Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 09223172360: dv#pr#sts#1496232154685#<IMEI>#null#0#100#0#1496232154023#1496232154323#0.0#s00000000000#s00000000000
- 09223172360: dv#pr#sts#1496232155350#<IMEI>#null#100#100#100#1496232154506#1496232154806#0.0#s00000000000#s00000000000
- 09223172360: dv#pr#sts#1496232155419#<IMEI>#null#100#100#0#1496232154625#1496232154925#0.0#s00000000000#s00000000000
- 09223172360: dv#pr#sts#1496232155701#<IMEI>#null#100#100#100#1496232155324#1496232155624#0.0#s00000000000#s00000000000
- 09223172360: dv#pr#sts#1496232155877#<IMEI>#null#100#100#110#1496232154653#1496232155442#0.0#s00000000000#s00000000000
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/code_cache/####/<Package>-1.apk.classes-353643974.zip
- <Package Folder>/code_cache/####/<Package>-1.apk.classes1653414428.zip
- <Package Folder>/databases/DBStalledLogger.db-journal
- <Package Folder>/databases/com.localytics.android.86ed8561843a682613515ab424bd98d76c847ffeb7506c198b14075a59ec35e5.analytics.sqlite-journal
- <Package Folder>/databases/com.localytics.android.86ed8561843a682613515ab424bd98d76c847ffeb7506c198b14075a59ec35e5.in-app.sqlite-journal
- <Package Folder>/databases/com.localytics.android.86ed8561843a682613515ab424bd98d76c847ffeb7506c198b14075a59ec35e5.profile.sqlite-journal
- <Package Folder>/databases/device_platform.db-journal
- <Package Folder>/databases/driver.db-journal
- <Package Folder>/databases/olaInbox.db-journal
- <Package Folder>/files/####/592EB0D903E7-0001-0834-641F5BE80DA2BeginSession.cls
- <Package Folder>/files/####/592EB0D903E7-0001-0834-641F5BE80DA2SessionApp.cls_temp
- <Package Folder>/files/####/592EB0D903E7-0001-0834-641F5BE80DA2SessionDevice.cls_temp
- <Package Folder>/files/####/592EB0D903E7-0001-0834-641F5BE80DA2SessionOS.cls_temp
- <Package Folder>/files/####/592EB0D903E7-0001-0834-641F5BE80DA2keys.meta
- <Package Folder>/files/####/com.crashlytics.settings.json
- <Package Folder>/files/####/initialization_marker
- <Package Folder>/files/####/sa_2cee4c64-2ee2-4a41-9a39-cba35db73360_1496232154217.tap
- <Package Folder>/files/####/sa_c1d736e9-e124-410a-8019-3baa19c3744d_1496232156498.tap
- <Package Folder>/files/####/session_analytics.tap
- <Package Folder>/files/####/session_analytics.tap.tmp
- <Package Folder>/files/nr_installation
- <Package Folder>/shared_prefs/BookingPreference.xml
- <Package Folder>/shared_prefs/NRAnalyticAttributeStore.xml
- <Package Folder>/shared_prefs/StateMachinePreference.xml
- <Package Folder>/shared_prefs/StateMachinePreference.xml.bak
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/shared_prefs/ack_events.xml
- <Package Folder>/shared_prefs/analytics_events.xml
- <Package Folder>/shared_prefs/billingPreference.xml
- <Package Folder>/shared_prefs/billingPreference.xml.bak
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answers;settings.xml
- <Package Folder>/shared_prefs/com.newrelic.android.agent.v1_<Package>.xml
- <Package Folder>/shared_prefs/com.newrelic.android.agent.v1_<Package>.xml.bak
- <Package Folder>/shared_prefs/data_usage.xml
- <Package Folder>/shared_prefs/data_usage.xml.bak
- <Package Folder>/shared_prefs/device_config_preference.xml
- <Package Folder>/shared_prefs/device_config_preference.xml.bak
- <Package Folder>/shared_prefs/inboxSharedPreference.xml
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.a.a.a.p.xml
- <Package Folder>/shared_prefs/loginVideoSharedPreference.xml
- <Package Folder>/shared_prefs/mqtt_config_preference.xml
- <Package Folder>/shared_prefs/mqtt_config_preference.xml.bak
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/network_config_preference.xml
- <Package Folder>/shared_prefs/network_config_preference.xml.bak
- <Package Folder>/shared_prefs/olaSharedPreference.xml
- <Package Folder>/shared_prefs/olaSharedPreference.xml.bak
- <Package Folder>/shared_prefs/optimus_config_preference.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- app_process /system/bin com.android.commands.pm.Pm list packages
- pm list packages
Может автоматически отправлять СМС-сообщения.
