Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.511.origin
Сетевая активность:
Подключается к:
- s####.####.com
- t####.####.com
- st####.####.com
- 1####.####.67
- i####.####.com
- ish####.net
- p####.####.com
- q####.####.com
- c####.####.com
- w####.####.com
- l####.####.com
- ping####.####.com
- n####.####.com
- a####.####.com
Запросы HTTP GET:
- s####.####.com/api/threads/listPosts.json?thread_key=####&url=####&title...
- p####.####.com/cartoon/book-1/1/862-8736/01.png?6820####
- p####.####.com/sbs/60/208.jpg
- 1####.####.67/strategy/larger4.3
- c####.####.com/9.gif?abc=####&rnd=####
- 1####.####.67/strategy/sul18
- p####.####.com/cartoon/book-1/1/862-8736/00.png?6820####
- st####.####.com/styles/embed.default.css?9b2a46a####
- ping####.####.com/pingd?dm=####&pvi=####&si=####&url=####&arg=####&ty=##...
- 1####.####.67/strategy/loss_4.3
- i####.####.com/gin/631/gins.png
- i####.####.com/ft/531/fts.jpg
- ish####.net/ComicBooks/ReadComicBooksToIso/5912.html
- w####.####.com/core.php?web_id=####&l=####&t=####
- p####.####.com/cartoon/book-1/1/862-8736/04-05.png?6820####
- i####.####.com/bojin/18/bjs.png
- q####.####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&...
- st####.####.com/images/bg_sprites.png
- p####.####.com/cartoon/book-1/1/862-8736/10.png?6820####
- 1####.####.67/strategy/dev_root2
- st####.####.com/embed.js
- p####.####.com/cartoon/book-1/1/862-8736/08.png?6820####
- i####.####.com/pq/250/pqs.jpg
- 1####.####.67/strategy/dev_root
- p####.####.com/cartoon/book-1/1/862-8736/15.png?6820####
- p####.####.com/cartoon/book-1/1/862-8736/12.png?6820####
- p####.####.com/cartoon/book-1/1/862-8736/sp.jpg?6820####
- p####.####.com/cartoon/book-1/1/862-8736/02.png?0f20####
- w####.####.com/q_stat.php?id=####&l=####
- p####.####.com/cartoon/book-1/1/862-8736/09.png?6820####
- p####.####.com/cartoon/book-1/1/862-8736/07.png?6820####
- i####.####.com/yz/921/yzs.png
- p####.####.com/cartoon/book-1/1/862-8736/13.png?6820####
- i####.####.com/toriko/396/mss.jpg
- i####.####.com/hero/121/yxs.png
- ish####.net/Content/scripts/jq.js
- ish####.net/ComicBooks/ReadComicBooksToIsoV1/5912.html
- p####.####.com/cartoon/book-1/1/862-8736/14.png?6820####
- p####.####.com/cartoon/book-1/1/862-8736/03.png?6820####
- t####.####.com/stats?sId=####
- st####.####.com/images/sprites.png
- 1####.####.67/strategy/symlink-adbd
- p####.####.com/cartoon/book-1/1/862-8736/16-17.png?6820####
- p####.####.com/cartoon/book-1/1/862-8736/11.png?6820####
- i####.####.com/op/862/ops.png
- i####.####.com/comic/fenxi/fm.jpg
- ish####.net/ReadComicBooksToIsoV2/5912
- st####.####.com/libs/embed.compat.js?24f8ca3####
- p####.####.com/cartoon/book-1/1/862-8736/06.png?6820####
Запросы HTTP POST:
- s####.####.com/pkl16.html
- a####.####.com/jiagu/t/infos
- ish####.net/ComicBooks/GetChapterList?id=####&PageIndex=####
- l####.####.com/8a61/gf2
- p####.####.com/jiagu/msgs
- ish####.net/ComicBooks/GetAllBook?ClassifyId=####&Size=####&PageIndex=####
- a####.####.com/ad-service/ad/mark
- n####.####.com/navipush.json
- 1####.####.67/log/interface.html
- l####.####.com/3a6bl
- l####.####.com/8a61/z8a
