Техническая информация
Вредоносные функции:
Скрывает свою иконку с экрана.
Сетевая активность:
Подключается к:
- TCP(???) 2####.126.6.26:8443
- TCP(DNS) <Google DNS>
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.media_provider_guard
- /data/data/####/.media_shell_guard
- /data/data/####/.mpu_probe
- /data/data/####/media_guard
Другие:
Запускает следующие shell-скрипты:
- /data/app/~~15gxmLwQaODpaynGa1-ISQ==/<Package>-gwIG8uNG2xjn7BoPVW-JWw==/lib/arm64/libwatchdog.so <Package> /data/local/tmp/.mpu_1116597365.apk
- /system/bin/sh -c nohup '/data/app/~~15gxmLwQaODpaynGa1-ISQ==/<Package>-gwIG8uNG2xjn7BoPVW-JWw==/lib/arm64/libwatchdog.so' <Package> '/data/local/tmp/.mpu_1116597365.apk' </dev/null >/dev/null 2>&1 &
- /system/bin/sh -c nohup /system/bin/sh '/data/user/0/<Package>/files/media_guard' </dev/null >/dev/null 2>&1 &
- /system/bin/sh -c nohup /system/bin/sh -c nohup '/data/app/~~15gxmLwQaODpaynGa1-ISQ==/<Package>-gwIG8uNG2xjn7BoPVW-JWw==/lib/arm64/libwatchdog.so' <Package> '/data/local/tmp/.mpu_1116597365.apk' </dev/null >/dev/null 2>&1 & </dev/null >/dev/null 2>&1 &
- /system/bin/sh -c nohup /system/bin/sh -c "nohup '/data/app/~~15gxmLwQaODpaynGa1-ISQ==/<Package>-gwIG8uNG2xjn7BoPVW-JWw==/lib/arm64/libwatchdog.so' <Package> '/data/local/tmp/.mpu_1116597365.apk' </dev/null >/dev/null 2>&1 &" </dev/null >/dev/null 2>&1 &
- /system/bin/sh -c nohup /system/bin/sh -c \ </dev/null >/dev/null 2>&1 &
- /system/bin/sh /data/user/0/<Package>/files/media_guard
- /system/bin/sh /system/bin/dpm set-active-admin --user 0 <Package>/.AdminReceiver
- /system/bin/sh /system/bin/settings put global selinux_enforcement 0
- /system/bin/su 0 /system/bin/sh -c /data/local/tmp/.mpu_ksud debug version 2>/dev/null
- /system/bin/su 0 /system/bin/sh -c /data/local/tmp/.mpu_ksud sepolicy check 'allow init init:process fork' 2>/dev/null
- /system/bin/su 0 /system/bin/sh -c test -d /data/adb/ksu
- /system/bin/su 0 /system/bin/sh -c test -x '/data/adb/ksu/bin/ksud'
- /system/bin/su 0 /system/bin/sh -c test -x '/data/adb/ksud'
- /system/bin/su 0 /system/bin/sh -c test -x '/data/adb/magisk/magiskpolicy'
- /system/bin/su 0 /system/bin/sh -c test -x '/debug_ramdisk/ksud'
- /system/bin/su 0 /system/bin/sh -c test -x '/sbin/magiskpolicy'
- /system/bin/su 0 /system/bin/sh -c test -x '/sbin/su'
- /system/bin/su 0 /system/bin/sh -c test -x '/system/bin/supolicy'
- /system/bin/su 0 /system/bin/sh -c test -x '/system/xbin/magiskpolicy'
- /system/bin/su 0 /system/bin/sh -c test -x '/system/xbin/su'
- /system/bin/su 0 /system/bin/sh -c test -x '/system/xbin/supolicy'
- /system/bin/su 0 /system/bin/sh -c test -x 'ksud'
- /system/bin/su 0 /system/bin/sh -c test -x 'magiskpolicy'
- /system/bin/su 0 /system/bin/sh -c test -x 'supolicy'
- /system/bin/su 0 /system/bin/sh -c which /data/adb/ksu/bin/ksud 2>/dev/null
- /system/bin/su 0 /system/bin/sh -c which /data/adb/ksud 2>/dev/null
- /system/bin/su 0 /system/bin/sh -c which /data/adb/magisk/magiskpolicy 2>/dev/null
- /system/bin/su 0 /system/bin/sh -c which /debug_ramdisk/ksud 2>/dev/null
- /system/bin/su 0 /system/bin/sh -c which /sbin/magiskpolicy 2>/dev/null
- /system/bin/su 0 /system/bin/sh -c which /system/bin/supolicy 2>/dev/null
- /system/bin/su 0 /system/bin/sh -c which /system/xbin/magiskpolicy 2>/dev/null
- /system/bin/su 0 /system/bin/sh -c which /system/xbin/supolicy 2>/dev/null
- /system/bin/su 0 /system/bin/sh -c which ksud 2>/dev/null
- /system/bin/su 0 /system/bin/sh -c which magiskpolicy 2>/dev/null
