Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.79.origin
Сетевая активность:
Подключается к:
- trac####.####.com
- n####.nl
- ab26251####.####.net
- ce####.####.org
- r####.####.nl
- api-ce####.####.org
- b####.####.com
- s####.####.com
- u####.####.com
- i####.####.com
- a####.####.io
- pri####.####.nl
- google-####.com
- p####.####.com
- c####.####.nl
- gl####.####.com
- pag####.####.com
- c6ba1cd####.####.com
- c####.####.org
- a####.####.net
- b####.####.nl
- s####.####.fi
- h####.com
- a####.####.com
- con####.####.net
- t####.####.com
- c####.####.net
- cloudfr####.####.com
- c####.####.com
Запросы HTTP GET:
- trac####.####.com/click?mb_pl=####&mb_nt=####&mb_campid=####&mb_package=...
- s####.####.fi/js/sat.js
- ce####.####.org/v3/system/countrys.json
- h####.com/js/bundles/partner-article.js?squizard?bust=####
- h####.com/article/58e6f86166f6003903b4fa41?view=####
- n####.nl/static/js/advertising.js
- c####.####.org/2017-04-07/06205956992c7c1998f3798b8f329a0e.jpg!240
- b####.####.com/b?c1=####&c2=####&ns_site=####&nb_01=####&nb_02=####&nb_1...
- a####.####.com/api/ads/check?md5=####&secret=####&app_v=####&app=####&ch...
- google-####.com/collect?v=####&_v=####&a=####&t=####&ni=####&_s=####&dl=...
- c####.####.org/v2/system/version-1-96.json
- n####.nl/static/CACHE/js/0dc4d6f6842e.js
- google-####.com/analytics.js
- n####.nl/m/cejxo07a7ydw_std160.jpg
- google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=####&u...
- h####.com/content?url=####
- n####.nl/files/adblock2.jpg
- c####.####.net/pixel?google_nid=####&googl####&id=####
- h####.com/css/fonts/roboto-v15-latin-regular.ttf
- r####.####.nl/Get/ilsemedia/JS/GetRcmd.js?ord=####
- h####.com/js/bundles/cookies.js
- n####.nl/static/vendor/fontawesome/fonts/fontawesome-webfont.ttf?v=####&...
- c####.####.org/2017-04-07/e22bf6793c5a89c7185a93ee5d1688b6.jpg!240
- n####.nl/static/img/atoms/images/logos/logosprite.svg?v=####
- api-ce####.####.org/v3/commentlist-46762469-517239576f2438a57722e2ccd7d0...
- c####.####.net/pixel?google_nid=####&google_cm=####&id=####&google_tc=####
- cloudfr####.####.com/x.png
- n####.nl/static/CACHE/js/e8c4579d66cc.js
- h####.com/css/fonts/roboto-v15-latin-500.ttf
- c6ba1cd####.####.com/58e6f86166f6003903b4fa41_500x281.jpg
- n####.nl/api/config/account_pages
- n####.nl/static/CACHE/js/a2c28962c5b1.js
- ab26251####.####.net/test.png
- n####.nl/adblock.html
- t####.####.com/sync?prtid=####&id=####&google_gid=####&google_cver=####
- s####.####.com/app/umeng?pid=####&dp=####&af=####&sk=####&cn=####&cv=####
- p####.####.com/sync/img?redir=####
- s####.####.com/c2/6035634/cs.js
- c####.####.nl/service/js/nunl/adblock/
- n####.nl/static/vendor/fontcustom/fonts/nunl_1077598ee2fd6b2c595b96bce22...
