Android.SmsSend.20707

Техническая информация

Вредоносные функции:

Отправляет СМС-сообщения:

13810931592: iyd ajh 200188820

Сетевая активность:

Подключается к:

f####.####.com
l####.####.cn
s####.####.cn

Запросы HTTP GET:

f####.####.com/M00/02/50/dzkV7FHKZ17obeDaAAAV6MhaNbU484/hyzjt.png
f####.####.com/M00/5E/EC/dzkV61HKZ16ItGWiAABCEgMxWvk380/hywwz.png
l####.####.cn/t?r=####&p=####
s####.####.cn/mobile/webview/ifontRank?version=####&user=####&apn=####&c...

Изменения в файловой системе:

Создает следующие файлы:

/system/fonts/DroidSansFallback.ttf
/system/fonts/DroidSansFallback_bk.ttf
<Package Folder>/.wn/####/4287fde1-d0f3-4469-82c3-d22d013a3915.a
<Package Folder>/.wn/####/apk_install_sc_db-journal
<Package Folder>/.wn/####/apk_install_tip.db-journal
<Package Folder>/.wn/####/app_stats.db-journal
<Package Folder>/.wn/####/app_track.db-journal
<Package Folder>/.wn/####/common_cfg.prefs
<Package Folder>/.wn/####/common_rundata.prefs
<Package Folder>/.wn/####/download.db-journal
<Package Folder>/.wn/####/exception
<Package Folder>/.wn/####/ext4-snail-5
<Package Folder>/.wn/####/libsnail_c2_e4_zip.so
<Package Folder>/.wn/####/log_cfg.prefs
<Package Folder>/.wn/####/log_index.db-journal
<Package Folder>/.wn/####/log_temp.db-journal
<Package Folder>/.wn/####/main.prefs
<Package Folder>/.wn/####/phone_dataer.prop
<Package Folder>/.wn/####/run_status.prefs
<Package Folder>/.wn/####/run_status_hb_request.gz
<Package Folder>/.wn/####/run_status_hb_response.gz
<Package Folder>/.wn/####/server_req_hb_response.gz
<Package Folder>/.wn/####/statistics.db-journal
<Package Folder>/.wn/####/win_ad.db-journal
<Package Folder>/app_ghaip/classes.jar
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/f_000001
<Package Folder>/cache/####/f_000002
<Package Folder>/cache/####/index
<Package Folder>/databases/dblsx-journal
<Package Folder>/databases/font.db
<Package Folder>/databases/font.db-journal
<Package Folder>/databases/iydDulMgr.db
<Package Folder>/databases/iydDulMgr.db-journal
<Package Folder>/databases/iydnet
<Package Folder>/databases/iydnet-journal
<Package Folder>/databases/iydpay
<Package Folder>/databases/iydpay-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/.c2.e4.zip
<Package Folder>/files/R4vx1Qlp6xQ=
<Package Folder>/shared_prefs/UserManager.xml
<Package Folder>/shared_prefs/UserManager.xml.bak
<Package Folder>/shared_prefs/UserManager.xml.bak (deleted)
<Package Folder>/shared_prefs/config.xml
<Package Folder>/shared_prefs/installID.xml
<Package Folder>/shared_prefs/iydsys.xml
<Package Folder>/shared_prefs/iydsys.xml.bak
<Package Folder>/shared_prefs/loader_wn.xml
<SD-Card>/.iydsys/####/setting.xml
<SD-Card>/.system/####/phone_dataer.prop

Другие:

Запускает следующие shell-скрипты:

/data/data/com.hyuy.kkh.o/.wn/files/ext4-snail-5
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
<dexopt>
<su-internal:result>
chmod 644 /system/fonts/DroidSansFallback.ttf
chmod 755 /system/fonts/DroidSansFallback_bk.ttf
cp -f /system/fonts/DroidSansFallback.ttf /system/fonts/DroidSansFallback_bk.ttf
cp -f /system/fonts/DroidSansFallback_bk.ttf /system/fonts/DroidSansFallback.ttf
mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
mount -t yaffs2 -o remount,rw /dev/block/mtdblock3 /system
sh
sh <Package Folder>/.wn/files/ext4-snail-5
su
su -c reboot