Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.84.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.84.origin
Сетевая активность:
Подключается к:
- 7j####.####.com
- c####.####.com
- c-h####.####.com
- f####.####.com
- p####.####.com
- s####.####.com
Запросы HTTP GET:
- 7j####.####.com/tdata_CgN316
- c####.####.com/app/forums/android/v3.2/chat-faces-mareacode-999999.html
- f####.####.com/ma~39_20170602095100_5930c484152a9.png
- p####.####.com/cloud.php?act=####&rectime=####&appid=####&uid=####&flag=...
- s####.####.com/config/hz-hzv3.conf
Запросы HTTP POST:
- c-h####.####.com/api.php?format=####&t=####
- s####.####.com/api.php?format=####&t=####
- s####.####.com/trace/com.m4399.gamecenter/1.0/360/1100f0NHPuFAqyJJ49Pp17...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_dex/####/libm4399opus.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/####/5910467b0bdee90af4a349d668175eeed904dcbf6a372cd704004c5ddfdf7f28.0.tmp
- <Package Folder>/cache/####/63c07183d17acc54c173e396b3ee8c93031634bd38e5d5ce7b3efbd5e846fd39.0.tmp
- <Package Folder>/cache/####/876a89c8ba1ed775215501eeee76627deb0de8b02bbd9ef6de73064e45025d6a.0
- <Package Folder>/cache/####/91fbedadf9832ff2894c9b4a4ed2ed5f6d1b394ecde0ccbf9bd80eb2fc34f7cf.0.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/cache/.test.txt
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/downloads.db-journal
- <Package Folder>/databases/framework.db-journal
- <Package Folder>/databases/gamecenter.db-journal
- <Package Folder>/databases/pushg.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/<Package>.plugin.main.apk
- <Package Folder>/files/####/<Package>.plugin.media.apk
- <Package Folder>/files/####/pref.app.covers.pt
- <Package Folder>/files/####/pref.headup.message.chat.unread.pt
- <Package Folder>/files/####/pref.local.delete.file.path.pt
- <Package Folder>/files/####/pref.local.plugin.models.pt
- <Package Folder>/files/####/push.jar
- <Package Folder>/files/.policy
- <Package Folder>/files/init.pid
- <Package Folder>/files/init_c.pid
- <Package Folder>/files/m4399AppEmoji3.0.json
- <Package Folder>/files/m4399BBSEmoji3.0.json
- <Package Folder>/files/mobclick_agent_cached_<Package>1156
- <Package Folder>/files/push.pid
- <Package Folder>/files/push.zip
- <Package Folder>/files/run.pid
- <Package Folder>/files/tdata_CgN316
- <Package Folder>/files/tdata_CgN316.jar
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak (deleted)
- <Package Folder>/shared_prefs/MyAnalytics_VERSION_INFO.xml
- <Package Folder>/shared_prefs/MyAnalytics_device_id.xml
- <Package Folder>/shared_prefs/MyAnalytics_general_config.xml
- <Package Folder>/shared_prefs/MyAnalytics_general_config.xml.bak
- <Package Folder>/shared_prefs/MyAnalytics_send_config.xml
- <Package Folder>/shared_prefs/UserInfo.xml
- <Package Folder>/shared_prefs/UserInfo.xml.bak
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/push_box_sdk_version.xml
- <Package Folder>/shared_prefs/skin_main_plugin_pref.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.disys
- <SD-Card>/.ssjjsy/####/<Package>.sdklogin
- <SD-Card>/.test.txt
- <SD-Card>/.udid
- <SD-Card>/libs/<Package>.db
- <SD-Card>/libs/app.db
- <SD-Card>/libs/com.igexin.sdk.deviceId.db
- <SD-Card>/system/####/tdata_CgN316
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- chmod 755 /data/data/com.m4399.gamecenter/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- dmesg
- getprop
- grep -i blueStacks
- grep -i virtualbox
- ls /system/bin
- ls /system/lib
- sh
Использует специальную библиотеку для скрытия исполняемого байткода.
