Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Loki.10.origin
- Android.Loki.15.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Loki.10.origin
- Android.Loki.15.origin
Сетевая активность:
Подключается к:
- 6####.####.129
- a####.####.com
- a####.####.net
- a####.####.org
- b####.####.com
- b####.####.net
- bidd####.####.net
- c####.####.com
- c####.####.net
- d####.####.com
- d####.####.net
- es-nets####.####.tv
- exelate####.####.net
- g####.####.com
- ge####.####.com
- gl####.####.com
- i####.####.com
- id####.####.com
- j####.####.com
- j####.####.com:8888
- l####.####.com
- lo####.####.com
- m####.####.com
- m####.####.org
- mo####.####.com
- mobilev####.####.com
- mw####.####.com
- p####.####.com
- pl####.####.com
- r####.####.com
- rtb-c####.####.com
- s####.####.com
- s####.####.tv
- se####.####.com
- sfil####.####.net
- startap####.com
- stats####.####.net
- t####.####.com
- tr####.####.com
- trac####.####.com
- trk-eu####.####.com
- u####.####.com
- u####.####.net
- videolo####.####.com
- view####.com
- w####.####.com
- x####.####.io
Запросы HTTP GET:
- 6####.####.129/tracking/adClose?d=####&clientSessionId=####&displayDurat...
- a####.####.com/fam/view.php?p=__pid####
- a####.####.com/match?external_user_id=####&publisher_dsp_id=####&r=####
- a####.####.com/user-registering?dataProviderId=####&userId=####&redirect...
- a####.####.net/sync?type=####&dsp=####&uuid=####&dspuuid=####
- a####.####.net/thirdparty/click?p=####
- a####.####.org/op?platform=####&os_version=####&package_name=####&app_ve...
- b####.####.com/p?c1=####&c2=####&ns_type=####&ns_st_sv=####&ns_st_it=###...
- b####.####.net/xbbe/match/smartclip?scid=####
- bidd####.####.net/rtb/UjpvcGVyYTpvcGVyYTpTZVF2RnM6U2VRdkZzOlNlUXZGczowNj...
- c####.####.com/20152/084522708637019342275474662836826051317851469897601...
- c####.####.com/default/Pix-1x1.gif
- c####.####.net/assets/9999999/blank.gif
- c####.####.net/cs?partnerId=####&partnerUserId=####&redirect=####
- c####.####.net/pixel?google_nid=####&google_hm=####&google_redir=####
- c####.####.net/serving/cookie/match/?party=####&id=####
- d####.####.com/8bf33fe57526aec8/sync.gif?fck=####&cbk=####
- d####.####.com/cookie/?ssp=####&cburl=####
- d####.####.com/getuid/smartclip?uuid=####
- d####.####.com/image/fetch/f_auto,q_80,w_84,h_84/http%3A%2F%2Flh3.google...
- d####.####.com/r/du/id/L2NzaWQvMS9tcGlkLzMxODMxNDE0/mpuid/2231e974-907e-...
- d####.####.net/ads?t=####&p=####&pl=####&cat=####&sz=####&rnd=####&cbb=#...
- d####.####.net/demconf.jpg?et:ibs%7cdata:dpid=####&dpuuid=####&redir=####
- es-nets####.####.tv/proxy/distributor/v2?s=####&tt=####&rt=####&rnd=####...
- exelate####.####.net/syncuid?dpid=####&o=####&uid=####
- g####.####.com/api/adserver/tag?AV_PUBLISHERID=####&AV_CHANNELID=####&AV...
- ge####.####.com/v1/map/e1b53c77d4e8a4bc/a4d3f61f-2fb8-4abb-a186-42da37c0...
- gl####.####.com/image.sbix?go=####&pid=####&xid=####
- i####.####.com/1.4/getadsmetadata?publisherId=####&productId=####&os=###...
- i####.####.com/InApp/resources/info_l.png
- id####.####.com/367028.gif?partner_uid=####
- j####.####.com/operah98324095809234/moatframe.js
- j####.####.com:8888/rule?p=####
- l####.####.com/pixel.gif
- lo####.####.com/load/?p=####&g=####&j=####
- m####.####.com/smartclipmatch?uuid=####
- m####.####.org/track/cmb/generic?ttd_pid=####&ttd_tpi=####&ttd_puid=####
- mo####.####.com/test/fingerprint_modified.js
- mobilev####.####.com/20152/084522708637019342275474662836826051317851469...
- mw####.####.com/mw?cid=####&zpartnerid=####&ztid=####&zts=####&zimpr=###...
- p####.####.com/sync/smartx/4e9d9bee-3975-4e6c-87d6-ffcf9cd07fcb
- pl####.####.com/script/5/SDK2.js
- r####.####.com/1.4/getads?publisherId=####&productId=####&os=####&sdkVer...
- r####.####.com/delivery/sync/855?id=####
- r####.####.com/ppm.ashx?mt=####&pid=####&xf=####&amtype=####&ap=####&ran...
