Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.543.origin
Сетевая активность:
Подключается к:
- t####.####.com
- p####.####.top
- 1####.####.67
- c####.####.org
- d####.####.com
- 5####.####.56
- c####.####.cn
- a####.####.com
Запросы HTTP GET:
- d####.####.com/GoodBooks/Books/cover/2012-12-21/adba4189-81ef-4803-ba14-...
- d####.####.com/GoodBooks/Books/cover/2015-06-19/c4cd959f-d76c-4ba0-86b9-...
- t####.####.com/advpic20170512_5915c65878da8.jpg?id=####
- d####.####.com/GoodBooks/Books/cover/2015-07-02/b41420dc-ed33-40c5-929d-...
- c####.####.cn/sfile/201705/17/all/cp_V2.7.8.txt
- d####.####.com/GoodBooks/Books/cover/2012-05-02/2677cec5-2020-4c30-9d81-...
- t####.####.com/sxsplash20160727_579817e1da72a.jpg
- 5####.####.56/checker
- c####.####.cn/upload/201704/19/app/20170419164327750.apk
- c####.####.cn/upload/201607/12/img/20160712113200038.png
- t####.####.com/advpic20170512_5915c5e47c786.jpg?id=####
- d####.####.com/GoodBooks/Books/cover/2015-03-30/b501b620-dee4-46f5-9d29-...
- t####.####.com/sxsplash20160727_579817de0f457.jpg
- d####.####.com/GoodBooks/Books/cover/2015-06-19/e983ec41-27eb-4358-881c-...
- d####.####.com/GoodBooks/Books/cover/2014-12-28/fd0974f4-b672-4aa8-a75e-...
- t####.####.com/sxsplash20160727_57981808344f4.jpg
- c####.####.org/strategy/sul18
- d####.####.com/GoodBooks/Books/cover/2011-07-21/639ffe76-d3d8-406e-9cab-...
- d####.####.com/GoodBooks/Books/cover/2015-10-12/154d1259-0161-44d4-8e55-...
- t####.####.com/advpic20170512_5915c52f28433.jpg?id=####
- d####.####.com/GoodBooks/Books/cover/2015-06-19/efa228a8-30b1-4a9d-9ae3-...
- t####.####.com/sxsplash20170518_591d70e9b1f7f.jpg
- c####.####.org/strategy/loss_4.3
- t####.####.com/advpic20170515_5919527cad388.jpg
- d####.####.com/GoodBooks/Books/cover/2011-06-13/1657b961-a597-4de1-821f-...
- c####.####.org/strategy/dev_root2
- d####.####.com/GoodBooks/Books/cover/2015-04-14/0da8d6f2-c021-4df6-9664-...
- c####.####.org/strategy/symlink-adbd
- d####.####.com/GoodBooks/Books/cover/2015-06-19/b79b4534-2dd4-42ec-a51e-...
- c####.####.org/strategy/UnknownDev
- t####.####.com/advpic20170512_5915c5842b9be.jpg?id=####
- t####.####.com/sxsplash20160727_579817da499fb.jpg
- d####.####.com/GoodBooks/Books/cover/2015-08-14/23560c39-ad67-4c94-8d60-...
- d####.####.com/GoodBooks/Books/cover/2015-06-19/7aaa5483-edb0-417f-909f-...
- a####.####.com/sx/GetConfigInfo.aspx?ver=####&passID=####&ver=####&clien...
- c####.####.org/strategy/base
- t####.####.com/sxsplash20160727_579817d469bca.jpg
- 5####.####.56/core
- d####.####.com/GoodBooks/Books/cover/2015-03-19/a01c9180-7a0d-4138-960c-...
- c####.####.org/strategy/larger4.3
- d####.####.com/GoodBooks/Books/cover/2015-05-08/c6e0eb27-13d9-4e16-b636-...
- d####.####.com/GoodBooks/Books/cover/2015-06-29/fb06197a-4e47-40c7-a137-...
- d####.####.com/GoodBooks/Books/cover/2015-04-02/923e22e8-6c98-4359-815b-...
- c####.####.cn/upload/201703/10/img/20170310154746318.png
- c####.####.org/strategy/dev_root
- d####.####.com/GoodBooks/Books/cover/2015-10-12/103d9fac-6211-448d-8510-...