- a####.####.com/app_logs
- l####.####.com/8a61/l2a
- 1####.####.67/strategy/interface.html
- l####.####.com/6b48k
- a####.####.com/jiagu/mark/upgrade
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/.jiagu.lock
- /data/data/####/shared_prefs/AppStore.xml
- /data/data/####/cache/image_manager_disk_cache/8f10fc7f1adf472eadba1e08ccb1846369b1fa1f807800432cda5718bd1f2dae.0.tmp
- /data/data/####/app_9ee73e34-fdff-439d-9240-67dfa5cfc61f/fileWork
- /data/data/####/app_subox_download/743257a6-c691-47ae-80fc-9506e3c021e6
- /data/data/####/app_7e16787b-7919-48e4-aa8e-4ee006085b0a/Matrix
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/files/cn.bkbk.garys.jar
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/cache/webviewCacheChromium/data_0
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/app_9ee73e34-fdff-439d-9240-67dfa5cfc61f/supolicy
- /data/data/####/app_subox_download/62cdab88-0563-4887-93a1-0808990428db
- /data/data/####/shared_prefs/jg_app_update_settings_random.xml
- /data/data/####/databases/comic.db-journal
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/ri.jar
- /data/data/####/app_96d519c6-3332-43c8-9410-a9a361ffa3c0/wsroot.sh
- /data/data/####/shared_prefs/qq.xml
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/app_subox/1740c449fc10be62df60ba0f18696c9f
- /data/data/####/app_7e16787b-7919-48e4-aa8e-4ee006085b0a/debuggerd
- /data/data/####/files/libjiagu.so
- /data/data/####/databases/t_u.db-journal
- /data/data/####/app_7e16787b-7919-48e4-aa8e-4ee006085b0a/wsroot.sh
- /data/data/####/app_96d519c6-3332-43c8-9410-a9a361ffa3c0/supolicy
- /data/data/####/app_9ee73e34-fdff-439d-9240-67dfa5cfc61f/wsroot.sh
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/_w1121190168.xml
- /data/data/####/app_ehtmp/eh.jar
- /data/data/####/cache/image_manager_disk_cache/9436538365c46aaeb089f83ca4d5e2303620b88c25377ce6bfa6839f4001886b.0.tmp
- /data/data/####/shared_prefs/qq.xml.bak
- /data/data/####/cache/image_manager_disk_cache/05fb6ccfbbbeb5dd09e5b039cf7d52a33bef4579ca5a2bf721a60658c1d7f7c5.0.tmp
- /data/data/####/app_9ee73e34-fdff-439d-9240-67dfa5cfc61f/su
- /data/data/####/app_bb7fa869-964b-46a4-ac35-c32ed922dd1d/pidof
- /data/data/####/app_9ee73e34-fdff-439d-9240-67dfa5cfc61f/ddexe
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/debuggerd
- /data/data/####/app_9ee73e34-fdff-439d-9240-67dfa5cfc61f/toolbox
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/app_bb7fa869-964b-46a4-ac35-c32ed922dd1d/toolbox
- /data/data/####/app_7e16787b-7919-48e4-aa8e-4ee006085b0a/fileWork
- /data/data/####/app_bb7fa869-964b-46a4-ac35-c32ed922dd1d/install-recovery.sh
- /data/data/####/cache/webviewCacheChromium/f_00000a
- /data/data/####/app_subox_download/6afb3492-cd35-4b30-90b4-503b5dbd4785
- /data/data/####/cache/webviewCacheChromium/f_00000c
- /data/data/####/cache/webviewCacheChromium/f_00000b
- /data/data/####/cache/webviewCacheChromium/f_00000e
- /data/data/####/cache/webviewCacheChromium/f_00000d
- /data/data/####/cache/webviewCacheChromium/f_00000f
- /data/data/####/shared_prefs/jg_core_control.xml.bak
