Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- a####.####.com
- a####.####.net
- d####.####.cn
- daisyf####.####.com
- f####.####.com
- s####.####.com
- un####.####.com
- w####.####.com
Запросы HTTP GET:
- a####.####.com/v3/api/nativeads?&publisherid=####&slotid=####&lang=####&...
- a####.####.net/api/v2/track?tokenid=####&imei=####&event=####&referrer=#...
- d####.####.cn/jarFile/SDKAutoUpdate/hyjwan.jar
- daisyf####.####.com/images/2016081820491788608.jpg
- f####.####.com/ipcity.php
- f####.####.com/store_home.php?vcode=####&lang=####&w=####&UID=####
- s####.####.com/b/?action=####&mid=####
- un####.####.com/b/?action=####&postype=####&mid=####&posid=####&cver=###...
- w####.####.com/api/v1/weather?lat=####&lon=####&lang=####&appid=####&tok...
Запросы HTTP POST:
- a####.####.com/ad-service/ad/mark
- s####.####.com/cw/cp.action?requestId=####&g=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/cache/####/0a7d400b10fd8f1ed981799b242d63be.0.tmp
- <Package Folder>/cache/####/0a7d400b10fd8f1ed981799b242d63be.1.tmp
- <Package Folder>/cache/####/1ccc0152080fe352c9d6ec14774e97be.0.tmp
- <Package Folder>/cache/####/1ccc0152080fe352c9d6ec14774e97be.1.tmp
- <Package Folder>/cache/####/2e7a52be1370ccf3a2099dfdf22d3f86.0.tmp
- <Package Folder>/cache/####/2e7a52be1370ccf3a2099dfdf22d3f86.1.tmp
- <Package Folder>/cache/####/402f7a44dadfa9ac68f0520a0d21e1a9.0.tmp
- <Package Folder>/cache/####/402f7a44dadfa9ac68f0520a0d21e1a9.1.tmp
- <Package Folder>/cache/####/5237439d4e94c8d43314c996a2f00a47.0.tmp
- <Package Folder>/cache/####/5237439d4e94c8d43314c996a2f00a47.1.tmp
- <Package Folder>/cache/####/5987f90950c6f52210ba2a973f7a0a42.0.tmp
- <Package Folder>/cache/####/5987f90950c6f52210ba2a973f7a0a42.1.tmp
- <Package Folder>/cache/####/615aa39094903b0cb8e33ed1f944a486.0.tmp
- <Package Folder>/cache/####/615aa39094903b0cb8e33ed1f944a486.1.tmp
- <Package Folder>/cache/####/86584cfe4d3996d2c73c45cfcc23d6ee.0.tmp
- <Package Folder>/cache/####/86584cfe4d3996d2c73c45cfcc23d6ee.1.tmp
- <Package Folder>/cache/####/a327b5ddf3b90f49a2d73f3ff0a23d29.0.tmp
- <Package Folder>/cache/####/a327b5ddf3b90f49a2d73f3ff0a23d29.1.tmp
- <Package Folder>/cache/####/bfb6ca884fc311326cd0d3cd918eb49b.0.tmp
- <Package Folder>/cache/####/bfb6ca884fc311326cd0d3cd918eb49b.1.tmp
- <Package Folder>/cache/####/c8eaeffe551b810bb22643a224ef88cf.0.tmp
- <Package Folder>/cache/####/c8eaeffe551b810bb22643a224ef88cf.1.tmp
- <Package Folder>/cache/####/e4d844661e631b8b85f318aa8c9fa8ac.0.tmp
- <Package Folder>/cache/####/e4d844661e631b8b85f318aa8c9fa8ac.1.tmp
- <Package Folder>/cache/####/eb2d233260d2e860193f64d730e85d8e.0.tmp
- <Package Folder>/cache/####/eb2d233260d2e860193f64d730e85d8e.1.tmp
- <Package Folder>/cache/####/f394375667d7968dc22145e62e1dd8ca.0.tmp
- <Package Folder>/cache/####/f394375667d7968dc22145e62e1dd8ca.1.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/dmc_report-journal
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/receiver_history_list.dat
- <Package Folder>/files/INSTALLATION
- <Package Folder>/files/gaClientId
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/<Package>_sdk_preferences.xml
- <Package Folder>/shared_prefs/<Package>_sdk_preferences.xml.bak
- <Package Folder>/shared_prefs/<Package>_sp.xml
- <Package Folder>/shared_prefs/<Package>_sp.xml.bak
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/IST.xml
- <Package Folder>/shared_prefs/IST.xml.bak
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/W_Key.xml.bak
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/cmadsdk_2023.xml
- <Package Folder>/shared_prefs/cmadsdk_2023.xml.bak
- <Package Folder>/shared_prefs/com.facebook.ads.FEATURE_CONFIG.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- <Package Folder>/shared_prefs/dmc_default.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/market_config.xml
- <Package Folder>/shared_prefs/market_config.xml.bak
- <Package Folder>/shared_prefs/mul_widget.xml
- <Package Folder>/shared_prefs/mul_widget.xml.bak
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/widget_mul_store.xml
- <SD-Card>/.xy
- <SD-Card>/Download/####/4.3_hyjwan.jar
- <SD-Card>/amber widgets/mul_widget_config.amber
- <SD-Card>/dt/restime.dat
Другие:
Запускает следующие shell-скрипты:
- /data/data/com.chenhui.tianqipindao/app_bin/watcher -p com.chenhui.tianqipindao -b 1 -u http://www.surveygizmo.com/s3/3191047/mul-widget-uninstall-survey
- <dexopt>
- chmod 755 /data/data/com.chenhui.tianqipindao/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- ls -l /system/bin/su
Использует специальную библиотеку для скрытия исполняемого байткода.
