Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Spy.165.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Spy.165.origin
Сетевая активность:
Подключается к:
- 1####.####.161
- 2####.####.214
- a####.####.cn
- a####.####.com
- a####.####.net
- api####.####.com
- m####.####.cn
- r####.####.net
- res####.####.com
- s####.####.net
- t####.####.net
- w####.com
- web####.####.com
Запросы HTTP GET:
- 1####.####.161/wb/qq%E9%9D%93%E5%8F%B7%E8%BF%9C%E7%A8%8B/QQ8%E4%BD%8D.txt
- 2####.####.214/action/pop_ad/ad?app_id=####&udid=####&imsi=####&net=####...
- a####.####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=...
- a####.####.net/banner/v4/req?s=####
- a####.####.net/offer/dist/aos/pkg/2.6.1/offers_2.6.1.zip
- a####.####.net/v3/get?s=####
- m####.####.cn/qxrj666?is_all=####&jumpfrom=####&is_all=####
- r####.####.net/spot/aos/v2/reqv3?s=####
- s####.####.net/stat/aos/v3/pku?s=####
- w####.com/qxrj666?is_all=####
- web####.####.com/appmaptile?z=####&x=####&y=####&lang=####&size=####&sca...
Запросы HTTP POST:
- a####.####.com/app_logs
- api####.####.com/v3/log/init
- res####.####.com/v3/log/init
- t####.####.net/v1/android/packages?rt=####&sign=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/anr/traces.txt
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/app_cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/cache/####/WebpageIcons.db-journal
- <Package Folder>/cache/####/WebpageIcons.db-journal (deleted)
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/54153b11cdd78a56dcc297012d86c83d
- <Package Folder>/databases/54153b11cdd78a56dcc297012d86c83d-journal
- <Package Folder>/databases/577e11f2fb01dac96d1ed9f905a12b47
- <Package Folder>/databases/577e11f2fb01dac96d1ed9f905a12b47-journal
- <Package Folder>/databases/OxgHkj2lz09F
- <Package Folder>/databases/OxgHkj2lz09F-journal
- <Package Folder>/databases/P15pKIjsm64m
- <Package Folder>/databases/P15pKIjsm64m-journal
- <Package Folder>/databases/T1oX0rhhuXWt
- <Package Folder>/databases/T1oX0rhhuXWt-journal
- <Package Folder>/databases/XKwVoK0huy3R
- <Package Folder>/databases/XKwVoK0huy3R-journal
- <Package Folder>/databases/be07be6bcc763165b527d4c9bbf8ffc0-journal
- <Package Folder>/databases/jqIqJYOT3JpT
- <Package Folder>/databases/jqIqJYOT3JpT-journal
- <Package Folder>/databases/wIU6pTyUBYWX
- <Package Folder>/databases/wIU6pTyUBYWX-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/wsUL1uCdKvjD
- <Package Folder>/databases/wsUL1uCdKvjD-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/arrow-left.png
- <Package Folder>/files/####/arrow-right.png
- <Package Folder>/files/####/blank.gif
- <Package Folder>/files/####/close-icon.png
- <Package Folder>/files/####/default.png
- <Package Folder>/files/####/detail-wx.html
- <Package Folder>/files/####/detail-wx.js
- <Package Folder>/files/####/detail.html
- <Package Folder>/files/####/detail.js
- <Package Folder>/files/####/feedback.html
- <Package Folder>/files/####/feedback.js
- <Package Folder>/files/####/form.css
- <Package Folder>/files/####/global.js
- <Package Folder>/files/####/lists.css
- <Package Folder>/files/####/lists.html
- <Package Folder>/files/####/lists.js
- <Package Folder>/files/####/md5.js
- <Package Folder>/files/####/pic_m.png
- <Package Folder>/files/####/pic_tips_01.png
- <Package Folder>/files/####/pic_tips_02.png
- <Package Folder>/files/####/result.png
- <Package Folder>/files/####/rule.html
- <Package Folder>/files/####/sdetail.html
- <Package Folder>/files/####/share.css
- <Package Folder>/files/####/share.html
- <Package Folder>/files/####/share.js
- <Package Folder>/files/####/sprite-face.png
- <Package Folder>/files/####/sprite-icons.png
- <Package Folder>/files/####/sprite-icons2.png
- <Package Folder>/files/####/wx-step1.jpg
- <Package Folder>/files/####/wx-step2.jpg
- <Package Folder>/files/####/wx-step3.jpg
- <Package Folder>/files/####/wx-step4.jpg
- <Package Folder>/files/####/wx-step5.jpg
- <Package Folder>/files/.imprint
- <Package Folder>/files/CacheTime.dat
- <Package Folder>/files/c52c9c9407a5b664fd0851ec842d14b7.zip
- <Package Folder>/files/libjiagu.so
- <Package Folder>/files/mobclick_agent_cached_<Package>21
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/AppSettings.xml
- <Package Folder>/shared_prefs/C306239E75034d979DB1957AC06E4612.xml (deleted)
- <Package Folder>/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
- <Package Folder>/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml.bak (deleted)
- <Package Folder>/shared_prefs/OFFERSCONFIG1.xml
- <Package Folder>/shared_prefs/PaySettings.xml
- <Package Folder>/shared_prefs/ShowAdFlag.xml
- <Package Folder>/shared_prefs/com.e4a.runtime.android.mainActivity.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/last_know_location.xml
- <Package Folder>/shared_prefs/spotData.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/Amap/####/10_6_3.dat
- <SD-Card>/Amap/####/10_6_3.idx
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/2ad6ca58194518ff5d5c2bc369e3f78b
- <SD-Card>/Android/####/2ad6ca58194518ff5d5c2bc369e3f78bb
- <SD-Card>/Android/####/373240561418738c721572c1da14b85e
- <SD-Card>/Android/####/373240561418738c721572c1da14b85e.ymtf
- <SD-Card>/Android/####/AppPackage.dat
- <SD-Card>/Android/####/CacheTime.dat
- <SD-Card>/Android/####/UnPackage.dat
- <SD-Card>/Android/####/android
- <SD-Card>/Android/####/i42d45df023jnkdd93la483f9xGFKXI
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Android/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
Другие:
Запускает следующие shell-скрипты:
- chmod 755 /data/data/com.qqlh/files/libjiagu.so
- chmod 755 <Package Folder>/files/libjiagu.so
Использует специальную библиотеку для скрытия исполняемого байткода.