Запросы HTTP POST:
- p####.####.top/sdf/tk
- p####.####.top/hadat/bj/x
- 1####.####.67/log/interface.html
- a####.####.com/ad-service/ad/mark
- p####.####.top/jzbdt/axft/fyz
- p####.####.top/hadat/ndxo/kdbh
- p####.####.top/jzbdt/d/rhae
- p####.####.top/jzbdt/r/u/ixvup
- p####.####.top/hadat/cpzdt/lx
- 1####.####.67/strategy/interface.html
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/app_002d50cc-f091-41d7-bedb-57a0af2c091c/supolicy
- <Package Folder>/app_d5e49c4a-c073-4e61-8ac8-63edd460470f/toolbox
- <Package Folder>/app_be05388c-970c-4fb3-afe2-95362b7f014b/supolicy
- <Package Folder>/app_941bef45-294c-4dc5-aec7-12b1120d4698/wsroot.sh
- <Package Folder>/app_f41a38eb-c271-4e98-b3b5-fee57486719d/debuggerd
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/app_be05388c-970c-4fb3-afe2-95362b7f014b/pidof
- <Package Folder>/app_f41a38eb-c271-4e98-b3b5-fee57486719d/supolicy
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/app_d5e49c4a-c073-4e61-8ac8-63edd460470f/fileWork
- <Package Folder>/app_d5e49c4a-c073-4e61-8ac8-63edd460470f/pidof
- <Package Folder>/app_002d50cc-f091-41d7-bedb-57a0af2c091c/debuggerd
- <Package Folder>/app_002d50cc-f091-41d7-bedb-57a0af2c091c/Matrix
- <Package Folder>/app_f41a38eb-c271-4e98-b3b5-fee57486719d/pidof
- <Package Folder>/app_be05388c-970c-4fb3-afe2-95362b7f014b/wsroot.sh
- <Package Folder>/app_subox_download/e68b3bf5-0a6e-4cbc-90d4-f1ded49c0999
- <Package Folder>/app_subox_download/7c8f8724-0def-41aa-ba87-56ebb854aec2
- <Package Folder>/app_e65a5d5c-5b2c-4b69-a74b-13e2fcc43d12/fileWork
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/shared_prefs/wv.xml.bak
- <Package Folder>/app_subox_download/815a2631-1b0a-4e09-9084-abeff4c8a4f5
- <Package Folder>/app_d5e49c4a-c073-4e61-8ac8-63edd460470f/ddexe
- <Package Folder>/app_d5e49c4a-c073-4e61-8ac8-63edd460470f/wsroot.sh
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/databases/ireader.db-journal
- <Package Folder>/app_f41a38eb-c271-4e98-b3b5-fee57486719d/toolbox
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/app_002d50cc-f091-41d7-bedb-57a0af2c091c/su
- <Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
- <Package Folder>/files/.jglogs/.jg.ic
- <Package Folder>/app_subox_download/b0096825-9f87-455a-a50a-f57f8eed4048
- <Package Folder>/app_002d50cc-f091-41d7-bedb-57a0af2c091c/pidof
- <Package Folder>/app_e65a5d5c-5b2c-4b69-a74b-13e2fcc43d12/su
- <Package Folder>/app_813baa13-1bb2-4e45-a603-2bfac9429fa8/checker.jar
- <Package Folder>/app_941bef45-294c-4dc5-aec7-12b1120d4698/ddexe
- <Package Folder>/app_941bef45-294c-4dc5-aec7-12b1120d4698/supolicy
- <Package Folder>/app_941bef45-294c-4dc5-aec7-12b1120d4698/fileWork
- <Package Folder>/app_e65a5d5c-5b2c-4b69-a74b-13e2fcc43d12/wsroot.sh
- <Package Folder>/app_plugin_download/5a3aa309-668e-4033-8e54-a25890e0e031
- <Package Folder>/app_941bef45-294c-4dc5-aec7-12b1120d4698/toolbox
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/app_e65a5d5c-5b2c-4b69-a74b-13e2fcc43d12/toolbox
- <Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
- <Package Folder>/app_f41a38eb-c271-4e98-b3b5-fee57486719d/wsroot.sh
- <Package Folder>/app_subox/c61913b615fb6224701377a119081f36
- <Package Folder>/app_e65a5d5c-5b2c-4b69-a74b-13e2fcc43d12/supolicy
- <Package Folder>/app_be05388c-970c-4fb3-afe2-95362b7f014b/install-recovery.sh
- <Package Folder>/app_d5e49c4a-c073-4e61-8ac8-63edd460470f/root3
- <Package Folder>/app_d5e49c4a-c073-4e61-8ac8-63edd460470f/install-recovery.sh
- <Package Folder>/app_002d50cc-f091-41d7-bedb-57a0af2c091c/ddexe