- pri####.####.nl/img/getoptin.gif?ord=####
- con####.####.net/nl_INF/sdk.js
- u####.####.com/usr?v=####&acc=####&upd=####&new=####&wst=####
- i####.####.com/s
- h####.com/js/jquery.js
- c####.####.nl/service/js/nunl/default/
- c####.####.org/2017-04-07/191d1a00e7dd0de1eaab0bdce8773ee9.jpg!240
- c####.####.org/2017-04-07/2829fef9a233d1f82cd9db4a8496dcbc.jpg!240
- t####.####.com/38645a54-e22a-423a-ac19-3d3ab0c47678?app_id=####&cid=####
- n####.nl/static/CACHE/css/b750e9df0fc7.css
- n####.nl/files/Adblock1.jpg
- pag####.####.com/pagead/js/r20170522/r20170110/show_ads_impl.js
- n####.nl/static/img/atoms/images/favicon/apple-touch-icon-57x57.png
- ce####.####.org/v3/system/initcountrytopic.json
- api-ce####.####.org/v2/content/getItemDetails-46762469.json
- t####.####.com/tm42098.js
- c####.####.com/tracking/adClick?d=####&ru=####&advId=####&clickId=####&s...
- ce####.####.org/v2/content/recommend-517239576f2438a57722e2ccd7d0c642-NL...
- c####.####.org/2017-04-07/4e6c470b403e19e0b41cc8aa09d273e6.jpg!240
- s####.####.fi/sat/sat.gif?log=####&evt=####&cid=####&c_ver=####&c_events...
- c####.####.org/v2/content/list-0-0-0-NL-1-0-1.json?1495016####
- c####.####.org/v2/system/startimg-NL.json
- c####.####.com/index.php?service=####&pub=####&offer_id=####&subpub=####
- a####.####.io/latest?base=####
- n####.nl/static/img/atoms/images/logos/logosprite_menu.svg?v=####
- a####.####.net/applnk/826227844?src_section_id=####
- pag####.####.com/pagead/js/adsbygoogle.js
- u####.####.com/req?v=####&upd=####&new=####&id=####&acc=####&tit=####
- n####.nl/api/playlists/slug/recommended?order_by=####
- c####.####.org/2017-04-07/753c1913748d9757d9dc0ed576919836.jpg!240
- c####.####.org/2017-04-07/1cb71f9632d61311e32d0e3eadb56699.jpg!240
- pri####.####.nl/pixel/u3Vi5ehmC00_Wq5dZuxHBnVe7m0M8RZYheFvMZx4yiY5X4dZ55...
- c####.####.org/v2/system/languages.json
- p####.####.com/sync/img?redir=####&mm####&mm####
- pri####.####.nl/script/consent.js
- pri####.####.nl/site/nu.nl/synchronize/MK62ZbK-sKJiv6MNEvDBnwWQYAfUzMN9n...
- n####.nl/static/CACHE/js/e11cc90777cc.js
- c####.####.org/2017-05-02/2ebaa8f725a065d5f5ed999cd137ceeb.jpg
- pri####.####.nl/script/cookiebar.js
- t####.####.com/agentapi/click?cid=####&aid=####&postbac####
- n####.nl/files/adblock3.jpg
- b####.####.com/b2?c1=####&c2=####&ns_site=####&nb_01=####&nb_02=####&nb_...
- c####.####.org/v2/content/article1-46762469-517239576f2438a57722e2ccd7d0...
- gl####.####.com/trace?offer_id=####&app_id=####&type=####&aff_sub=####
- c####.####.org/v2/system/models-96.json
- c####.####.com/js/4751656579.js
- c####.####.com/files/79e464325fa8c8cbe099fcdd523c9968
- c####.####.org/2017-04-07/4382b60753a80f6d3fb25f14ab04de59.jpg!240
- h####.com/css/partner-article.css?bust=####
- b####.####.nl/m/m1nx5sqrhbgz.png
- a####.####.com/api/s2s/goto?id=####&channel=####&provider=####&iid=####&...
