Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- 2####.####.31
- d####.####.cn
- mon####.####.com
- pmi####.####.com
- r####.####.cn
Запросы HTTP GET:
- 2####.####.31/d.xiongjiong.com.cn/jarFile/SDKAutoUpdate/wet4.jar?wsiphos...
- d####.####.cn/jarFile/SDKAutoUpdate/wet4.jar
Запросы HTTP POST:
- mon####.####.com/analytics/rqdsync
- pmi####.####.com/
- r####.####.cn/k1?requestId=####&g=####&ua=####
Изменения в файловой системе:
Создает следующие файлы:
- /system/etc/install-recovery.sh
- /system/usr/####/ikmsu
- /system/usr/attrch
- <Package Folder>/app_permission/ipme_2x
- <Package Folder>/app_permission/solo_km.10
- <Package Folder>/applib/attrch
- <Package Folder>/applib/busybox
- <Package Folder>/applib/kd
- <Package Folder>/applib/kd.tmp
- <Package Folder>/applib/libNativeRQD.so
- <Package Folder>/applib/libxy.so
- <Package Folder>/applib/p_monitor2_x
- <Package Folder>/applib/supolicy
- <Package Folder>/applib/tools
- <Package Folder>/cache/MLFiletr.conf
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/eup_db
- <Package Folder>/databases/eup_db-journal
- <Package Folder>/databases/perform.db
- <Package Folder>/databases/perform.db-journal
- <Package Folder>/databases/pure_log.db
- <Package Folder>/databases/pure_log.db-journal
- <Package Folder>/databases/ss.db
- <Package Folder>/databases/ss.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/data
- <Package Folder>/files/21_wod.jar
- <Package Folder>/files/40263.dat
- <Package Folder>/files/40264.dat
- <Package Folder>/files/40270.dat
- <Package Folder>/files/SuTimeCtrl.dat
- <Package Folder>/files/e_config
- <Package Folder>/files/firewall-2.0.2.dat
- <Package Folder>/files/k_ul
- <Package Folder>/files/kulibs.conf
- <Package Folder>/files/sc01
- <Package Folder>/files/sh.tmp
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/a.xml.bak
- <Package Folder>/shared_prefs/accessSDKProperties.xml
- <Package Folder>/shared_prefs/accessSDKProperties.xml.bak
- <Package Folder>/shared_prefs/accessSDKProperties.xml.bak (deleted)
- <Package Folder>/shared_prefs/actionStats.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml
- <Package Folder>/shared_prefs/appsflyer-data.xml.bak
- <Package Folder>/shared_prefs/appsflyer-data.xml.bak (deleted)
- <Package Folder>/shared_prefs/common_setting.xml
- <Package Folder>/shared_prefs/engine_config.xml
- <Package Folder>/shared_prefs/engine_config.xml.bak
- <Package Folder>/shared_prefs/first_enable_script.xml
- <Package Folder>/shared_prefs/fk_applyRoot.xml
- <Package Folder>/shared_prefs/fk_applyRootByOther.xml
- <Package Folder>/shared_prefs/fk_reportRoot.xml
- <Package Folder>/shared_prefs/km.conf.xml
- <Package Folder>/shared_prefs/km_access_setting.xml
- <Package Folder>/shared_prefs/km_setting.xml
- <Package Folder>/shared_prefs/km_su.xml
- <Package Folder>/shared_prefs/km_update_setting.xml
- <Package Folder>/shared_prefs/mulDataStats.xml
- <Package Folder>/shared_prefs/pmDataStats.xml
- <Package Folder>/shared_prefs/pmSmsDataStats.xml
- <Package Folder>/shared_prefs/pr02.xml
- <Package Folder>/shared_prefs/pure_state.xml
- <Package Folder>/shared_prefs/setting_fast_report.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/stringDataStats.xml
- <Package Folder>/shared_prefs/stringDataStatsNew.xml
- <Package Folder>/shared_prefs/switchStats.xml
- <Package Folder>/shared_prefs/switchStats.xml.bak
- <Package Folder>/shared_prefs/tombstone.xml
- <SD-Card>/Download/####/4.8_wet4.jar.tmp
- <SD-Card>/dt/restime.dat
- <SD-Card>/e_config
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.dianling.youhua.dashisssaaogewxtsgnt/applib/kd
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/sh -c getprop ro.board.platform
- <dexopt>
- <su-internal:request>
- <su-internal:result>
- chcon u:object_r:system_file:s0 /system/etc/install-recovery.sh
- chcon u:object_r:system_file:s0 /system/usr/attrch
- chmod 0755 /system/etc/install-recovery.sh
- chmod 0755 /system/usr/attrch
- chmod 0755 /system/usr/ikm
- chmod 0755 <Package Folder>/applib/kd
- chmod 0755 <Package Folder>/applib/p_monitor2_x
- chmod 0755 <Package Folder>/files/21_wod.jar
- chmod 0764 <Package Folder>/applib/attrch
- chmod 0764 <Package Folder>/applib/busybox
- chmod 0764 <Package Folder>/applib/libNativeRQD.so
- chmod 0764 <Package Folder>/applib/libxy.so
- chmod 0764 <Package Folder>/applib/supolicy
- chmod 0764 <Package Folder>/applib/tools
- chmod 0771 <Package Folder>/applib
- chmod 6755 /system/usr/ikm/ikmsu
- chmod 755 /dev/p_monitor2_x
- chmod 755 <Package Folder>/app_permission/ipme_2x
- chmod 755 <Package Folder>/app_permission/solo_km.10
- chmod 755 <Package Folder>/files/k_ul
- chown 0.0 /system/etc/install-recovery.sh
- chown 0.0 /system/usr/attrch
- daemonsu
- dumpsys activity -a provider com.kingroot.common.framework.task.provider.KTaskProvider
- getprop ro.board.platform
- id
- ku.sud
- mkdir /system/usr/ikm
- mount -o remount -rw /system
- mount -o ro,remount /system /system
- ps
- ps k_ul
- rm /dev/p_monitor2_x
- rm /system/usr/attrch
- rm /system/usr/ikm/ikmsu
- rm <Package Folder>/files/sh.tmp
- service list
- sh
- sh <Package Folder>/applib/kd
- su
- su -v
Использует повышенные привилегии.
