Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.84.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.84.origin
Сетевая активность:
Подключается к:
- a####.####.com
- c####.####.com
- guaguaz####.####.com
- m####.####.cn
- n####.####.com
- s####.####.cn
- s####.####.com
- ser####.####.cn
Запросы HTTP GET:
- c####.####.com/jquery/2.1.4/jquery.min.js
- guaguaz####.####.com/article/images/medal_gold_1.png
- m####.####.cn/mmbiz_jpg/hHCgRL19ZjRtEOV4HSr9sn19T2E3RJbUKDicjKiaBibtCpmU...
- s####.####.com/app-share/resources/js/aarticle.js?v=####
Запросы HTTP POST:
- a####.####.com/app_logs
- a####.####.com/data2
- a####.####.com/errconf
- n####.####.com/navipush.json
- s####.####.cn/v2/report
- ser####.####.cn/app-http/api
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/index
- <Package Folder>/databases/ThrowalbeLog.db-journal
- <Package Folder>/databases/ggz.db-journal
- <Package Folder>/databases/jpush_local_notification.db
- <Package Folder>/databases/jpush_local_notification.db-journal
- <Package Folder>/databases/jpush_statistics.db
- <Package Folder>/databases/jpush_statistics.db-journal
- <Package Folder>/databases/reqinfo.db
- <Package Folder>/databases/reqinfo.db-journal
- <Package Folder>/databases/sharesdk.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/.imprint
- <Package Folder>/files/.lock
- <Package Folder>/files/jpush_stat_cache_history.json
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/COUNTLY_STORE.xml
- <Package Folder>/shared_prefs/RongPush.xml
- <Package Folder>/shared_prefs/RongPush.xml.bak
- <Package Folder>/shared_prefs/SDK20161206120457d3d38wr3almuw88.xml
- <Package Folder>/shared_prefs/SharedPreferences_ruit.xml
- <Package Folder>/shared_prefs/SharedPreferences_ruit.xml.bak
- <Package Folder>/shared_prefs/Statistics.xml
- <Package Folder>/shared_prefs/Statistics.xml.bak
- <Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml
- <Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml.bak
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml.bak
- <Package Folder>/shared_prefs/jpush_device_info.xml
- <Package Folder>/shared_prefs/mob_sdk_exception_1.xml
- <Package Folder>/shared_prefs/mob_sdk_exception_1.xml.bak
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/share_sdk_1.xml
- <Package Folder>/shared_prefs/share_sdk_1.xml (deleted)
- <Package Folder>/shared_prefs/share_sdk_1.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/Mob/####/.lock
- <SD-Card>/ShareSDK/.ba
- <SD-Card>/ShareSDK/.dk
- <SD-Card>/data/.push_deviceid
- <SD-Card>/guaguazhuan/####/02761bcbee98d8d2db8305498f784a31.0
- <SD-Card>/guaguazhuan/####/0a5cdc3539a3a687f9c0c4d5fd0f740e.0
- <SD-Card>/guaguazhuan/####/1202bd0b0e5275fa42a5fc003bf95ef3.0
- <SD-Card>/guaguazhuan/####/18e7d27447cdc38d87303684b8ee1265.0
- <SD-Card>/guaguazhuan/####/1cf538a91b1c991ca7846d2467b73c50.0
