Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Duad.1.origin
Сетевая активность:
Подключается к:
- s####.####.com
- apirepo####.####.com
- g####.####.net
- djjkj0y####.####.net
- r####.####.com
- c####.####.com
- gl####.####.com
- a####.####.com
Запросы HTTP GET:
- g####.####.net/prod/upload/adunion/images/2e6/1200_628_934730c105767704.jpeg
- g####.####.net/prod/upload/adunion/images/a72/1200_628_f84bcbcc0d57661c.jpeg
- g####.####.net/prod/upload/adunion/images/9e0/170_170_2ab63f59f58b2cb0.png
- g####.####.net/prod/upload/adunion/images/10d/170_170_4771b63873e313fc.png
- g####.####.net/prod/upload/adunion/images/148/170_170_5fa5aeeae8f81546.png
- g####.####.net/prod/upload/adunion/images/b8f/1200_628_4d58dfa2ab508b17.jpeg
- g####.####.net/prod/upload/adunion/images/93e/170_170_d01a30ee1b1a39b1.png
- g####.####.net/prod/upload/adunion/images/75e/170_170_4e74f8bf40b1379d.png
- g####.####.net/prod/upload/adunion/images/2de/1200_628_3d69cef78286d42a.jpeg
- g####.####.net/prod/upload/adunion/images/1e9/1200_628_6a19a8f6938a8167.jpeg
- g####.####.net/prod/upload/adunion/images/df7/170_170_8fa8600b4bc36bfc.png
- g####.####.net/prod/upload/adunion/images/11d/1200_628_146423b46d279006.jpeg
- g####.####.net/prod/upload/adunion/images/9c5/170_170_50fdd48fea14f059.png
- g####.####.net/prod/upload/adunion/images/231/170_170_75a4e6c736034852.png
- c####.####.com/index.php?service=####&pub=####&offer_id=####&uc_trans_1=####&subpub=####
- g####.####.net/prod/upload/adunion/images/d3c/170_170_44dea50c61fa36e6.png
- gl####.####.com/trace?offer_id=####&aff_id=####&aff_sub=####&aff_sub7=####&aff_sub8=####
- a####.####.com/adunion/slot/getSrcPrio?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=...
- g####.####.net/prod/upload/adunion/images/fe3/170_170_2b36b3fd31fda9f0.png
- a####.####.com/adunion/rtb/getInmobiAd?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=...
- g####.####.net/prod/upload/adunion/images/9b8/170_170_d4a908971c92c510.png
- g####.####.net/prod/upload/adunion/images/35a/170_170_bd8257eace514d5b.png
- s####.####.com/app/umeng?pid=####&dp=####&af=####&sk=####&cn=####&cv=####
- g####.####.net/prod/upload/adunion/images/26a/170_170_a4a09d985802f4d8.png
- g####.####.net/prod/upload/adunion/images/0e3/170_170_b5015b88a83f96ab.png
- g####.####.net/prod/upload/adunion/images/08d/170_170_f7ab0c85150f958f.png
- g####.####.net/prod/upload/adunion/images/7f3/170_170_884a2682f858e819.png
- g####.####.net/prod/upload/adunion/images/e29/170_170_b2ddf65a31a9c060.png
- g####.####.net/prod/upload/adunion/images/09e/170_170_c7806a66d60f9d24.png
- djjkj0y####.####.net/apps/20170122/com_alibaba_aliexpresshd-160.apk
- g####.####.net/prod/upload/adunion/images/608/170_170_406f226252c8da96.png
- g####.####.net/prod/upload/adunion/images/0a3/170_170_975d278bdda487f0.png
- g####.####.net/prod/upload/adunion/images/758/170_170_a5adac9fe45399d6.png
- g####.####.net/prod/upload/adunion/images/350/170_170_c9a4a017505aa83e.png
- g####.####.net/prod/upload/adunion/images/f9f/170_170_4e41360695173cf5.png
- a####.####.com/adunion/rtb/fetchAd?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=####...
- g####.####.net/prod/upload/adunion/images/371/170_170_32cb3cad24b2c98a.png
- g####.####.net/prod/upload/adunion/images/bdf/170_170_56a7cd0d33c67dbd.png
- a####.####.com/adunion/slot/getDlAd?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=###...
- g####.####.net/prod/upload/adunion/images/1f7/170_170_247d470acd8fcfbb.png
- g####.####.net/prod/upload/adunion/images/1fd/170_170_40f6cf4d761b294a.png
- g####.####.net/prod/upload/adunion/images/b89/170_170_93f0c1e09596695f.png
- g####.####.net/prod/upload/adunion/images/be3/741_417_010ec1f8a25c153f.jpeg
- g####.####.net/prod/upload/adunion/images/fa5/170_170_e8aef7f9f0954323.png
- apirepo####.####.com/apiClick?cidRev=####&ts=####&ifa=####&dm=####&dos=####&an=####&au=####&clickId####&customParam=####&testingMode=####
- g####.####.net/prod/upload/adunion/images/aa5/170_170_e8fe1de27900fe5f.png
Запросы HTTP POST:
- s####.####.com/pkl16.html
- a####.####.com/jiagu/t/infos
- r####.####.com/orts/rp?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=####&ntt=####&ls...
- a####.####.com/ad-service/ad/mark
- a####.####.com/app_logs
- r####.####.com/orts/rpb?h=####&w=####&model=####&vendor=####&sdk=####&dpi=####&sv=####&svn=####&pkg=####&v=####&vn=####&op=####&locale=####&ntt=####&l...
- a####.####.com/jiagu/mark/upgrade
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/.jiagu.lock
- /data/data/####/files/pl.apk
- /data/data/####/files/AdjustIoPackageQueue
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/ACCOMBLISHMENTS.xml.bak
- /data/data/####/files/.jglogs/.log3
- /data/data/####/shared_prefs/jg_core_control.xml.bak
- /data/data/####/Plugin/global.fm.fileexplorer/apk/base-1.apk
- /data/data/####/files/mobclick_agent_cached_####1008
- /data/data/####/files/pl.apk.tmp.tmp
- /data/data/####/files/AdjustIoActivityState
- /data/data/####/databases/_nohttp_cookies_db.db
- /data/data/####/databases/google_analytics_v4.db-journal
- /data/data/####/shared_prefs/medaille_save.xml
- /data/data/####/shared_prefs/jg_app_update_settings_random.xml
- /data/data/####/databases/gfad.db-journal
- /data/data/####/shared_prefs/ACCOMBLISHMENTS.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- /data/data/####/files/.imprint
- /data/data/####/files/.jglogs/.jg.ri
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml
- /data/data/####/files/libjiagu.so
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/.jglogs/.jg.ac
- /data/data/####/daemon
- /data/data/####/shared_prefs/jg_core_control.xml
- /data/data/####/databases/_nohttp_cookies_db.db-journal
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml
- /data/data/####/files/gaClientId
- /data/data/####/shared_prefs/coin_save.xml
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/Plugin/global.fm.fileexplorer/Signature/Signature_0.key
- /data/data/####/databases/google_app_measurement.db-journal
- /data/data/####/Plugin/global.fm.fileexplorer/dalvik-cache/base-1.dex
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/libjiagu.so
- /data/data/####/daemon
Другие:
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