- /system/bin/su 0 /system/bin/sh -c which supolicy 2>/dev/null
- /system/xbin/su -c test -x '/data/adb/magisk/magiskpolicy'
- /system/xbin/su -c test -x '/sbin/magiskpolicy'
- /system/xbin/su -c test -x 'magiskpolicy'
- /system/xbin/su -c which /data/adb/magisk/magiskpolicy 2>/dev/null
- /system/xbin/su -c which /sbin/magiskpolicy 2>/dev/null
- /system/xbin/su -c which magiskpolicy 2>/dev/null
- /system/xbin/su 0 /system/bin/sh -c test -x '/data/adb/magisk/magiskpolicy'
- /system/xbin/su 0 /system/bin/sh -c test -x '/sbin/magiskpolicy'
- /system/xbin/su 0 /system/bin/sh -c test -x 'magiskpolicy'
- /system/xbin/su 0 /system/bin/sh -c which /data/adb/magisk/magiskpolicy 2>/dev/null
- /system/xbin/su 0 /system/bin/sh -c which /sbin/magiskpolicy 2>/dev/null
- /system/xbin/su 0 /system/bin/sh -c which magiskpolicy 2>/dev/null
- id
- setenforce 0
- setprop ro.boot.selinux permissive
- sh -c /data/local/tmp/.mpu_ksud debug version 2>/dev/null
- sh -c /data/local/tmp/.mpu_ksud sepolicy check 'allow init init:process fork' 2>/dev/null
- sh -c cp '/data/app/~~15gxmLwQaODpaynGa1-ISQ==/<Package>-gwIG8uNG2xjn7BoPVW-JWw==/base.apk' '/data/local/tmp/.mpu_1116597365.apk' && chmod 644 '/data/local/tmp/.mpu_1116597365.apk'
- sh -c cp '/system/bin/su' '/data/local/tmp/.mpu_ksud' && chmod 755 '/data/local/tmp/.mpu_ksud'
- sh -c echo -1000 > /proc/2868/oom_score_adj
- sh -c echo -1000 > /proc/4255/oom_score_adj
- sh -c echo -17 > /proc/2868/oom_adj
- sh -c echo -17 > /proc/4255/oom_adj
- sh -c find /data/adb /system /sbin /vendor -name 'ksud' -type f 2>/dev/null | head -1
- sh -c find /data/adb /system /sbin /vendor -name 'magiskpolicy' -type f 2>/dev/null | head -1
- sh -c find /data/adb /system /sbin /vendor -name 'supolicy' -type f 2>/dev/null | head -1
- sh -c getenforce 2>/dev/null
- sh -c rm -f '/data/local/tmp/.mpu_ksud'
- sh -c test -d /data/adb/ksu
- sh -c test -x '/data/adb/ksu/bin/ksud'
- sh -c test -x '/data/adb/ksud'
- sh -c test -x '/data/adb/magisk/magiskpolicy'
- sh -c test -x '/data/local/tmp/.mpu_ksud'
- sh -c test -x '/debug_ramdisk/ksud'
- sh -c test -x '/sbin/magiskpolicy'
- sh -c test -x '/sbin/su'
- sh -c test -x '/system/bin/su'
- sh -c test -x '/system/bin/supolicy'
- sh -c test -x '/system/xbin/magiskpolicy'
- sh -c test -x '/system/xbin/su'
- sh -c test -x '/system/xbin/supolicy'
- sh -c test -x 'ksud'
- sh -c test -x 'magiskpolicy'
- sh -c test -x 'supolicy'
- sh -c which /data/adb/ksu/bin/ksud 2>/dev/null
- sh -c which /data/adb/ksud 2>/dev/null
- sh -c which /data/adb/magisk/magiskpolicy 2>/dev/null
- sh -c which /debug_ramdisk/ksud 2>/dev/null
- sh -c which /sbin/magiskpolicy 2>/dev/null
- sh -c which /system/bin/supolicy 2>/dev/null
- sh -c which /system/xbin/magiskpolicy 2>/dev/null
- sh -c which /system/xbin/supolicy 2>/dev/null
- sh -c which ksud 2>/dev/null
- sh -c which magiskpolicy 2>/dev/null
- sh -c which su 2>/dev/null
- sh -c which supolicy 2>/dev/null
- sleep 120
- su -c /data/local/tmp/.mpu_ksud debug version 2>/dev/null
- su -c /data/local/tmp/.mpu_ksud sepolicy check 'allow init init:process fork' 2>/dev/null
- su -c cmd device_policy set-active-admin --user 0 <Package>/.AdminReceiver
- su -c cp '/data/app/~~15gxmLwQaODpaynGa1-ISQ==/<Package>-gwIG8uNG2xjn7BoPVW-JWw==/base.apk' '/data/local/tmp/.mpu_1116597365.apk' && chmod 644 '/data/local/tmp/.mpu_1116597365.apk'
- su -c cp '/system/bin/su' '/data/local/tmp/.mpu_ksud' && chmod 755 '/data/local/tmp/.mpu_ksud'
- su -c dpm set-active-admin --user 0 <Package>/.AdminReceiver
