Техническая информация
Вредоносные функции:
Скрывает свою иконку с экрана устройства.
Сетевая активность:
Подключается к:
- f####.####.net
- g####.####.com
- tr####.####.com
Запросы HTTP GET:
- f####.####.net//ads/apks/5839250e-08d2-43b6-95ea-b450f6b7aeb2.apk
- g####.####.com/getconfig.do?sv=####&kv=####&appkey=####&names=####
Запросы HTTP POST:
- tr####.####.com/update.xxdd
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_baidu/xpodg
- <Package Folder>/av/####/0.xml
- <Package Folder>/av/####/base.apk
- <Package Folder>/av/####/data@app@com.dream.it.possible-1@base.apk@classes.dex
- <Package Folder>/av/####/package.ini
- <Package Folder>/av/####/packages.ini
- <Package Folder>/av/####/signature.ini
- <Package Folder>/av/####/tmp.qv2483
- <Package Folder>/av/####/uid-list.ini
- <Package Folder>/av/####/userlist.xml
- <Package Folder>/cache/34f5dd9b-d9bc-44f3-a288-7daeb2b56bcf
- <Package Folder>/code_cache/####/iuzwp.apk.classes1084836502.zip
- <Package Folder>/code_cache/####/iuzwp.apk.classes2.dex
- <Package Folder>/daemon.t.tmp
- <Package Folder>/files/35329472ce033fd9912b2215f6ede11c.dex (deleted)
- <Package Folder>/files/MKdh.dex (deleted)
- <Package Folder>/files/iuzwp.apk
- <Package Folder>/files/orodd.apk
- <Package Folder>/files/ubqyx
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <SD-Card>/.mkcong
- <SD-Card>/35329472ce033fd9912b2215f6ede11c.jar
- <SD-Card>/Android/####/35329472ce033fd9912b2215f6ede11c.jar
- <SD-Card>/Android/####/MKdh
- <SD-Card>/Android/####/MKdh.zip
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.ifidr.bira/app_baidu/xpodg -p com.ifidr.bira -r am start --user 0 -n com.ifidr.bira/jtgl.ptht -a jtgl.ptht -i 2122
- /data/data/com.ifidr.bira/app_baidu/xpodg -p com.ifidr.bira -r am start --user 0 -n com.ifidr.bira/jtgl.ptht -a jtgl.ptht -i 2271
- /data/data/com.ifidr.bira/app_baidu/xpodg -p com.ifidr.bira -r am start --user 0 -n com.ifidr.bira/jtgl.ptht -a jtgl.ptht -i 2306
- /data/data/com.ifidr.bira/app_baidu/xpodg -p com.ifidr.bira -r am start --user 0 -n com.ifidr.bira/jtgl.ptht -a jtgl.ptht -i 2452
- /data/data/com.ifidr.bira/app_baidu/xpodg -p com.ifidr.bira -r am start --user 0 -n com.ifidr.bira/jtgl.ptht -a jtgl.ptht -i 2547
- /data/data/com.ifidr.bira/app_baidu/xpodg -p com.ifidr.bira -r am start --user 0 -n com.ifidr.bira/jtgl.ptht -a jtgl.ptht -i 2573
- /data/data/com.ifidr.bira/daemon -p com.ifidr.bira/daemon -r am startservice --user 0 -n com.ifidr.bira/com.xlb.keeplive.KeepLiveService -e key daemon -i 2452
- /data/user/0/com.ifidr.bira/app_baidu/xpodg -p com.ifidr.bira -r am start --user 0 -n com.ifidr.bira/jtgl.ptht -a jtgl.ptht -i 2483
- /data/user/0/com.ifidr.bira/app_baidu/xpodg -p com.ifidr.bira -r am start --user 0 -n com.ifidr.bira/jtgl.ptht -a jtgl.ptht -i 2520
- <dexopt>
- chmod 777 /data/data/com.ifidr.bira/app_baidu/xpodg
- chmod 777 /data/data/com.ifidr.bira/daemon
- chmod 777 /data/user/0/<Package>/app_baidu/xpodg
- chmod 777 /data/user/0/com.ifidr.bira/app_baidu/xpodg
- chmod 777 <Package Folder>/app_baidu/xpodg
- chmod 777 <Package Folder>/daemon
- sh /data/user/0/<Package>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/jtgl.ptht -a jtgl.ptht -i 2483
- sh /data/user/0/<Package>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/jtgl.ptht -a jtgl.ptht -i 2520
- sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/jtgl.ptht -a jtgl.ptht -i 2122
- sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/jtgl.ptht -a jtgl.ptht -i 2271
- sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/jtgl.ptht -a jtgl.ptht -i 2306
- sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/jtgl.ptht -a jtgl.ptht -i 2452
- sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/jtgl.ptht -a jtgl.ptht -i 2547
- sh <Package Folder>/app_baidu/xpodg -p <Package> -r am start --user 0 -n <Package>/jtgl.ptht -a jtgl.ptht -i 2573
- sh <Package Folder>/daemon -p <Package>/daemon -r am startservice --user 0 -n <Package>/com.xlb.keeplive.KeepLiveService -e key daemon -i 2452
