Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 10690700356: UPSMS#EtbLB0pCwKCuRLxCJBXXed0slIoeQUVgPzGMetW8jTX/+vWDrB/75xPpNR6TeRHA
Сетевая активность:
Подключается к:
- 2####.####.213
- m####.####.com
- m####.####.com:8080
- mon####.####.com
- o####.####.com
- o####.####.com:8080
- p####.####.com
- r####.####.com
- t####.####.com
- z####.####.com
Запросы HTTP GET:
- 2####.####.213/mmgr.myapp.com/myapp/gjbig/packmanage/1/1/xinxi.png?mkey=...
- m####.####.com/gjsmall/dpsw/cdn/61653f5037b10ff895ffa53581e24dde.jpg
- m####.####.com/myapp/gjbig/packmanage/1/1/xinxi.png
- r####.####.com/circle/real/8f7a4832e6c6480d9b0457eb3f8455d2-321978.jpg
- t####.####.com/wifi/cw.html
- z####.####.com/zxpic_imtt/abstractimage/2017/07/15/0040/004536_190189075...
Запросы HTTP POST:
- m####.####.com/
- m####.####.com/analytics/upload?rid=####&sid=####
- m####.####.com:8080/analytics/upload?rid=####&sid=####
- m####.####.com:8080/analytics/upload?sid=####
- mon####.####.com/analytics/rqdsync
- o####.####.com/analytics/upload?sid=####
- o####.####.com:8080/analytics/upload
- p####.####.com/
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/077f1cef4bb018c35dd0bd5ea24bb546.0
- <Package Folder>/cache/####/348db1028509e7fd452e3f956d97e04c.0
- <Package Folder>/cache/####/35f65d3e08638c29e7a6d66a7574ecbc.0
- <Package Folder>/cache/####/3a6e01f2bf073c80da6352dab054ccea.0
- <Package Folder>/cache/####/5801cac57bb0181d61bd74be749b0612.0
- <Package Folder>/cache/####/757a8d9fe2193f878579d8c56cf52b46.0
- <Package Folder>/cache/####/88423e5de30ea9d8da22c423a68dad08.0
- <Package Folder>/cache/####/c0a3c7c876cc12403a2a4b858b8838bd.0
- <Package Folder>/cache/####/e60a146a45377ac30b42d3bcfc24d510.0
- <Package Folder>/cache/####/journal
- <Package Folder>/databases/Discovery_DB-journal
- <Package Folder>/databases/beacon_db-journal
- <Package Folder>/databases/eup_db
- <Package Folder>/databases/eup_db-journal
- <Package Folder>/databases/fea_tunnel.db-journal
- <Package Folder>/databases/meriExt.db-journal
- <Package Folder>/databases/pi_config.db-journal
- <Package Folder>/databases/qqsecure.db
- <Package Folder>/databases/qqsecure.db-journal
- <Package Folder>/files/####/map_contact_id_
- <Package Folder>/files/30001000.dat
- <Package Folder>/files/40463.dat
- <Package Folder>/files/Beacon_sig_1.lock
- <Package Folder>/files/athena_v4.dat
- <Package Folder>/files/j_dd_fl.dat
- <Package Folder>/files/mrdg.dat
- <Package Folder>/files/wifidm
- <Package Folder>/files/x_rb_j_al_ct_2.dat
- <Package Folder>/files/x_rp_dt_j.dat
- <Package Folder>/shared_prefs/183.xml
- <Package Folder>/shared_prefs/183.xml.bak
- <Package Folder>/shared_prefs/267.xml
- <Package Folder>/shared_prefs/ConfigInfo.xml
- <Package Folder>/shared_prefs/ConfigInfo.xml.bak
- <Package Folder>/shared_prefs/DENGTA_META.xml
- <Package Folder>/shared_prefs/DENGTA_META.xml.bak
- <Package Folder>/shared_prefs/Discovery_Sp_0.xml
- <Package Folder>/shared_prefs/Discovery_Sp_0.xml.bak
- <Package Folder>/shared_prefs/DualSimConfigInfo.xml
