Техническая информация
Вредоносные функции:
Отправляет СМС-сообщения:
- 10690133603: auto##0092533314##mpc_yxhezi_and_200253741##该短信用于360游戏注册/登录
Сетевая активность:
Подключается к:
- a####.####.cn
- a####.####.com
- and####.####.com
- d####.####.com:8083
- m####.####.cn
- ope####.####.cn
- p####.####.cn
- p####.####.com
- s####.####.cn
- sh####.####.com
Запросы HTTP GET:
- a####.####.cn/10/popup/notice?appid=####&nonce=####&rkey=####&signid=####
- and####.####.com/group/?method=####&n=####
- m####.####.cn/list/get?product=####&source=####&version=####
- ope####.####.cn/index/upgrade?package=####&version=####&apk_version=####...
- p####.####.com/t0174936816868190aa.jpg
- p####.####.com/t0178c548e210e9c425.png
- s####.####.cn/ak/02522a2b2726fb0a03bb19f2d8d9524d.html?m2=####
- sh####.####.com/160422/57b92647917cce029e2634ba82d77e69/libpatch.so
Запросы HTTP POST:
- a####.####.com/ad-service/ad/mark
- d####.####.com:8083/
- p####.####.cn/pstat/plog.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/9e321132b5fd45e1e7a38f5d185d2066_pic
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/QHA_JSON_PERSISTER_02522a2b2726fb0a03bb19f2d8d9524d
- <Package Folder>/files/####/Y29tLmltb2QzNjA=.tick.lock
- <Package Folder>/files/####/pvpjh1.dat
- <Package Folder>/files/####/pvpjh2.dat
- <Package Folder>/files/####/pvpjh3.dat
- <Package Folder>/files/####/pvpjh4.dat
- <Package Folder>/files/####/pvpjh5.dat
- <Package Folder>/files/frameso
- <Package Folder>/files/statistics.log (deleted)
- <Package Folder>/libs/####/libpatch
- <Package Folder>/libs/####/libpatch1
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/Pay_config.xml
- <Package Folder>/shared_prefs/QH_DeviceSDK.xml
- <Package Folder>/shared_prefs/QH_SDK_M2.xml
- <Package Folder>/shared_prefs/QH_SDK_UserData.xml
- <Package Folder>/shared_prefs/QH_SDK_UserData.xml.bak
- <Package Folder>/shared_prefs/QH_SDK_UserData02522a2b2726fb0a03bb19f2d8d9524d.xml
- <Package Folder>/shared_prefs/QH_SDK_UserData02522a2b2726fb0a03bb19f2d8d9524d.xml.bak
- <Package Folder>/shared_prefs/QH_SDK_sessionID.xml
- <Package Folder>/shared_prefs/QH_SDK_sessionID.xml.bak
- <Package Folder>/shared_prefs/WukongSDKPre.xml
- <Package Folder>/shared_prefs/coolcloud_config.xml
- <Package Folder>/shared_prefs/gamecenter_sdk_plugin_pre.xml
- <Package Folder>/shared_prefs/gamecenter_sdk_plugin_pre.xml.bak
- <Package Folder>/shared_prefs/iapppay_config.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/q_p2_plib_plugin_lib_sp.xml
- <Package Folder>/shared_prefs/qh_login_cfg.xml
- <Package Folder>/shared_prefs/qh_login_cfg.xml.bak
- <Package Folder>/shared_prefs/qihoo_hosts_cfg.xml
- <Package Folder>/shared_prefs/qihoo_hosts_cfg.xml.bak
- <Package Folder>/shared_prefs/qihoo_https_cer_pre.xml
- <Package Folder>/shared_prefs/qihoo_https_cer_pre.xml.bak
- <Package Folder>/shared_prefs/qlocal_float_sdk_share_preference.xml
- <Package Folder>/shared_prefs/qlocal_float_sdk_share_preference.xml.bak
- <Package Folder>/shared_prefs/sdk_apk_info.xml
- <Package Folder>/shared_prefs/share_data_updatesdk.xml
- <Package Folder>/update.qh
- <SD-Card>/360/####/02522a2b2726fb0a03bb19f2d8d9524d
- <SD-Card>/360/####/8sg
- <SD-Card>/360/####/8sg (deleted)
- <SD-Card>/360/####/Y29tLmltb2QzNjA=
- <SD-Card>/360/####/Y29tLmltb2QzNjA= (deleted)
- <SD-Card>/360/####/dcsdid.dat
- <SD-Card>/360/.deviceId
- <SD-Card>/360Download/libpatch.so
- <SD-Card>/360Download/libpatch1.so
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/2srnjblqxn03998ej90uotas2.0.tmp
- <SD-Card>/Android/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- chmod 755 /data/data/com.imod360/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 777 /storage/emulated/0/360gamecentersdk/.cache/image
Использует специальную библиотеку для скрытия исполняемого байткода.
