警惕，黑客千方百计攻击安卓用户

在用户设备上成功执行应用程序后，它会从Android设备上窃取联系人、短信、通话日志、设备位置等。通过窃取这些信息，黑客可以通过OTP服务登录重要账户，通过短信进行包括金融在内的各种欺诈，并通过向被盗联系人发送短信来扩大他们的传播范围。我们认为这种恶意软件被用来执行有针对性的攻击

技术分析

APK Metadata Information

• App Name: System Settings

• Package Name: me.hawkshaw

• SHA256 Hash:

805309668d4dd73ff39e6c1407df346fe0e18beb7a5efe24a9660f990770b 224

恶意软件向用户请求38种不同的权限，其中至少有18种被滥用。下面列出了这些危险的权限

Permissions	Description
ACCESS_NETWORK_STATE	Allows the app to view information about network connections
READ_PHONE_STATE	Allows access to phone state, including the current cellular network information, the phone number and the serial number of this phone, the status of any ongoing calls, and a list of any Phone Accounts registered on the device
READ_SMS	Access phone messages
WRITE_SMS	Allows the app to modify or delete SMS
READ_CONTACTS	Access phone contacts
PROCESS_OUTGOING_CALLS	Allows the app to process outgoing calls and modify the dialing number
READ_EXTERNAL_STORAGE	Allows the app to read the contents of the device’s external storage.
WRITE_EXTERNAL_STORAGE	Allows the app to write or delete files to the external storage of the device
READ_CALL_LOG	Access phone call logs
RECORD_AUDIO	Allows the app to record audio with the microphone, which can be misused by attackers
ACCESS_COARSE_LOCATION	Allows the app to get the approximate location of the device network sources, such as cell towers and Wi-Fi
ACCESS_FINE_LOCATION	Allows the app to get the precise location of the device using the Global Positioning System (GPS)
CALL_PHONE	Allows an application to initiate a phone call without going through the Dialer user interface to confirm the call.
SEND_SMS	Allows an application to send SMS messages.
RECEIVE_SMS	Allows an application to receive SMS messages.
GET_ACCOUNTS	Allows the app to get the list of accounts used by the phone.
RECEIVE_SMS	Allows an application to receive SMS messages.
READ_HISTORY_BOOKMARKS	Allows the app to read the browser history and bookmarks.