Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.543.origin
Сетевая активность:
Подключается к:
- s####.####.com
- p####.####.top
- o####.####.com
- 7j####.####.com
- f####.####.com
- c####.####.cn
- a####.####.com
Запросы HTTP GET:
- f####.####.com/category_cover/v1/1421842495.jpg
- f####.####.com/category_cover/v1/1421634469.jpg
- f####.####.com/category_cover/v1/1449800276.jpg
- f####.####.com/subject_cover/v1/small1421227597.jpg
- f####.####.com/category_cover/v1/1421842639.jpg
- f####.####.com/category_cover/v1/1449800852.jpg
- f####.####.com/api/sys/show_ctrl
- f####.####.com/api/recommend/sound?device=####
- f####.####.com/subject_cover/v1/big1489114774.jpg
- f####.####.com/img1/89/d1/f988fc82a31f99c15e072df09187-big.jpg
- f####.####.com/subject_cover/v1/small1487141814.jpg
- f####.####.com/subject_cover/1490067573303.jpg
- f####.####.com/api/category/get_list?device=####&merge=####&type=####&wh...
- f####.####.com/api/recommend/subject?page=####
- f####.####.com/common/default/hcc_android.png
- f####.####.com/subject_cover/1490067730785.jpg
- 7j####.####.com/tdata_gOY640
- f####.####.com/api/category/get_list?device=####&hot=####&merge=####&typ...
- f####.####.com/api/recommend/foucs?device=####&v=####
- f####.####.com/category_cover/v1/1421842365.jpg
- f####.####.com/category_cover/v1/1421842317.jpg
- f####.####.com/category_cover/v1/1449800324.jpg
- f####.####.com/subject_cover/v1/small1421227734.jpg
- f####.####.com/api/trends/show_tips?user_id=####
- f####.####.com/subject_cover/1490067659654.jpg
- f####.####.com/subject_cover/v1/small1461146657.jpg
- 7j####.####.com/tdata_KtX382
- f####.####.com/subject_cover/v1/1421063755.jpg
- f####.####.com/api/recommend/collect?device=####&limit=####&page=####&so...
- f####.####.com/category_cover/v1/1449801864.jpg
- f####.####.com/category_cover/v1/1421842765.jpg
- f####.####.com/category_cover/v1/1450149670.jpg
- f####.####.com/common/default/hot_category_cover_android.png
- f####.####.com/category_cover/v1/1450231827.jpg
- f####.####.com/api/category/get_list?device=####&type=####&hot=####
- c####.####.cn/sfile/201704/27/all/cp_V2.7.7.txt
Запросы HTTP POST:
- p####.####.top/sdf/ffn
- p####.####.top/jzbdt/enk/g/wbgh
- a####.####.com/snsconf
- p####.####.top/jzbdt/edvkb/z
- o####.####.com/check_config_update
- p####.####.top/jzbdt/bmi/vu/v
- p####.####.top/jzbdt/r/pej/unv
- p####.####.top/jzbdt/rcmjs/lvgo/r
- a####.####.com/conn
- s####.####.com/api.php?format=####&t=####
- p####.####.top/jzbdt/eu/ns/evog
- a####.####.com/app_logs
- a####.####.com/data2
- p####.####.top/jzbdt/umdsy/ib
- a####.####.com/log4
- a####.####.com/conf4
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/files/hc.jar
- /data/data/####/files/push.pid
- /data/data/####/.jiagu/libjiagu.so
- /data/data/####/files/init.pid
- /data/data/####/databases/pushsdk.db-journal
- /sdcard/libs/com.getui.sdk.deviceId.db
- /data/data/####/shared_prefs/ting_data.xml
- /sdcard/duole/fm/pic/2053428655.tmp
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml.bak
- /data/data/####/databases/duole.db-journal
- /sdcard/duole/fm/pic/-523194935.tmp
- /sdcard/duole/fm/pic/-1921688372.tmp
- /sdcard/duole/fm/pic/1083731605.tmp
- /data/data/####/files/.imprint
- /sdcard/duole/fm/pic/-176195517.tmp
- /sdcard/libs/app.db
- /sdcard/duole/fm/pic/-1505230482.tmp
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/databases/pushext.db-journal
- /sdcard/duole/fm/pic/1122706258.tmp
- /sdcard/duole/fm/pic/-1465446266.tmp
