Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.1.origin
Сетевая активность:
Подключается к:
- s####.####.com
- c####.####.org
- ce####.####.org
- p####.####.com
- e####.####.com
- e####.####.com:8088
- a####.####.com
Запросы HTTP GET:
- ce####.####.org/v3/system/countrys.json
- a####.####.com/2017/03/16/16291628.dex
- c####.####.org/v2/content/list-0-45333877-45299733-NL-1-0-1.json
- c####.####.org/2017-03-10/fdd09187affd6584db1bd008d0a9d282.jpg
- c####.####.org/v2/content/list-0-0-0-NL-1-0-1.json?1485415####
- c####.####.org/2017-03-21/ac1614c08a1c6e0c77ea64c421aea194.jpg!240
- ce####.####.org/v3/system/initcountrytopic.json
- c####.####.org/2017-03-21/6ba6bc1ec0b565d65c4c678fd508af4e.jpg!240
- c####.####.org/2017-03-21/aee7e7051359c4d88a26032ebc4c48d9.jpg!240
- ce####.####.org/v2/content/recommend-2479c25dc4fb781df6250a98a9867660-NL-0.json
- c####.####.org/2017-03-21/894c92319d3557f520282fe206903baa.jpg!240
- c####.####.org/v2/system/startimg-NL.json
- c####.####.org/2017-03-21/8a83dfddf59760c542e47431cb4d1e86.jpg!240
- a####.####.com/2017/03/16/162846737.so
- c####.####.org/2017-03-21/4fb7346c29b99fc9188696162d86de4a.jpg!240
- a####.####.com/2017/03/16/162833859.so
- c####.####.org/2017-03-21/7ac7eae0cf4233eeb14ffd3eef0dd768.jpg!240
- c####.####.org/v2/system/languages.json
- c####.####.org/v2/system/models-104.json
- a####.####.com/2017/03/16/162908592.dat
- c####.####.org/2017-03-21/1655686595dbb4539e10efb50d9f286d.jpg!240
- c####.####.org/v2/system/version-1-104.json
- a####.####.com/2017/03/16/162928889.so
Запросы HTTP POST:
- e####.####.com/ping
- s####.####.com/pkl16.html
- a####.####.com/jiagu/t/infos
- p####.####.com/jiagu/msgs
- ce####.####.org/auth/gather
- e####.####.com:8088/sdk/api/ad/hull
- e####.####.com/sdk/api/log/record
- a####.####.com/app_logs
- e####.####.com/sdk/api/regclient
- a####.####.com/ad-service/ad/mark
- a####.####.com/jiagu/mark/upgrade
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/.jiagu.lock
- /data/data/####/databases/snowfoxad_msg.db-journal
- /data/data/####/files/AppEventsLogger.persistedevents
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/shared_prefs/jg_app_update_settings_random.xml
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/.yflurrydatasenderblock.bce31a01-4258-4287-9d05-102d4c3d4674
- /data/data/####/files/.umeng/exchangeIdentity.json
- /sdcard/Android/data/####/cache/uil-images/13kihbsj3qou5k327b18bj46b.0.tmp
- /data/data/####/shared_prefs/configLookPath.xml
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/databases/google_app_measurement_local.db-journal
- /data/data/####/files/.yflurryfreqcap.-74f3d84c97ae62b2
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/app_jgls/.log.ls
- /data/data/####/files/####.so
- /data/data/####/files/.yflurryadlog.-74f3d84c97ae62b2
- /data/data/####/files/.YFlurrySenderIndex.info.AnalyticsData_4V9ZCNZSFZ2KVF43Q7BB_216
- /sdcard/Android/data/####/cache/uil-images/jquhmd7ywr3nwif2vjukurl8.0.tmp
- /data/data/####/shared_prefs/com.google.android.gms.appid.xml
- /data/data/####/shared_prefs/com.facebook.sdk.attributionTracking.xml
- /sdcard/Android/data/####/cache/uil-images/ttjx8yt90cz01uaswprxajcp.0.tmp
- /data/data/####/files/mesosphere.so
- /data/data/####/files/lookDL/dlLookCore-2018370489.tmp
- /data/data/####/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/shared_prefs/Prophet.xml
- /data/data/####/dex_cache/MultiDex.lock
- /sdcard/Android/data/####/.snowfoxmsg/imei.txt
- /data/data/####/shared_prefs/Game_recommend.xml.bak