- r####.####.com/r/bd?ddc=####&pid=####&uid=####
- rtb-c####.####.com/redir/?partnerid=####&partneruserid=####&redirurl=####
- s####.####.com/GenericUserSync.ashx?dpid=####&pid=####
- s####.####.com/P-KBimcgrdQj/dmp.gif?rtbuid=####&redir=####
- s####.####.com/partner?adv_id=####&uid=####&redir=####
- s####.####.com/sdktmp/sdk?v=####&id=####&af=####&nv=####&dn=####&bundle=...
- s####.####.com/sync/img?mt_exid=50&redir=http://ad.sxp.smartclip.net/syn...
- s####.####.com/sync?type=####&dsp=####&dspuuid=####&red=####
- s####.####.tv/um?eid=####&uid=####&fb=####
- se####.####.com/vast/2.00/106702?VPI=####&content_page_url=####&device[o...
- sfil####.####.net/http_only/way2travel/Assets/scripts/way2travel.js
- startap####.com/1.4/trackdownload?publisherId=####&productId=####&os=###...
- stats####.####.net/count?type=####&crea=####&ite=####&cpg=####&adv=####&...
- t####.####.com/site/12057?dt=####&r=####&sig=####&bkca=####
- tr####.####.com/track?d=####&cou=####&cos=####&r=####&rs=####&sid=####&t...
- trac####.####.com/vtr?channel_id=####&app_name=####&ad_quartile=####
- trk-eu####.####.com/ILogger.aspx?event=####&type=####&adId=####&fmid=###...
- u####.####.com/3PDPHandler.aspx?tpdp=####&app=####&pid=####
- u####.####.net/smartclip/1/info2?sType=####
- videolo####.####.com/sync?UIVO=####&redir=####
- view####.com/movie/1056-10206-000/demon-seduction/?e0=####&e1_trackall=#...
- w####.####.com/ac?siteid=####&pgid=####&fmtid=####&ab=####&tgt=####&oc=#...
- x####.####.io/0.gif?pid=####&id=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_Parse/installationId
- <Package Folder>/app_fiverocks/events2-journal
- <Package Folder>/app_indicators/indicator_d
- <Package Folder>/app_indicators/indicator_p
- <Package Folder>/app_sslcache/www.addroider.com.443
- <Package Folder>/cache/####/4fdc600c6f5739691c70e9330340918f_parsefichv1_31.json
- <Package Folder>/cache/####/applicationId
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/cache/ads-964720365.jar
- <Package Folder>/databases/ParseOfflineStore
- <Package Folder>/databases/ParseOfflineStore-journal
- <Package Folder>/databases/arrkii.asa.sdk.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/.DS_Store
- <Package Folder>/files/ISDZcyNXkTzQhwxvstub.jar
- <Package Folder>/files/SPyxcMpdtadgNhVSdynamicloader.jar
- <Package Folder>/files/StartAppSplash.html
- <Package Folder>/files/StartappMetadata
- <Package Folder>/files/ahMZjZIyWHhwDbejdaemon.so
- <Package Folder>/files/back_.png
- <Package Folder>/files/back_dark.png
- <Package Folder>/files/browser_icon_dark.png
- <Package Folder>/files/close_button.png
- <Package Folder>/files/drawable-hdpi.zip
- <Package Folder>/files/drawable.zip
- <Package Folder>/files/empty_star.png
- <Package Folder>/files/feRrQMsTOymdlgJdsa.jar
- <Package Folder>/files/filled_star.png
- <Package Folder>/files/forward_.png
- <Package Folder>/files/forward_dark.png
- <Package Folder>/files/half_star.png
- <Package Folder>/files/info_l.png
- <Package Folder>/files/info_s.png
- <Package Folder>/files/librzKXgueSDvKSXJOpbootstrap.so
- <Package Folder>/files/logo.png
- <Package Folder>/files/shared_prefs_sdk_ad_prefs
- <Package Folder>/files/tab_side.png
- <Package Folder>/files/x_dark.png
- <Package Folder>/shared_prefs/FBAdPrefs.xml
- <Package Folder>/shared_prefs/SDKIDFA.xml
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml
- <Package Folder>/shared_prefs/ak.salvia.sdk.xml.bak
- <Package Folder>/shared_prefs/com.arrkii.module.offerprobe.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- <Package Folder>/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml
- <Package Folder>/shared_prefs/com.startapp.android.publish.CookiePrefsFile.xml.bak
- <Package Folder>/shared_prefs/com.startapp.android.publish.xml
- <Package Folder>/shared_prefs/com.startapp.android.publish.xml.bak
- <Package Folder>/shared_prefs/dayupdate.xml
- <Package Folder>/shared_prefs/fiverocks.xml
- <Package Folder>/shared_prefs/fiverocks.xml.bak
- <SD-Card>/.salvia/<Package>
- <SD-Card>/.salvia/tick
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- chmod 755 /data/data/com.tiny.volumebooster/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Использует специальную библиотеку для скрытия исполняемого байткода.