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/shared_prefs/COUNTLY_STORE.xml
- /data/data/####/app_bb7fa869-964b-46a4-ac35-c32ed922dd1d/Matrix
- /data/data/####/app_96d519c6-3332-43c8-9410-a9a361ffa3c0/debuggerd
- /data/data/####/shared_prefs/umeng_message_state.xml
- /data/data/####/shared_prefs/recent_list.xml.bak
- /data/data/####/app_96d519c6-3332-43c8-9410-a9a361ffa3c0/ddexe
- /data/data/####/app_bb7fa869-964b-46a4-ac35-c32ed922dd1d/su
- /data/data/####/app_9ee73e34-fdff-439d-9240-67dfa5cfc61f/pidof
- /data/data/####/files/.jglogs/.jg.ac
- /data/data/####/cache/image_manager_disk_cache/633af6756e2d0907009cf147f4b9c2d0fed2ab18e229015bb5e2218b565aefad.0.tmp
- /data/data/####/cache/webviewCacheChromium/f_000009
- /data/data/####/cache/webviewCacheChromium/f_000008
- /data/data/####/app_9ee73e34-fdff-439d-9240-67dfa5cfc61f/debuggerd
- /data/data/####/app_7e16787b-7919-48e4-aa8e-4ee006085b0a/ddexe
- /data/data/####/cache/webviewCacheChromium/f_000001
- /data/data/####/cache/webviewCacheChromium/f_000003
- /data/data/####/cache/webviewCacheChromium/f_000002
- /data/data/####/cache/webviewCacheChromium/f_000005
- /data/data/####/cache/webviewCacheChromium/f_000004
- /data/data/####/cache/webviewCacheChromium/f_000007
- /data/data/####/cache/webviewCacheChromium/f_000006
- /data/data/####/files/umeng_it.cache
- /data/data/####/app_bb7fa869-964b-46a4-ac35-c32ed922dd1d/fileWork
- /data/data/####/app_9ee73e34-fdff-439d-9240-67dfa5cfc61f/install-recovery.sh
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/app_subox_download/84878ddf-671d-4bd4-9aee-dd4c859910de
- /data/data/####/app_anonymous_files/anonymous_core.so
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/root3
- /data/data/####/app_7e16787b-7919-48e4-aa8e-4ee006085b0a/supolicy
- /data/data/####/app_7e16787b-7919-48e4-aa8e-4ee006085b0a/pidof
- /data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/ddexe
- /data/data/####/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- /data/data/####/cache/image_manager_disk_cache/9d8f6fcc6252704411a8862ef2805203470b13eb87d85ac83a4b9817d7abccb5.0.tmp
- /data/data/####/shared_prefs/i_l_y.xml
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/device.db
- /data/data/####/shared_prefs/umeng_feedback_conversations.xml
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/install-recovery.sh
- /data/data/####/cache/webviewCacheChromium/f_000014
- /data/data/####/shared_prefs/AppStore.xml.bak
- /data/data/####/cache/webviewCacheChromium/f_000012
- /data/data/####/cache/webviewCacheChromium/f_000013
- /data/data/####/cache/webviewCacheChromium/f_000010
- /data/data/####/cache/webviewCacheChromium/f_000011
- /data/data/####/app_subox/b18a021d11a3004d25017230b681476b
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/supolicy
- /data/data/####/app_bb7fa869-964b-46a4-ac35-c32ed922dd1d/ddexe
- /sdcard/Android/data/####/cache/kit/journal.tmp
- /data/data/####/app_7e16787b-7919-48e4-aa8e-4ee006085b0a/toolbox
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/wsroot.sh
- /data/data/####/cache/image_manager_disk_cache/84c11312f8e8b2ad5629270463410daa8909f35377a6611f2fa9338ee12d74d4.0.tmp