- <SD-Card>/guaguazhuan/####/242a41b54864e55b5baf5d05e5d660ef.0
- <SD-Card>/guaguazhuan/####/3150afb3460304c08e8a41e750ae3deb.0
- <SD-Card>/guaguazhuan/####/3180ded40d369913eabb4937624d1df9.0
- <SD-Card>/guaguazhuan/####/34a77fd222bfc73e9b9a9417c347b8ee.0
- <SD-Card>/guaguazhuan/####/36e8e8909177dda635550fc22eea1518.0
- <SD-Card>/guaguazhuan/####/3ba4d4b0259ef8546fc545457bff0e6b.0.tmp (deleted)
- <SD-Card>/guaguazhuan/####/426e39097d4d8baba036de082b0b6dfc.0
- <SD-Card>/guaguazhuan/####/453373d5c26b3ff750f999705293e279.0
- <SD-Card>/guaguazhuan/####/4b0fff893986c18ebfde41c3e8778dc2.0
- <SD-Card>/guaguazhuan/####/51139366d1d57a838e9022243abafdb3.0
- <SD-Card>/guaguazhuan/####/5498819dfd27e532c9c772ceb88321b5.0
- <SD-Card>/guaguazhuan/####/59fdb66bc4bab657c770e65642d5bcfb.0.tmp (deleted)
- <SD-Card>/guaguazhuan/####/6aa103d9b45426a0017cf1816938b4d8.0.tmp (deleted)
- <SD-Card>/guaguazhuan/####/71285057d7fe500a8ea6696183f37dc8.0
- <SD-Card>/guaguazhuan/####/771001f3be93db8e8079a8666a9297b4.0
- <SD-Card>/guaguazhuan/####/7ba3611d7406376c3028c3f60b326c78.0
- <SD-Card>/guaguazhuan/####/87a9bdf06830adea000305c17d400373.0
- <SD-Card>/guaguazhuan/####/8a70d10774c8b74e52e3328c8cd8322b.0
- <SD-Card>/guaguazhuan/####/8c27a0f7f927865272f982d8f3db1c54.0
- <SD-Card>/guaguazhuan/####/95723b28064a1a16c9659254646c2c5e.0
- <SD-Card>/guaguazhuan/####/a41194a3e2c6f2a2d2e3ddd1829125d1.0
- <SD-Card>/guaguazhuan/####/a6f94c89c93c7390ad2314d5f605d3c9.0
- <SD-Card>/guaguazhuan/####/b1326fec1a885a282dc9b0310164587c.0
- <SD-Card>/guaguazhuan/####/b28c7166a91c0719b2e6f41537ac8033.0
- <SD-Card>/guaguazhuan/####/b5f12f3704253fa1fc5d0264d9082fb2.0
- <SD-Card>/guaguazhuan/####/c08cca4ca3c91d9679ad8edae3bde1cc.0
- <SD-Card>/guaguazhuan/####/c68f1a1f19bbcc6da34f6b5b21c14719.0
- <SD-Card>/guaguazhuan/####/c8acf59b56b6abbd493594dd9d8625c8.0
- <SD-Card>/guaguazhuan/####/cab73d646eb7a7ffd8fbb2b0ec60bee3.0
- <SD-Card>/guaguazhuan/####/cf2563913fea11cd222fbeb485d6774a.0
- <SD-Card>/guaguazhuan/####/d3c7bb96dbad06936f1d457d4475bb37.0
- <SD-Card>/guaguazhuan/####/d5c26d1627237575fcdb8d134223ff08.0.tmp (deleted)
- <SD-Card>/guaguazhuan/####/dbbb2256b04cdb0091f8d8c79ab76184.0
- <SD-Card>/guaguazhuan/####/e7d41ebd0744d51b793f6668fa975388.0
- <SD-Card>/guaguazhuan/####/ec2e62784b455439dcaf670b1c2ca689.0
- <SD-Card>/guaguazhuan/####/ed29022db6b09fa05bfdbf7bf633b27e.0.tmp (deleted)
- <SD-Card>/guaguazhuan/####/f1125b10e9fc70c920cd44890c0102bc.jpg
- <SD-Card>/guaguazhuan/####/f22e2fbfd1dd265a1f3feeedfa9a2351.0
- <SD-Card>/guaguazhuan/####/f7e679c2f3e768a75c48fc0cc8ae8503.0
- <SD-Card>/guaguazhuan/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- chmod 755 /data/data/cc.ruit.guaguazhuan/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Использует специальную библиотеку для скрытия исполняемого байткода.
