Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.76.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.HiddenAds.76.origin
Сетевая активность:
Подключается к:
- 2####.####.214
- m####.####.com
- p####.####.com
- sbli####.com
- sbli####.com:3000
Запросы HTTP GET:
- 2####.####.214/mmgr.myapp.com/msoft/sec/secure/6/2/3/ku/NewKingrootV4.82...
- m####.####.com/msoft/sec/secure/6/2/3/ku/NewKingrootV4.82_C138_B250_offi...
- sbli####.com/apk/ckd1
- sbli####.com:3000/
Запросы HTTP POST:
- p####.####.com/
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_krsdk/Kinguser.apk
- <Package Folder>/app_krsdk/__krsdk.res__
- <Package Folder>/app_krsdk/chkmount
- <Package Folder>/app_krsdk/krsdk.cert
- <Package Folder>/app_krsdk/krsdk.res
- <Package Folder>/app_krsdk/ktools
- <Package Folder>/app_krsdk/reportroot
- <Package Folder>/app_krsdk/su2
- <Package Folder>/app_krsdk/su3
- <Package Folder>/app_krsdk/su_check
- <Package Folder>/app_krsdk/supolicy
- <Package Folder>/app_krsdk/yis_cfg.txt
- <Package Folder>/app_slog/actsts
- <Package Folder>/applib/ktools
- <Package Folder>/cache/####/-1054688343519785461
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/40372.dat
- <Package Folder>/files/####/8101.jar
- <Package Folder>/files/####/TimeSer.apk
- <Package Folder>/files/####/busybox
- <Package Folder>/files/####/clean.sh
- <Package Folder>/files/####/debuggerd
- <Package Folder>/files/####/install-recovery.sh
- <Package Folder>/files/####/install_recovery.sh
- <Package Folder>/files/####/kds
- <Package Folder>/files/####/krsdk.cert
- <Package Folder>/files/####/krsdk.res
- <Package Folder>/files/####/ktools
- <Package Folder>/files/####/ku-config
- <Package Folder>/files/####/rootpost.sh
- <Package Folder>/files/####/su
- <Package Folder>/files/####/sysser
- <Package Folder>/files/####/syssvr
- <Package Folder>/files/40372.dat
- <Package Folder>/files/8101.jar
- <Package Folder>/files/TimeSer.apk
- <Package Folder>/files/busybox
- <Package Folder>/files/ck.zip
- <Package Folder>/files/ckd1
- <Package Folder>/files/clean.sh
- <Package Folder>/files/debuggerd
- <Package Folder>/files/dk.jar
- <Package Folder>/files/ek.jar
- <Package Folder>/files/install-recovery.sh
- <Package Folder>/files/install_recovery.sh
- <Package Folder>/files/kds
- <Package Folder>/files/krsdk-b247106-stock-conf
- <Package Folder>/files/krsdk.cert
- <Package Folder>/files/krsdk.res
- <Package Folder>/files/ktools
- <Package Folder>/files/ku-config
- <Package Folder>/files/libkrsdk1.2.0.220.so
- <Package Folder>/files/rootpost.sh
- <Package Folder>/files/su
- <Package Folder>/files/sysser
- <Package Folder>/files/syssvr
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/SSPPrefe.xml
- <Package Folder>/shared_prefs/SSPPrefe.xml.bak
- <Package Folder>/shared_prefs/conf.xml.xml
- <Package Folder>/shared_prefs/kingrootsdk.xml
- <Package Folder>/shared_prefs/kingrootsdk_defense.xml
- <Package Folder>/shared_prefs/nuclear_setting.xml
- <Package Folder>/shared_prefs/system_device_id.xml
- <SD-Card>/Android/channel_id
- <SD-Card>/Android/system_device_id
- <SD-Card>/DCIM/channel_id
- <SD-Card>/DCIM/system_device_id
- <SD-Card>/krsdk-b247106-stock-conf
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- <dexopt>
- <error:2>
- chmod 0755 <Package Folder>/app_krsdk/ktools
- chmod 0755 <Package Folder>/applib/ktools
- chmod 0771 <Package Folder>/applib
- chmod 755 /data/data/com.mgyun.shua.su/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- getprop ro.board.platform
- getprop ro.build.description
- getprop ro.build.version.opporom
- getprop ro.cm.device
- getprop ro.cm.version
- getprop ro.hardware
- getprop ro.miui.ui.version.code
- getprop ro.mtk.hardware
- getprop ro.product.cpu.abi
- getprop ro.product.cpu.abi2
- ls -l /dev/kmem
- ls -lZ <Package Folder>/app_krsdk/
- ls /data/local/tmp
- netstat -n -W
- ps |grep sysser
- service list
- sh
- su -v
Использует специальную библиотеку для скрытия исполняемого байткода.
