Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.SmsSpy.677.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.SmsSpy.677.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sdk.qi1####.com:80
- TCP(HTTP/1.1) q####.qi1####.com:14302
- TCP(HTTP/1.1) q####.qi1####.com:15302
- TCP(HTTP/1.1) m.1huas####.com:80
- TCP(HTTP/1.1) z####.wann####.com:9500
- TCP(HTTP/1.1) dede####.s####.com:80
- TCP(HTTP/1.1) hangzho####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) d####.s####.com:80
- TCP(HTTP/1.1) qyc####.qi1####.com:8200
- TCP(HTTP/1.1) z####.wann####.com:9600
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) i-1.hg####.com:80
- TCP(HTTP/1.1) www.zhang####.com:80
- TCP(HTTP/1.1) www.yo####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) zxc####.wann####.com:8200
- TCP(HTTP/1.1) x1.hg####.com:80
- TCP(HTTP/1.1) 014.mx####.com:80
- TCP(HTTP/1.1) img.q####.net:80
- TCP(TLS/1.0) d####.s####.com:443
Запросы DNS:
- 014.mx####.com
- a####.u####.com
- app.s####.com
- av####.s####.com
- d####.s####.com
- dede####.s####.com
- hangzho####.oss-cn-####.aliy####.com
- hm.b####.com
- i-1.hg####.com
- img.q####.net
- l####.tbs.qq.com
- m.1huas####.com
- m.s####.com
- q####.qi1####.com
- qyc####.qi1####.com
- sdk.qi1####.com
- www.s####.com
- www.yo####.com
- www.zhang####.com
- x1.hg####.com
- z####.wann####.com
- zxc####.wann####.com
Запросы HTTP GET:
- 014.mx####.com/count.do?sc=####
- 014.mx####.com/count.do?sc===Bd####
- 014.mx####.com/count.do?sc==VUR####
- 014.mx####.com/count.do?sc==hUP####
- d####.s####.com/book/book_detail/100056641
- d####.s####.com/chapter/book_chapter_detail/100760562
- d####.s####.com/chapter/book_chapter_detail/100761090
- d####.s####.com/chapter/book_chapter_detail/100761627
- d####.s####.com/chapter/book_chapter_detail/100762169
- d####.s####.com/resources/css/grid.css
- d####.s####.com/resources/css/skin/white.css
- d####.s####.com/resources/css/style.css
- d####.s####.com/resources/fonts/iconfont.css
- d####.s####.com/resources/fonts/iconfont.ttf?t=####
- d####.s####.com/resources/images/avatar-default.png
- d####.s####.com/resources/images/logo-footer.png
- d####.s####.com/resources/images/tmp/cover.jpg
- d####.s####.com/resources/js/base.js
- d####.s####.com/resources/js/book-read-original.js
- d####.s####.com/resources/js/dialog-form.js?v=####
- d####.s####.com/resources/js/enjs.min.js
- d####.s####.com/resources/js/flexible.js
- d####.s####.com/resources/js/jquery-3.2.1.min.js
- d####.s####.com/resources/js/language/Strandition.js
- d####.s####.com/resources/js/myEncrytExtend-min.js
- d####.s####.com/resources/js/plugins/jquery.base64.min.js
- d####.s####.com/resources/js/plugins/jquery.lazyload/jquery.lazyload-1.9...
- d####.s####.com/resources/js/third-parties/jquery.uiAlertView-1.0.0.js
- d####.s####.com/resources/js/third-parties/placeholder.js
- d####.s####.com/setting/download
- d####.s####.com/uploads/allimg/c180114/81ac4aa7d5d250cbe433e09b167ea5d5....
- dede####.s####.com/download/Novel-release_161_jiagu_sign.apk
- hangzho####.oss-cn-####.aliy####.com/qiyi/client/sdk/so/libzxvps.so
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?3c839f9####
- i-1.hg####.com/2017/11/2/4a5f1b83-57f8-4839-8a9a-74164794926d.png
- i-1.hg####.com/2017/11/2/78e3f637-6690-401d-8015-d9bd61814365.png
- img.q####.net/image/248/248414/248414s.jpg
- m.1huas####.com/chapter/detail?ChannelId=####&novelId=####&t=####&s=####...
- qyc####.qi1####.com:8200/sdk/file?oz/Afum####
- sdk.qi1####.com/qiyi/client/sdk/PaySDK-1.2.16.8-UR_yx.jar
- www.yo####.com/cover/12/12984.jpg
- www.zhang####.com/Upload/Novel/Image/Large/20171206/20171206132728554301...
- x1.hg####.com/duandai/duandai.json
Запросы HTTP POST:
- a####.u####.com/app_logs
- d####.s####.com/chapter/ajax_get_session_code
- d####.s####.com/chapter/get_book_chapter_detail_info
- l####.tbs.qq.com/ajax?c=####&k=####
- l####.tbs.qq.com/ajax?c=####&v=####&k=####
- q####.qi1####.com:14302/sdk_login?t=####
- q####.qi1####.com:15302/sdk_login?t=####
- z####.wann####.com:9500/
- z####.wann####.com:9600/
- zxc####.wann####.com:8200/qy/acceptSdkFileReq
- zxc####.wann####.com:8200/qy/getOnlineLoginHttpReq
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_tbs/####/core_info
- <Package Folder>/app_tbs/####/debug.conf
- <Package Folder>/app_tbs/####/tbscoreinstall.txt
- <Package Folder>/app_tbs/####/tbslock.txt
- <Package Folder>/cache/####/0880f18d8a0bcc3e8c9221acfb78e6263ef....0.tmp
- <Package Folder>/cache/####/46a2c81225bcef1f86a6a8316e9633175c3....0.tmp
- <Package Folder>/cache/####/73e8962e9007dd720ff628b47a18c23b96d....0.tmp
- <Package Folder>/cache/####/bb92d02a912e4d39dd58d98095d78b3eaa3....0.tmp
- <Package Folder>/cache/####/da94898814af923b791f3dfc66033982000....0.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/a.db-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/qy_db_pay-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/exid.dat
- <Package Folder>/files/getprop
- <Package Folder>/files/pid
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/libzxvps/####/tmp_so
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/jg_so_upgrade_setting.xml
- <Package Folder>/shared_prefs/reader_pre.xml
- <Package Folder>/shared_prefs/tbs_download_config.xml
- <Package Folder>/shared_prefs/tbs_download_stat.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/unknown.xml
- <Package Folder>/shared_prefs/unknown.xml.bak
- <Package Folder>/tmp_jar
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.Systemp/.cfg
- <SD-Card>/.Systemp/device
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
Другие:
Запускает следующие shell-скрипты:
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.google.android.gms.analytics.CampaignTrackingService
- cat /sys/block/mmcblk0/device/cid
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- dd if=<Package Folder>/lib/libhelper.so of=<Package Folder>/lib/helper
- df
- getprop
- getprop ro.product.cpu.abi
- ls -l /system/bin/su
- ps | grep <Package>
- sh
Загружает динамические библиотеки:
- libhelper
- libjiagu
- libsmsmanager
- libzxvps
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- DES-ECB-NoPadding
- DESede-ECB-PKCS5Padding
- RSA-ECB-NoPadding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- DES-ECB-NoPadding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
Парсит информацию из смс сообщений.
Осуществляет доступ к информации об отправленых/принятых смс.
