Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 10690691036592: c6fcbae8-6ca8-4fc8-9ee4-fc82efda51c3-1496217916695,点击发送直接注册
- 10690691036592: e4a50b7d-528f-4309-bd65-f38427e8614e-1496217966983,点击发送直接注册
Сетевая активность:
Подключается к:
- c####.####.com
- htt####.####.com
- i####.####.com:8000
- l####.####.com
- nsc####.####.com
- pass####.####.com
- t####.####.com
- wap####.####.com
Запросы HTTP GET:
- htt####.####.com/ips/v1?_client_type=####&_client_version=####&_phone_im...
- i####.####.com:8000/
- nsc####.####.com/v.gif?pid=####&pj=####&c_version=####&t=####&c_device_t...
- pass####.####.com/wp/api/security/antireplaytoken?tpl=####&v=####&callba...
- t####.####.com/tb/client/logsync3.js?t=####
- wap####.####.com/static/appsapi/conf/config.txt?tpl=####&app_version=###...
Запросы HTTP POST:
- c####.####.com/c/s/pluginsmisconf
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_plugins/####/libbd_wsp_v1_0.so
- <Package Folder>/app_plugins/####/libentryex.so
- <Package Folder>/app_plugins/####/libgoogle_breakpad.so
- <Package Folder>/app_plugins/####/liblive_sdk.so
- <Package Folder>/app_plugins/####/libmtprocessor-jni.so
- <Package Folder>/app_plugins/####/libopengljni.so
- <Package Folder>/app_plugins/####/libssohash.so
- <Package Folder>/app_plugins/1496217913940
- <Package Folder>/app_plugins/1496217914025
- <Package Folder>/app_plugins/1496217914571
- <Package Folder>/app_plugins/1496217915041
- <Package Folder>/app_plugins/1496217915413
- <Package Folder>/app_plugins/1496217915725
- <Package Folder>/app_plugins/1496217915854
- <Package Folder>/app_plugins/plugin_settings
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/baidu_adp.db-journal
- <Package Folder>/databases/baidu_tieba.db-journal
- <Package Folder>/databases/trafficstats.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/firll.dat
- <Package Folder>/files/####/offinfo.dat
- <Package Folder>/files/####/stat44F94582Writing.log
- <Package Folder>/files/####/switchsConfig
- <Package Folder>/files/wappass.baidu.com-passport-login.html
- <Package Folder>/shared_prefs/adp_feature_switch.xml
- <Package Folder>/shared_prefs/common_settings.xml
- <Package Folder>/shared_prefs/plugin_config.xml
- <Package Folder>/shared_prefs/plugininstaller_settings.xml
- <Package Folder>/shared_prefs/plugininstaller_settings.xml.bak
- <Package Folder>/shared_prefs/remote_settings.xml
- <Package Folder>/shared_prefs/sapi_system.xml
- <Package Folder>/shared_prefs/sapi_system.xml.bak
- <Package Folder>/shared_prefs/settings.xml
- <Package Folder>/shared_prefs/settings.xml.bak
- <SD-Card>/.BD_SAPI_CACHE/####/login.html
- <SD-Card>/baidu/####/conlts.dat
- <SD-Card>/baidu/####/ls.db
- <SD-Card>/baidu/####/ls.db-journal
- <SD-Card>/baidu/####/yoh.dat
- <SD-Card>/baidu/####/yol.dat
- <SD-Card>/baidu/####/yom.dat
- <SD-Card>/baidu/.cuid
- <SD-Card>/tieba/####/dbg44F94582Writing.log
- <SD-Card>/tieba/####/dbgB3650527Writing.log
- <SD-Card>/tieba/####/err44F94582Writing.log
- <SD-Card>/tieba/####/errB3650527Writing.log
- <SD-Card>/tieba/from.dat
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- getprop net.dns1
- getprop net.dns2
- getprop ro.miui.ui.version.name
Может автоматически отправлять СМС-сообщения.