- con####.####.net/connect/xd_arbiter/r/0F7S7QWJ0Ac.js?version=####
Запросы HTTP POST:
- a####.####.com/api/ads/fetch?_s=####
- a####.####.com/api/ads/connect
- ce####.####.org/auth/gather
- a####.####.com/ad-service/ad/mark
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_tmpdex/reach-sdk.zip
- <Package Folder>/app_417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFile.tmp
- <Package Folder>/shared_prefs/AppStore.xml.bak
- <Package Folder>/files/.yflurryfreqcap.-3604fbe1ac7f4f1c
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.fabric.sdk.android.Onboarding.xml
- <Package Folder>/databases/Zuoyoo_db
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/shared_prefs/Game_recommend.xml
- <Package Folder>/files/.yflurryreport.-3604fbe1ac7f4f1c
- <Package Folder>/databases/reach.database.ad-journal
- <Package Folder>/app_417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d/sessions/sessionFile
- <Package Folder>/files/.Fabric/io.fabric.sdk.android;fabric/com.crashlytics.settings.json
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/app_dex/reach-sdk.zip.tmp
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/Game_recommend.xml.bak
- <Package Folder>/files/.yflurryadlog.-3604fbe1ac7f4f1c
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/shared_prefs/updateVer.xml
- <Package Folder>/files/.jglogs/.jg.ic
- <Package Folder>/shared_prefs/Reach.xml
- <Package Folder>/shared_prefs/GATHER.xml
- <Package Folder>/shared_prefs/417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d.xml
- <Package Folder>/shared_prefs/Prophet.xml
- <Package Folder>/app_417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d/events/eventsFile
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/shared_prefs/com.facebook.sdk.appEventPreferences.xml
- <Package Folder>/shared_prefs/GATHER.xml.bak
- <Package Folder>/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
- <Package Folder>/databases/Zuoyoo_db-journal
- <Package Folder>/shared_prefs/MASTER_DATA.xml
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml
- <Package Folder>/files/AppEventsLogger.persistedevents
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/shared_prefs/v2_local_login.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/coolook.minisite.xml
- <Package Folder>/shared_prefs/com.amazonaws.android.auth.xml
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/files/.yflurrydatasenderblock.2f6d21a5-373a-44e8-bd2c-0659193b223f
- <Package Folder>/shared_prefs/com.google.android.gms.appid.xml
- <Package Folder>/shared_prefs/Reach.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/cache/webviewCacheChromium/f_000008
- <Package Folder>/cache/webviewCacheChromium/f_000016
- <Package Folder>/cache/webviewCacheChromium/f_000014
- <Package Folder>/cache/webviewCacheChromium/f_000015
- <Package Folder>/cache/webviewCacheChromium/f_000012
- <Package Folder>/cache/webviewCacheChromium/f_000013
- <Package Folder>/cache/webviewCacheChromium/f_000010
- <Package Folder>/cache/webviewCacheChromium/f_000011
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/cache/webviewCacheChromium/f_00000a
- <Package Folder>/cache/webviewCacheChromium/f_00000c
- <Package Folder>/cache/webviewCacheChromium/f_00000b
- <Package Folder>/app_417b80da20024fb78c8de7fd6feddb7f515d6767-01b7-49e5-8273-c8d11b0f331d/validatorFile
- <Package Folder>/cache/webviewCacheChromium/f_00000d
- <Package Folder>/app_dex/reach-sdk.zip
- <Package Folder>/cache/webviewCacheChromium/f_00000f
- <Package Folder>/cache/webviewCacheChromium/f_00000e
- <Package Folder>/shared_prefs/com.facebook.sdk.attributionTracking.xml
- <Package Folder>/shared_prefs/BSModelForPlaced.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/test.xml
- <Package Folder>/cache/webviewCacheChromium/f_000009
- <Package Folder>/shared_prefs/CurArticleInfo.xml
- <Package Folder>/databases/google_app_measurement_local.db
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/cache/webviewCacheChromium/f_000003
- <Package Folder>/cache/webviewCacheChromium/f_000002
- <Package Folder>/cache/webviewCacheChromium/f_000005
- <Package Folder>/cache/webviewCacheChromium/f_000004
- <Package Folder>/cache/webviewCacheChromium/f_000007
- <Package Folder>/cache/webviewCacheChromium/f_000006
- <Package Folder>/shared_prefs/CountryRelevant.xml
- <Package Folder>/no_backup/com.google.android.gms.appid-no-backup
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/databases/google_app_measurement_local.db-journal
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_XS7MGCQYH4WTKK82VNTC_216
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Другие:
Запускает следующие shell-скрипты:
- chmod 755 /data/data/####/.jiagu/libjiagu.so
- <dexopt>
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Использует специальную библиотеку для скрытия исполняемого байткода.
Может автоматически отправлять СМС-сообщения.
