Android.SmsSend.20237

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

13810765357: iyd ajh 198086913

Сетевая активность:

Подключается к:

f####.####.com
l####.####.cn
s####.####.cn

Запросы HTTP GET:

f####.####.com/M00/02/50/dzkV7FHKZ17obeDaAAAV6MhaNbU484/hyzjt.png
f####.####.com/M00/5E/EC/dzkV61HKZ16ItGWiAABCEgMxWvk380/hywwz.png
l####.####.cn/t?r=####&p=####
s####.####.cn/mobile/webview/ifontRank?version=####&user=####&apn=####&c...

Изменения в файловой системе:

Создает следующие файлы:

/system/fonts/DroidSansFallback_bk.ttf
<Package Folder>/.snail/####/2de3c7d1-0776-477a-8880-cc1cc9d41e2b.a
<Package Folder>/.snail/####/apk_install_sc_db-journal
<Package Folder>/.snail/####/apk_install_tip.db-journal
<Package Folder>/.snail/####/app_stats.db-journal
<Package Folder>/.snail/####/app_track.db-journal
<Package Folder>/.snail/####/common_cfg.prefs
<Package Folder>/.snail/####/common_rundata.prefs
<Package Folder>/.snail/####/download.db-journal
<Package Folder>/.snail/####/exception
<Package Folder>/.snail/####/ext4-snail-5
<Package Folder>/.snail/####/libsnail_a4_b2_zip.so
<Package Folder>/.snail/####/log_cfg.prefs
<Package Folder>/.snail/####/log_index.db-journal
<Package Folder>/.snail/####/log_temp.db-journal
<Package Folder>/.snail/####/main.prefs
<Package Folder>/.snail/####/phone_dataer.prop
<Package Folder>/.snail/####/run_status.prefs
<Package Folder>/.snail/####/run_status_hb_request.gz
<Package Folder>/.snail/####/run_status_hb_response.gz
<Package Folder>/.snail/####/server_req_hb_response.gz
<Package Folder>/.snail/####/statistics.db-journal
<Package Folder>/.snail/####/win_ad.db-journal
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/index
<Package Folder>/databases/font.db
<Package Folder>/databases/font.db-journal
<Package Folder>/databases/iydDulMgr.db
<Package Folder>/databases/iydDulMgr.db-journal
<Package Folder>/databases/iydnet
<Package Folder>/databases/iydnet-journal
<Package Folder>/databases/iydpay
<Package Folder>/databases/iydpay-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/.a4.b2.zip
<Package Folder>/shared_prefs/UserManager.xml
<Package Folder>/shared_prefs/UserManager.xml.bak
<Package Folder>/shared_prefs/config.xml
<Package Folder>/shared_prefs/installID.xml
<Package Folder>/shared_prefs/iydsys.xml
<Package Folder>/shared_prefs/iydsys.xml.bak
<Package Folder>/shared_prefs/loader_snail.xml
<SD-Card>/.iydsys/####/setting.xml
<SD-Card>/.system/####/phone_dataer.prop

Другие:

Запускает следующие shell-скрипты:

/data/data/com.hsdw.dh.o/.snail/files/ext4-snail-5
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<dexopt>
<su-internal:request>
<su-internal:result>
chmod 644 /system/fonts/DroidSansFallback.ttf
chmod 755 /system/fonts/DroidSansFallback_bk.ttf
cp -f /system/fonts/DroidSansFallback.ttf /system/fonts/DroidSansFallback_bk.ttf
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
mount -t yaffs2 -o remount,rw /dev/block/mtdblock3 /system
sh
sh <Package Folder>/.snail/files/ext4-snail-5
su