- /sdcard/system/tmp/local/tdata_gOY640
- /data/data/####/databases/sharesdk.db-journal
- /data/data/####/shared_prefs/kr.xml
- /sdcard/system/tmp/1d8bd96ac4924feef6d3de201e3a09a1/tdata_gOY640.tmp
- /sdcard/system/tmp/1d8bd96ac4924feef6d3de201e3a09a1/tdata_KtX382.tmp
- /data/data/####/shared_prefs/kr.xml.bak
- /data/data/####/files/run.pid
- /sdcard/duole/fm/pic/953898193.tmp
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /sdcard/system/tmp/1d8bd96ac4924feef6d3de201e3a09a1/tdata_KtX382.jar
- /sdcard/duole/fm/pic/1180489713.tmp
- /data/data/####/files/gdaemon_20151105
- /sdcard/duole/fm/pic/785746543.tmp
- /sdcard/duole/fm/pic/499452553.tmp
- /data/data/####/shared_prefs/dsi.xml
- /data/data/####/files/zu.jar
- /data/data/####/databases/t_u.db-journal
- /data/data/####/databases/pushg.db-journal
- /data/data/####/shared_prefs/share_sdk_0.xml.bak
- /sdcard/duole/fm/pic/83043397
- /sdcard/duole/fm/pic/211387309.tmp
- /data/data/####/shared_prefs/duole_guide.xml
- /data/data/####/files/umeng_it.cache
- /data/data/####/app_jgls/.log.lock
- /data/data/####/databases/webview.db-journal
- /sdcard/Android/data/####/files/Download/V2.7.7.txt
- /data/data/####/shared_prefs/wv.xml.bak
- /data/data/####/shared_prefs/sfe.xml.bak
- /sdcard/libs/####.db
- /sdcard/duole/fm/pic/83043397.tmp
- /sdcard/duole/fm/pic/95231411.tmp
- /data/data/####/app_jgls/.log.ls
- /sdcard/duole/fm/download_data.txt
- /sdcard/duole/fm/pic/1177330912.tmp
- /sdcard/duole/fm/pic/-1637884782.tmp
- /sdcard/duole/fm/pic/2015490903.tmp
- /sdcard/duole/fm/pic/-414988037
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /sdcard/ShareSDK/.ba
- /sdcard/duole/fm/pic/-414988037.tmp
- /sdcard/duole/fm/pic/-1496586069.tmp
- /sdcard/duole/fm/pic/1404062527.tmp
- /data/data/####/shared_prefs/wv.xml
- /sdcard/system/tmp/local/tdata_KtX382
- /data/data/####/databases/increment.db-journal
- /sdcard/duole/fm/pic/2015490903
- /sdcard/duole/fm/pic/722701246.tmp
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /sdcard/ShareSDK/.dk
- /sdcard/system/tmp/1d8bd96ac4924feef6d3de201e3a09a1/tdata_gOY640.jar
- /sdcard/duole/fm/pic/-1341191055.tmp
- /sdcard/duole/fm/pic/1180489713
- /data/data/####/databases/duole.db
- /data/data/####/shared_prefs/share_sdk_0.xml
- /data/data/####/shared_prefs/sfe.xml
Присваивает атрибут 'исполняемый' для следующих файлов:
- /data/data/####/files/gdaemon_20151105
Другие:
Запускает следующие shell-скрипты:
- /system/bin/dexopt --dex 27 49 40 215232 /data/data/####/files/hc.jar 1251701515 1539328792 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fr
- /data/data/####/files/gdaemon_20151105 0 ####/com.igexin.sdk.PushService 25262 300 0
- /system/bin/dexopt --dex 27 61 40 251912 /storage/emulated/0/system/tmp/1d8bd96ac4924feef6d3de201e3a09a1/tdata_gOY640.jar 1216894365 -1173311178 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/fram
- sh /data/data/####/files/gdaemon_20151105 0 ####/com.igexin.sdk.PushService 25262 300 0
- chmod 755 /data/data/####/.jiagu/libjiagu.so
- /system/bin/dexopt --dex 27 62 40 363576 /storage/emulated/0/system/tmp/1d8bd96ac4924feef6d3de201e3a09a1/tdata_KtX382.jar 1218810764 1230894262 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/frame
- /system/bin/dexopt --dex 27 58 40 215232 /data/data/####/files/zu.jar 1251701515 1539328792 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/fr
- chmod 700 /data/data/####/files/gdaemon_20151105
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
