Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 106584211: 5fd3bec6c0a86a507081142202507826M302000A免费登录短信，请勿修改
Сетевая активность:
Подключается к:
- 1####.####.195
- 7x####.####.com
- a####.####.com
- boo####.####.cn
- i####.####.cn
- obf0c####.####.com
- s####.####.com
- w####.####.com
Запросы HTTP GET:
- 7x####.####.com/zip/payjar_-1_20170628221644.zip
- boo####.####.cn/pubres/book/4x1/41x0/410x5/410537826/410537826.jpg
- i####.####.cn/iplookup/iplookup.php?format=####&aaa_flag=####
- obf0c####.####.com/visenvt9_9_20160808104730.zip
- w####.####.com/r/p/myspacedata.jsp?vt=####&aaa_flag=####
Запросы HTTP POST:
- 1####.####.195/asg/portal.do
- a####.####.com/app_logs
- s####.####.com/api.php?format=####&t=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/databases/intercept_pad.db-journal
- <Package Folder>/databases/ishugui.db-journal
- <Package Folder>/databases/pushext.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/databases/tmpd8.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/.imprint
- <Package Folder>/files/gdaemon_20151105
- <Package Folder>/files/init.pid
- <Package Folder>/files/mobclick_agent_cached_<Package>1010318
- <Package Folder>/files/push.pid
- <Package Folder>/files/run.pid
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/Cookies<IMSI>.xml
- <Package Folder>/shared_prefs/conf_sp_name.xml
- <Package Folder>/shared_prefs/ishugui.shareInfo.xml
- <Package Folder>/shared_prefs/ishugui.shareInfo.xml.bak
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak (deleted)
- <SD-Card>/.ishugui/####/1de8wqmhjef2zdef07sw30wu8
- <SD-Card>/.ishugui/####/23ntv30wfs88s6twx2igxjm3w
- <SD-Card>/.ishugui/####/2pelusgug1ryd8j2c79vysn7x
- <SD-Card>/.ishugui/####/35sqqz6orxc4v73vnpr284k5e
- <SD-Card>/.ishugui/####/392554583.kf
- <SD-Card>/.ishugui/####/392554584.kf
- <SD-Card>/.ishugui/####/3y21a51cxguv2yecb29847gqr
- <SD-Card>/.ishugui/####/5106w2aoc421dd93kr7hxxys6
- <SD-Card>/.ishugui/####/51tgbsb0nrb7357koefmam9nu
- <SD-Card>/.ishugui/####/590iyu9t17qjxgt49ohfurpj0
- <SD-Card>/.ishugui/####/5r6qq7yyxk81kl2s1euhp954y
- <SD-Card>/.ishugui/####/6eluypdc5naar1a9jfzfodi33
- <SD-Card>/.ishugui/####/6grmj9oeybaa9jrpn0kfpjkd2
- <SD-Card>/.ishugui/####/6l6zk0vzmonnfqfmajvtitzq4
- <SD-Card>/.ishugui/####/6wabuf737pcp0k60mx895sbw2
- <SD-Card>/.ishugui/####/bfi8ct6pv1byrfuj2oezw37f
- <SD-Card>/.ishugui/####/bookinfo.bat
- <SD-Card>/.ishugui/####/dzbook-ak392554581_log.txt
- <SD-Card>/.ishugui/####/html.css
- <SD-Card>/.ishugui/####/html.js
- <SD-Card>/.ishugui/####/html.txt
- <SD-Card>/.ishugui/empty.system
- <SD-Card>/.ishugui/payerr.txt
- <SD-Card>/.system/####/paydex.dzlib.temp
- <SD-Card>/.system/####/visen.conf
- <SD-Card>/.system/####/visen.conf.mark
- <SD-Card>/.system/####/visen.conf.temp
- <SD-Card>/libs/<Package>.db
- <SD-Card>/libs/app.db
- <SD-Card>/libs/com.getui.sdk.deviceId.db
- <SD-Card>/libs/com.igexin.sdk.deviceId.db
- <SD-Card>/system/####/tdata_KtX382
- <SD-Card>/system/####/tdata_KtX382.jar
- <SD-Card>/system/####/tdata_KtX382.tmp
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.dzbook.ak392554581/files/gdaemon_20151105 0 com.dzbook.ak392554581/com.igexin.sdk.PushService 24738 300 0
- <dexopt>
- chmod 700 /data/data/com.dzbook.ak392554581/files/gdaemon_20151105
- chmod 700 <Package Folder>/files/gdaemon_20151105
- sh <Package Folder>/files/gdaemon_20151105 0 <Package>/com.igexin.sdk.PushService 24738 300 0