- /data/data/####/files/SUBOXLOG_
- /data/data/####/app_subox_download/72a0ba60-d04c-4ff8-a779-014a05ccb981
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/fileWork
- /data/data/####/cache/image_manager_disk_cache/9d42169b1a9fe20a4145afc0fe7171d6835286beebc1bf3a6e706910ee1fced7.0.tmp
- /data/data/####/shared_prefs/jg_core_control.xml
- /data/data/####/cache/image_manager_disk_cache/acbeb6ff0a6a30913d77bdc60705ccf8532d36bc55b2ad702ff1375ff97e3a88.0.tmp
- /data/data/####/app_96d519c6-3332-43c8-9410-a9a361ffa3c0/pidof
- /data/data/####/shared_prefs/9b87bdc4.xml
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/pidof
- /data/data/####/shared_prefs/_i1121190168.xml
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/su
- /data/data/####/shared_prefs/_w1121190168.xml.bak
- /data/data/####/app_7e16787b-7919-48e4-aa8e-4ee006085b0a/install-recovery.sh
- /data/data/####/app_96d519c6-3332-43c8-9410-a9a361ffa3c0/fileWork
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/.jglogs/.log3
- /data/data/####/shared_prefs/recent_list.xml
- /data/data/####/cache/image_manager_disk_cache/240848e3b04b07756aa3b5c19c47054795afc0de720bfd383d108e6ee8e4ddd8.0.tmp
- /data/data/####/files/####c.jar
- /data/data/####/app_subox_download/d15eabbd-765a-4361-b186-31cddda64e50
- /data/data/####/app_ijx/[B@4aa03890.jar
- /data/data/####/shared_prefs/9b87bdc4.xml.bak
- /data/data/####/shared_prefs/Statistics.xml.bak
- /data/data/####/files/.imprint
- /data/data/####/app_bb7fa869-964b-46a4-ac35-c32ed922dd1d/debuggerd
- /data/data/####/app_7e16787b-7919-48e4-aa8e-4ee006085b0a/su
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/toolbox
- /data/data/####/app_96d519c6-3332-43c8-9410-a9a361ffa3c0/install-recovery.sh
- /data/data/####/cache/image_manager_disk_cache/journal.tmp
- /data/data/####/cache/image_manager_disk_cache/12377e562055b553fda1744cf255255be4c0cefd03f3af95c021acf84c9c18e5.0.tmp
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/Matrix
- /data/data/####/shared_prefs/umeng_feedback_user_info.xml
- /data/data/####/app_96d519c6-3332-43c8-9410-a9a361ffa3c0/toolbox
- /data/data/####/app_bb7fa869-964b-46a4-ac35-c32ed922dd1d/supolicy
- /data/data/####/app_bb7fa869-964b-46a4-ac35-c32ed922dd1d/wsroot.sh
- /data/data/####/app_96d519c6-3332-43c8-9410-a9a361ffa3c0/Matrix
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/app_96d519c6-3332-43c8-9410-a9a361ffa3c0/su
- /data/data/####/shared_prefs/Statistics.xml
- /data/data/####/app_9ee73e34-fdff-439d-9240-67dfa5cfc61f/Matrix
- /data/data/####/app_subox/b0141e478b25af7c40a8cca8de6c4708
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/libjiagu.so
- /data/data/####/app_bb7fa869-964b-46a4-ac35-c32ed922dd1d/Matrix
- /data/data/####/app_7e16787b-7919-48e4-aa8e-4ee006085b0a/Matrix
- /data/data/####/app_0ee67478-337a-456b-ba92-b4a3e4c65808/Matrix
- /data/data/####/app_9ee73e34-fdff-439d-9240-67dfa5cfc61f/Matrix
- /data/data/####/app_96d519c6-3332-43c8-9410-a9a361ffa3c0/Matrix
Другие:
Запускает следующие shell-скрипты:
- chmod 755 /data/data/####/files/libjiagu.so
- sh
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
