Android.DownLoader.3049

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Backdoor.433.origin
Android.Backdoor.433.origin

Загружает из Интернета следующие детектируемые угрозы:

Android.Backdoor.433.origin
Android.Backdoor.433.origin

Сетевая активность:

Подключается к:

amap####.####.com
c####.####.com
p####.####.com
p####.####.com:6088
up####.####.cn

Запросы HTTP GET:

amap####.####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
c####.####.com/s?v####
p####.####.com/c/1496215261206

Запросы HTTP POST:

p####.####.com:6088/s/
up####.####.cn/v1/push/sdk/postlist

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_jgls/.log.lock
<Package Folder>/app_jgls/.log.ls
<Package Folder>/app_uwmalo/C545F4F27C8123C17820470644C46C09.jar
<Package Folder>/cache/####/journal
<Package Folder>/databases/hmdb
<Package Folder>/databases/hmdb-journal
<Package Folder>/databases/jpush_local_notification.db
<Package Folder>/databases/jpush_local_notification.db-journal
<Package Folder>/databases/jpush_local_notification.db-wal
<Package Folder>/databases/jpush_statistics.db
<Package Folder>/databases/jpush_statistics.db-journal
<Package Folder>/databases/jpush_statistics.db-shm (deleted)
<Package Folder>/databases/jpush_statistics.db-wal
<Package Folder>/databases/jpush_statistics.db-wal (deleted)
<Package Folder>/databases/logdb.db
<Package Folder>/databases/logdb.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/69114225798503.0
<Package Folder>/files/####/journal
<Package Folder>/files/####/journal.tmp
<Package Folder>/files/####/libwgs2gcj.so
<Package Folder>/files/appPackageNames
<Package Folder>/files/ivzzyr
<Package Folder>/files/jpush_stat_cache.json
<Package Folder>/files/jpush_stat_cache_history.json
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/JPushSA_Config.xml
<Package Folder>/shared_prefs/JPushSA_Config.xml.bak
<Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml
<Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml.bak
<Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml.bak (deleted)
<Package Folder>/shared_prefs/cn.jpush.preferences.v2.rid.xml
<Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml
<Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml.bak
<Package Folder>/shared_prefs/disk_entries_list_ImagePipelineCacheDefault_-1385813832.xml
<Package Folder>/shared_prefs/disk_entries_list_ImagePipelineCacheSmall_-966125250.xml
<Package Folder>/shared_prefs/jpush_device_info.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/pref.xml
<SD-Card>/Android/####/adv
<SD-Card>/Android/####/config
<SD-Card>/Android/####/deviceId
<SD-Card>/Android/####/hwh.nomedia
<SD-Card>/Android/####/master
<SD-Card>/Android/####/master.lock
<SD-Card>/Android/####/sys_install
<SD-Card>/amap/####/alsn.db
<SD-Card>/amap/####/alsn.db-journal
<SD-Card>/data/.push_deviceid