- su -c echo -1000 > /proc/2868/oom_score_adj
- su -c echo -1000 > /proc/4255/oom_score_adj
- su -c echo -17 > /proc/2868/oom_adj
- su -c echo -17 > /proc/4255/oom_adj
- su -c find /data/adb /system /sbin /vendor -name 'ksud' -type f 2>/dev/null | head -1
- su -c find /data/adb /system /sbin /vendor -name 'magiskpolicy' -type f 2>/dev/null | head -1
- su -c find /data/adb /system /sbin /vendor -name 'supolicy' -type f 2>/dev/null | head -1
- su -c getenforce 2>/dev/null
- su -c id
- su -c rm -f '/data/local/tmp/.mpu_ksud'
- su -c setenforce 0
- su -c setprop ro.boot.selinux permissive
- su -c settings put global selinux_enforcement 0
- su -c test -d /data/adb/ksu
- su -c test -x '/data/adb/ksu/bin/ksud'
- su -c test -x '/data/adb/ksud'
- su -c test -x '/data/adb/magisk/magiskpolicy'
- su -c test -x '/data/local/tmp/.mpu_ksud'
- su -c test -x '/debug_ramdisk/ksud'
- su -c test -x '/sbin/magiskpolicy'
- su -c test -x '/sbin/su'
- su -c test -x '/system/bin/su'
- su -c test -x '/system/bin/supolicy'
- su -c test -x '/system/xbin/magiskpolicy'
- su -c test -x '/system/xbin/su'
- su -c test -x '/system/xbin/supolicy'
- su -c test -x 'ksud'
- su -c test -x 'magiskpolicy'
- su -c test -x 'supolicy'
- su -c which /data/adb/ksu/bin/ksud 2>/dev/null
- su -c which /data/adb/ksud 2>/dev/null
- su -c which /data/adb/magisk/magiskpolicy 2>/dev/null
- su -c which /debug_ramdisk/ksud 2>/dev/null
- su -c which /sbin/magiskpolicy 2>/dev/null
- su -c which /system/bin/supolicy 2>/dev/null
- su -c which /system/xbin/magiskpolicy 2>/dev/null
- su -c which /system/xbin/supolicy 2>/dev/null
- su -c which ksud 2>/dev/null
- su -c which magiskpolicy 2>/dev/null
- su -c which su 2>/dev/null
- su -c which supolicy 2>/dev/null
- su 0 /system/bin/sh -c /data/local/tmp/.mpu_ksud debug version 2>/dev/null
- su 0 /system/bin/sh -c /data/local/tmp/.mpu_ksud sepolicy check 'allow init init:process fork' 2>/dev/null
- su 0 /system/bin/sh -c test -d /data/adb/ksu
- su 0 /system/bin/sh -c test -x '/data/adb/ksu/bin/ksud'
- su 0 /system/bin/sh -c test -x '/data/adb/ksud'
- su 0 /system/bin/sh -c test -x '/data/adb/magisk/magiskpolicy'
- su 0 /system/bin/sh -c test -x '/debug_ramdisk/ksud'
- su 0 /system/bin/sh -c test -x '/sbin/magiskpolicy'
- su 0 /system/bin/sh -c test -x '/sbin/su'
- su 0 /system/bin/sh -c test -x '/system/bin/supolicy'
- su 0 /system/bin/sh -c test -x '/system/xbin/magiskpolicy'
- su 0 /system/bin/sh -c test -x '/system/xbin/su'
- su 0 /system/bin/sh -c test -x '/system/xbin/supolicy'
- su 0 /system/bin/sh -c test -x 'ksud'
- su 0 /system/bin/sh -c test -x 'magiskpolicy'
- su 0 /system/bin/sh -c test -x 'supolicy'
- su 0 /system/bin/sh -c which /data/adb/ksu/bin/ksud 2>/dev/null
- su 0 /system/bin/sh -c which /data/adb/ksud 2>/dev/null
- su 0 /system/bin/sh -c which /data/adb/magisk/magiskpolicy 2>/dev/null
- su 0 /system/bin/sh -c which /debug_ramdisk/ksud 2>/dev/null
- su 0 /system/bin/sh -c which /sbin/magiskpolicy 2>/dev/null
- su 0 /system/bin/sh -c which /system/bin/supolicy 2>/dev/null
- su 0 /system/bin/sh -c which /system/xbin/magiskpolicy 2>/dev/null
- su 0 /system/bin/sh -c which /system/xbin/supolicy 2>/dev/null
- su 0 /system/bin/sh -c which ksud 2>/dev/null
- su 0 /system/bin/sh -c which magiskpolicy 2>/dev/null
- su 0 /system/bin/sh -c which supolicy 2>/dev/null
- su 0 id
Загружает динамические библиотеки:
- libattack
- libdns
Использует повышенные привилегии.
Пытается определить окружение песочницы.