- <Package Folder>/shared_prefs/DualSimConfigInfo.xml.bak
- <Package Folder>/shared_prefs/DualSimService.xml
- <Package Folder>/shared_prefs/HostUpdateConfig.xml
- <Package Folder>/shared_prefs/HostUpdateConfig.xml.bak
- <Package Folder>/shared_prefs/MarketDao.xml
- <Package Folder>/shared_prefs/MarketDao.xml.bak
- <Package Folder>/shared_prefs/SettingInfo.xml
- <Package Folder>/shared_prefs/TMSPropertiesAntitheftProperty.xml
- <Package Folder>/shared_prefs/TMSPropertiesIpDialProperty.xml
- <Package Folder>/shared_prefs/TMSPropertiesNetInterfaceManager.xml
- <Package Folder>/shared_prefs/TMSPropertiesnetworkload.xml
- <Package Folder>/shared_prefs/TMSPropertiesoperator_data_sync_setting.xml
- <Package Folder>/shared_prefs/TMSPropertieswup.xml
- <Package Folder>/shared_prefs/TMSPropertieswup.xml.bak
- <Package Folder>/shared_prefs/TempRootHelper.xml
- <Package Folder>/shared_prefs/TempRootHelper.xml.bak
- <Package Folder>/shared_prefs/TempRootHelper.xml.bak (deleted)
- <Package Folder>/shared_prefs/WLOGIN_DEVICE_INFO.xml
- <Package Folder>/shared_prefs/WLOGIN_DEVICE_INFO.xml.bak
- <Package Folder>/shared_prefs/account_misc.xml
- <Package Folder>/shared_prefs/catfish_sdk_config.xml
- <Package Folder>/shared_prefs/catfish_sdk_config.xml.bak
- <Package Folder>/shared_prefs/check_imsi.xml
- <Package Folder>/shared_prefs/conch_cache.xml
- <Package Folder>/shared_prefs/ctfactutlsp59.xml
- <Package Folder>/shared_prefs/daemon_config.xml
- <Package Folder>/shared_prefs/fixnt.xml
- <Package Folder>/shared_prefs/freq_ctrl_profile2.xml
- <Package Folder>/shared_prefs/freq_ctrl_profile4.xml
- <Package Folder>/shared_prefs/freq_ctrl_profile5.xml
- <Package Folder>/shared_prefs/freq_ctrl_profile6.xml
- <Package Folder>/shared_prefs/kv_profile_sp_name.xml
- <Package Folder>/shared_prefs/last_time.dat.xml
- <Package Folder>/shared_prefs/meri_config.xml
- <Package Folder>/shared_prefs/prfle_cnfg_dao.xml
- <Package Folder>/shared_prefs/rqd.xml
- <Package Folder>/shared_prefs/rqd.xml.bak
- <Package Folder>/shared_prefs/sk.xml
- <SD-Card>/.tmfs/<Package>_db.sqlite-journal
- <SD-Card>/.tmfs/filesafe_deamon.d
- <SD-Card>/2020479375e23c9c54d557b06b288587.tmp
- <SD-Card>/<Package>/####/2020479375e23c9c54d557b06b288587
- <SD-Card>/<Package>/####/C5418C1F1BA8FB638A38016FDD42227F.png.temp
- <SD-Card>/<Package>/####/MV9wb3J0YWxJbmZv
- <SD-Card>/DCIM/####/sk_g.dat
- <SD-Card>/DCIM/.probe
- <SD-Card>/tencent/####/MjAxNzA1MzE
- <SD-Card>/tencent/####/meta.dat
- <SD-Card>/tencent/####/record.dat
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/cpuinfo
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/sh -c getprop ro.board.platform
- /system/bin/sh -c getprop ro.build.fingerprint
- <error:2>
- chmod 755 <Package Folder>/files/athena_v4.dat
- chmod 755 <Package Folder>/files/wifidm
- getprop ro.board.platform
- getprop ro.build.fingerprint
- getprop ro.miui.ui.version.name
- grep wifidm
- pgrep wifidm
- pidof wifidm
- ps
- ps wifidm
- service list
- sh
- sh -c ps | grep wifidm
