ptg
- chmod 6777 <Package Folder>/files/pwa
- chmod 6777 <Package Folder>/files/qmi
- chmod 6777 <Package Folder>/files/sms
- chmod 6777 <Package Folder>/files/status
- chmod 6777 <Package Folder>/files/sync
- chown 0:0 /system/app/service.apk
- chown 0:0 /system/lib/liblocSDK6a.so
- chown 0:0 /system/lib/libnativeLoad.so
- chown 0:0 <Package Folder>/files/kworker
- chown 0:0 <Package Folder>/files/nmea
- chown 0:0 <Package Folder>/files/ptg
- chown 0:0 <Package Folder>/files/pwa
- chown 0:0 <Package Folder>/files/qmi
- chown 0:0 <Package Folder>/files/sms
- chown 0:0 <Package Folder>/files/status
- chown 0:0 <Package Folder>/files/sync
- getprop
- grep gsm.sim.state
- id
- mount
- mount -o remount,rw /dev/block/sda1 /system
- sh
- sh -c <Package Folder>/files/kworker <Package Folder>
- sh -c <Package Folder>/files/ptg <Package Folder>
- sh -c <Package Folder>/files/pwa <Package Folder>
- sh -c <Package Folder>/files/qmi <Package Folder>
- sh -c <Package Folder>/files/status <Package Folder>
- sh -c <Package Folder>/files/sync <Package Folder>
- sh -c am startservice --user 0 -n com.sec.android.system/.PowerDetectService
- sh -c chmod 6777 <Package Folder>/files/kworker
- sh -c chmod 6777 <Package Folder>/files/nmea
- sh -c chmod 6777 <Package Folder>/files/ptg
- sh -c chmod 6777 <Package Folder>/files/pwa
- sh -c chmod 6777 <Package Folder>/files/qmi
- sh -c chmod 6777 <Package Folder>/files/sms
- sh -c chmod 6777 <Package Folder>/files/status
- sh -c chmod 6777 <Package Folder>/files/sync
- sh -c chown 0:0 <Package Folder>/files/kworker
- sh -c chown 0:0 <Package Folder>/files/nmea
- sh -c chown 0:0 <Package Folder>/files/ptg
- sh -c chown 0:0 <Package Folder>/files/pwa
- sh -c chown 0:0 <Package Folder>/files/qmi
- sh -c chown 0:0 <Package Folder>/files/sms
- sh -c chown 0:0 <Package Folder>/files/status
- sh -c chown 0:0 <Package Folder>/files/sync
- sh -c getprop | grep gsm.sim.state
- su
- su -c <Package Folder>/files/ptg <Package Folder>
- su -c <Package Folder>/files/pwa <Package Folder>
- su -c <Package Folder>/files/qmi <Package Folder>
- su -c <Package Folder>/files/status <Package Folder>
- su -c <Package Folder>/files/sync <Package Folder>
- su -c chown 0:0 <Package Folder>/files/kworker
- su -c chown 0:0 <Package Folder>/files/nmea
- su -c chown 0:0 <Package Folder>/files/ptg
- su -c chown 0:0 <Package Folder>/files/pwa
- su -c chown 0:0 <Package Folder>/files/qmi
- su -c chown 0:0 <Package Folder>/files/sms
- su -c chown 0:0 <Package Folder>/files/status
- su -c chown 0:0 <Package Folder>/files/sync
- su -c mount -o remount,rw /dev/block/sda1 /system
Использует повышенные привилегии.
Использует права администратора.
Может автоматически отправлять СМС-сообщения.