- /sdcard/Android/data/####/cache/uil-images/3yrq03yo1yhilaga74jmp2r1j.0.tmp
- /data/data/####/no_backup/com.google.android.gms.appid-no-backup
- /sdcard/Android/data/####/cache/uil-images/29bz2k2uav9a7n84fsml64mwt.0.tmp
- /data/data/####/shared_prefs/SDKIDFA.xml
- /data/data/####/files/.jglogs/.jg.ac
- /data/data/####/files/####.dex
- /data/data/####/files/umeng_it.cache
- /sdcard/Android/data/####/cache/.nomedia
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/files/.yflurryreport.-74f3d84c97ae62b2
- /data/data/####/databases/google_app_measurement_local.db
- /data/data/####/databases/snowfoxad_msg.db
- /sdcard/Android/data/####/cache/uil-images/3c7s5btacd43cg4j8al7408xc.0.tmp
- /data/data/####/shared_prefs/v2_local_login.xml
- /data/data/####/shared_prefs/BSModelForPlaced.xml
- /data/data/####/databases/db_snowfox.db
- /data/data/####/.jiagu/libjiagu.so
- /data/data/####/shared_prefs/MASTER_DATA.xml
- /data/data/####/databases/db_snowfox.db-journal
- /data/data/####/shared_prefs/jg_core_setting.xml.bak
- /sdcard/####/WelcomeImg/fdd09187affd6584db1bd008d0a9d282.jpg
- /data/data/####/databases/Zuoyoo_db
- /sdcard/Android/data/.nomedia
- /sdcard/Android/data/####/files/logdata/delay_20170126072345151_2479c25dc4fb781df6250a98a9867660_b.dat
- /data/data/####/shared_prefs/Game_recommend.xml
- /data/data/####/databases/Zuoyoo_db-journal
- /data/data/####/shared_prefs/FBAdPrefs.xml
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml
- /data/data/####/shared_prefs/Module_Switch_DATA.xml.bak
- /data/data/####/app_jgls/.log.lock
- /data/data/####/shared_prefs/updateVer.xml
- /data/data/####/shared_prefs/test.xml
- /data/data/####/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/shared_prefs/sp_cache.xml
- /data/data/####/shared_prefs/coolook.minisite.xml
- /data/data/####/shared_prefs/jg_core_setting.xml
- /sdcard/Android/data/####/.snowfoxmsg/dev_8afc64e7.txt
- /data/data/####/app_303e6a5d8e46461f9102b8e5a351026f515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFile
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/.jglogs/.log3
- /data/data/####/shared_prefs/CountryRelevant.xml
- /data/data/####/files/lib.dat
- /data/data/####/app_303e6a5d8e46461f9102b8e5a351026f515d6767-01b7-49e5-8273-c8d11b0f331d/validatorFile
- /data/data/####/app_303e6a5d8e46461f9102b8e5a351026f515d6767-01b7-49e5-8273-c8d11b0f331d/sessions/sessionFile
- /data/data/####/shared_prefs/snowfoxprf.xml
- /data/data/####/shared_prefs/Module_Switch_DATA.xml
- /data/data/####/files/####.dat
- /data/data/####/shared_prefs/GATHER.xml.bak
- /data/data/####/files/.imprint
- /data/data/####/files/.jglogs/.jg.ri
- /data/data/####/files/mesosphere.jar
- /data/data/####/files/lookDL/dlLookCore2037573823.tmp
- /sdcard/Android/data/####/cache/uil-images/4n9959cn5ez3ptvsct17rym9w.0.tmp
- /data/data/####/files/snowfox_v18.jar
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/303e6a5d8e46461f9102b8e5a351026f515d6767-01b7-49e5-8273-c8d11b0f331d.xml
- /data/data/####/files/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/files/snowfox_v18.so
- /sdcard/Android/data/####/files/logdata/delay_20170126072341572_2479c25dc4fb781df6250a98a9867660_s.dat
- /sdcard/Android/data/####/cache/uil-images/journal.tmp
- /data/data/####/dex_cache/base21187856593.zip
- /sdcard/Android/data/####/cache/uil-images/64r9qjv9pkv6y8e9xs83d2ctk.0.tmp
- /data/data/####/shared_prefs/GATHER.xml
Другие:
Запускает следующие shell-скрипты:
- ps
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