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_002d50cc-f091-41d7-bedb-57a0af2c091c/fileWork
- <Package Folder>/app_d5e49c4a-c073-4e61-8ac8-63edd460470f/su
- <Package Folder>/shared_prefs/sfe.xml
- <Package Folder>/app_d5e49c4a-c073-4e61-8ac8-63edd460470f/device.db
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/app_be05388c-970c-4fb3-afe2-95362b7f014b/Matrix
- <Package Folder>/app_be05388c-970c-4fb3-afe2-95362b7f014b/su
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/app_f41a38eb-c271-4e98-b3b5-fee57486719d/install-recovery.sh
- <Package Folder>/app_anonymous_files/anonymous_core.so
- <Package Folder>/app_002d50cc-f091-41d7-bedb-57a0af2c091c/install-recovery.sh
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/app_d5e49c4a-c073-4e61-8ac8-63edd460470f/Matrix
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/app_be05388c-970c-4fb3-afe2-95362b7f014b/ddexe
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_sslcache/www.ireadercity.com.443
- <Package Folder>/app_941bef45-294c-4dc5-aec7-12b1120d4698/install-recovery.sh
- <Package Folder>/app_e65a5d5c-5b2c-4b69-a74b-13e2fcc43d12/Matrix
- <Package Folder>/app_f41a38eb-c271-4e98-b3b5-fee57486719d/fileWork
- <Package Folder>/app_941bef45-294c-4dc5-aec7-12b1120d4698/su
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/app_941bef45-294c-4dc5-aec7-12b1120d4698/debuggerd
- <Package Folder>/app_subox_download/9df2099e-0314-49cb-8d4d-4ed7f5e223af
- <Package Folder>/app_subox_download/b5390fe3-4923-40ab-9d05-6b619c14c443
- <Package Folder>/app_e65a5d5c-5b2c-4b69-a74b-13e2fcc43d12/debuggerd
- <Package Folder>/app_subox_download/d56aeb7e-5137-4266-8920-83b88225e859
- <Package Folder>/app_f41a38eb-c271-4e98-b3b5-fee57486719d/su
- <Package Folder>/files/ki.jar
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/app_d5e49c4a-c073-4e61-8ac8-63edd460470f/debuggerd
- <Package Folder>/shared_prefs/umeng_feedback_conversations.xml
- <Package Folder>/app_be05388c-970c-4fb3-afe2-95362b7f014b/fileWork
- <Package Folder>/app_be05388c-970c-4fb3-afe2-95362b7f014b/toolbox
- <Package Folder>/app_002d50cc-f091-41d7-bedb-57a0af2c091c/toolbox
- <Package Folder>/app_d5e49c4a-c073-4e61-8ac8-63edd460470f/supolicy
- <Package Folder>/app_002d50cc-f091-41d7-bedb-57a0af2c091c/wsroot.sh
- <Package Folder>/app_e65a5d5c-5b2c-4b69-a74b-13e2fcc43d12/install-recovery.sh
- <Package Folder>/app_plugin_download/8f617c59-158a-4523-a893-a72ee9e3e06e
- <Package Folder>/app_e65a5d5c-5b2c-4b69-a74b-13e2fcc43d12/ddexe
- <Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- <Package Folder>/app_subox_download/54598668-4a94-4608-8167-72f3bd81ec14
- <Package Folder>/app_941bef45-294c-4dc5-aec7-12b1120d4698/pidof
- <Package Folder>/app_941bef45-294c-4dc5-aec7-12b1120d4698/Matrix
- <Package Folder>/databases/aireader_v2-journal
- <Package Folder>/app_f41a38eb-c271-4e98-b3b5-fee57486719d/Matrix
- <Package Folder>/files/lg.jar
- <Package Folder>/app_f41a38eb-c271-4e98-b3b5-fee57486719d/ddexe
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/com_ireader_city_you_qi.xml
- <Package Folder>/app_be05388c-970c-4fb3-afe2-95362b7f014b/debuggerd
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/umeng_feedback_user_info.xml
- <Package Folder>/app_e65a5d5c-5b2c-4b69-a74b-13e2fcc43d12/pidof
- <Package Folder>/shared_prefs/multidex.version.xml
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 755 /data/data/####/.jiagu/libjiagu.so
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- <dexopt>
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
