Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- <SMS Address>: 状态有异，请确认状态并及时报警！当前所在地址：
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) www.gst####.com:80
- TCP(HTTP/1.1) f####.gst####.com:80
- TCP(HTTP/1.1) m####.gst####.cn:80
- TCP(HTTP/1.1) csi.gst####.com:80
- TCP(HTTP/1.1) mt1.go####.cn:80
- TCP(HTTP/1.1) m####.go####.cn:80
- TCP(HTTP/1.1) www.go####.cn:80
Запросы DNS:
- csi.gst####.com
- f####.gst####.com
- m####.go####.cn
- m####.gst####.cn
- mt1.go####.cn
- www.go####.cn
- www.gst####.com
Запросы HTTP GET:
- m####.go####.cn/maps/api/js/AuthenticationService.Authenticate?1shttp://...
- m####.go####.cn/maps/api/js/QuotaService.RecordEvent?1shttp://www.google...
- m####.go####.cn/maps/api/js/StaticMapService.GetMapImage?1####&1i####&2#...
- m####.go####.cn/maps/api/js/ViewportInfoService.GetViewportInfo?1####&1#...
- m####.gst####.cn/images/cleardot.gif
- m####.gst####.cn/mapfiles/api-3/images/mapcnt6.png
- m####.gst####.cn/mapfiles/closedhand_8_8.cur
- m####.gst####.cn/mapfiles/maps_lite/images/1x/button_directions_blue_62d...
- m####.gst####.cn/mapfiles/maps_lite/images/1x/button_directions_blue_pre...
- m####.gst####.cn/mapfiles/maps_lite/images/1x/button_mylocation_black_62...
- m####.gst####.cn/mapfiles/maps_lite/images/1x/button_mylocation_black_pr...
- m####.gst####.cn/mapfiles/maps_lite/images/1x/ic_arrow_right_white_24dp....
- m####.gst####.cn/mapfiles/maps_lite/images/1x/ic_close_lightgray_13dp.png
- m####.gst####.cn/mapfiles/maps_lite/images/1x/ic_directions_quantum.png
- m####.gst####.cn/mapfiles/maps_lite/images/1x/ic_menu_burger_default_24d...
- m####.gst####.cn/mapfiles/maps_lite/images/spinner_color.gif
- m####.gst####.cn/mapfiles/openhand_8_8.cur
- m####.gst####.cn/mapfiles/transparent.png
- m####.gst####.cn/maps
- m####.gst####.cn/maps-api-v3/api/js/30/2/intl/zh_cn/controls.js
- m####.gst####.cn/maps-api-v3/api/js/30/2/intl/zh_cn/onion.js
- m####.gst####.cn/maps-api-v3/api/js/30/2/intl/zh_cn/poly.js
- m####.gst####.cn/maps-api-v3/api/js/30/2/intl/zh_cn/stats.js
- m####.gst####.cn/maps-lite/js/2/ml_20170829_0/intl/zh_cn/controls_common...
- m####.gst####.cn/maps-lite/js/2/ml_20170829_0/intl/zh_cn/mobile_controls...
- m####.gst####.cn/maps/@?nogmmr=####
- m####.gst####.cn/maps/lite/suggest?pb=####
- m####.gst####.cn/maps/preview/log204?pb=####
- m####.gst####.cn/maps/vt?pb=####&token=####
- mt1.go####.cn/maps/vt?lyrs=####&hl=####&gl=####&x=####&y=####&z=####
- www.gst####.com/images/icons/material/system/1x/expand_less_grey600_24dp...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/CachedGeoposition.db
- <Package Folder>/files/CachedGeoposition.db-journal
- <Package Folder>/files/GeolocationPermissions.db-journal (deleted)
- <Package Folder>/shared_prefs/TextingState.xml
- <Package Folder>/shared_prefs/multidex.version.xml
Другие:
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
