Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 10690691036592: 42d1c74c-0ec9-4b9f-a415-19d6f8b29044-1496217044941,点击发送直接注册
- 10690691036592: eeaa2815-d34e-499c-a2f7-deba544d31e4-1496217053951,点击发送直接注册
Сетевая активность:
Подключается к:
- a####.####.com
- c####.####.com
- htt####.####.com
- i####.####.com:8000
- l####.####.com
- nsc####.####.com
- pass####.####.com
- t####.####.com
- wap####.####.com
Запросы HTTP GET:
- htt####.####.com/ips/v1?_client_type=####&_client_version=####&_phone_im...
- i####.####.com:8000/
- nsc####.####.com/v.gif?pid=####&type=####&tpl=####&device=####&name=####...
- pass####.####.com/wp/api/security/antireplaytoken?tpl=####&v=####&callba...
- t####.####.com/tb/client/logsync3.js?t=####
- wap####.####.com/static/appsapi/conf/config.txt?tpl=####&app_version=###...
Запросы HTTP POST:
- a####.####.com/device/logForC
- c####.####.com/c/s/switch
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_plugins/####/libssohash.so
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/baidu_adp.db-journal
- <Package Folder>/databases/baidu_tieba.db-journal
- <Package Folder>/databases/trafficstats.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/firll.dat
- <Package Folder>/files/####/offinfo.dat
- <Package Folder>/files/####/stat108F66E4Writing.log
- <Package Folder>/files/####/switchsConfig
- <Package Folder>/files/wappass.baidu.com-passport-login.html
- <Package Folder>/shared_prefs/adp.xml
- <Package Folder>/shared_prefs/adp.xml.bak
- <Package Folder>/shared_prefs/adp_feature_switch.xml
- <Package Folder>/shared_prefs/common_settings.xml
- <Package Folder>/shared_prefs/sapi_system.xml
- <Package Folder>/shared_prefs/sapi_system.xml.bak
- <Package Folder>/shared_prefs/settings.xml
- <Package Folder>/shared_prefs/settings.xml.bak
- <SD-Card>/.BD_SAPI_CACHE/####/login.html
- <SD-Card>/.pingfangx/####/1496217042869
- <SD-Card>/.pingfangx/####/com.baidu.tieba.pluginall_1496217043229_49.apk
- <SD-Card>/.pingfangx/####/plugin_settings
- <SD-Card>/.pingfangx/####/xxsave.db
- <SD-Card>/.pingfangx/####/xxsave.db-journal
- <SD-Card>/baidu/####/conlts.dat
- <SD-Card>/baidu/####/ls.db
- <SD-Card>/baidu/####/ls.db-journal
- <SD-Card>/baidu/####/yoh.dat
- <SD-Card>/baidu/####/yol.dat
- <SD-Card>/baidu/####/yom.dat
- <SD-Card>/baidu/.cuid
- <SD-Card>/gifXStLHP2110 (deleted)
- <SD-Card>/gifpixDSfAHp2110 (deleted)
- <SD-Card>/tieba/####/dbg108F66E4Writing.log
- <SD-Card>/tieba/####/dbg898FE914Writing.log
- <SD-Card>/tieba/from.dat
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- getprop net.dns1
- getprop net.dns2
- getprop ro.miui.ui.version.name
Может автоматически отправлять СМС-сообщения.
