Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.2083
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.2083
Сетевая активность:
Подключается к:
- a####.####.com
- pan####.net
- pan####.net:8080
Запросы HTTP POST:
- a####.####.com/ad-service/ad/mark
- pan####.net/BackAds/req.action?
- pan####.net:8080/BackAds/req.action?
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/app_ne/<Package>.odex
- <Package Folder>/app_ne/<Package>.zip
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/shared_prefs/PrefsFile.xml
- <Package Folder>/shared_prefs/exit.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <SD-Card>/USBJoyData/BTKeyboard_JoyPrefsFile_45055_257_0.xml
- <SD-Card>/USBJoyData/Buzz4-1_JoyPrefsFile_1356_2_0.xml
- <SD-Card>/USBJoyData/C64-1Player_JoyPrefsFile_16962_308_0.xml
- <SD-Card>/USBJoyData/C64-1Player_JoyPrefsFile_16962_308_1.xml
- <SD-Card>/USBJoyData/C64-2Players_JoyPrefsFile_16962_308_0.xml
- <SD-Card>/USBJoyData/C64-2Players_JoyPrefsFile_16962_308_1.xml
- <SD-Card>/USBJoyData/Keyboard-DPAD_JoyPrefsFile_62721_4097_0.xml
- <SD-Card>/USBJoyData/Keyboard_JoyPrefsFile_62721_4097_0.xml
- <SD-Card>/USBJoyData/Keyrah-MainEmpty_JoyPrefsFile_62720_4096_0.xml
- <SD-Card>/USBJoyData/Keyrah_JoyPrefsFile_62720_4096_0.xml
- <SD-Card>/USBJoyData/Logitech-F310-Xinput-mode_JoyPrefsFile_1133_49693_0.xml
- <SD-Card>/USBJoyData/Logitech-F310-Xinput-mode_JoyPrefsFile_1133_49693_1.xml
- <SD-Card>/USBJoyData/Logitech-F710-Wireless_JoyPrefsFile_1133_49695_0.xml
- <SD-Card>/USBJoyData/Logitech-F710-Wireless_JoyPrefsFile_1133_49695_1.xml
- <SD-Card>/USBJoyData/Logitech-Rumble2-Wireless_JoyPrefsFile_1133_49689_0.xml
- <SD-Card>/USBJoyData/Logitech-Rumble2-Wireless_JoyPrefsFile_1133_49689_1.xml
- <SD-Card>/USBJoyData/Logitech-RumblePad2_JoyPrefsFile_1133_49688_0.xml
- <SD-Card>/USBJoyData/Logitech-RumblePad2_JoyPrefsFile_1133_49688_1.xml
- <SD-Card>/USBJoyData/Mouse_JoyPrefsFile_62722_4098_0.xml
- <SD-Card>/USBJoyData/N64-1Player_JoyPrefsFile_3727_12307_0.xml
- <SD-Card>/USBJoyData/N64-1Player_JoyPrefsFile_3727_12307_1.xml
- <SD-Card>/USBJoyData/N64-2Players_JoyPrefsFile_3727_12307_0.xml
- <SD-Card>/USBJoyData/N64-2Players_JoyPrefsFile_3727_12307_1.xml
- <SD-Card>/USBJoyData/PS3-Wired_JoyPrefsFile_1356_616_0.xml
- <SD-Card>/USBJoyData/PS3wireless_JoyPrefsFile_1356_619_0.xml
- <SD-Card>/USBJoyData/PS3wireless_JoyPrefsFile_1356_619_1.xml
- <SD-Card>/USBJoyData/PS3wireless_JoyPrefsFile_1356_619_2.xml
- <SD-Card>/USBJoyData/PS3wireless_JoyPrefsFile_1356_619_3.xml
- <SD-Card>/USBJoyData/PSX-1Player_JoyPrefsFile_2064_1_0.xml
- <SD-Card>/USBJoyData/PSX-2Players_JoyPrefsFile_2064_1_0.xml
- <SD-Card>/USBJoyData/PhoneJoy_JoyPrefsFile_40957_259_0.xml
- <SD-Card>/USBJoyData/RB-DrumKit-1_JoyPrefsFile_7085_3_0.xml
- <SD-Card>/USBJoyData/RB-Guitar-1_JoyPrefsFile_7085_2_0.xml
- <SD-Card>/USBJoyData/Razer-Onza-1stPlayer_JoyPrefsFile_5769_64768_0.xml
- <SD-Card>/USBJoyData/Razer-Onza-2ndPlayer_JoyPrefsFile_5769_64768_1.xml
- <SD-Card>/USBJoyData/Razer-Onza-TE-1stPlayer_JoyPrefsFile_7085_64768_0.xml
- <SD-Card>/USBJoyData/Razer-Onza-TE_2ndPlayer_JoyPrefsFile_7085_64768_1.xml
- <SD-Card>/USBJoyData/SNES-1Player_JoyPrefsFile_3727_12307_0.xml
- <SD-Card>/USBJoyData/SNES-1Player_JoyPrefsFile_3727_12307_1.xml
- <SD-Card>/USBJoyData/SNES-2Players_JoyPrefsFile_3727_12307_0.xml
- <SD-Card>/USBJoyData/SNES-2Players_JoyPrefsFile_3727_12307_1.xml
- <SD-Card>/USBJoyData/ShuttleExpress_JoyPrefsFile_2867_32_0.xml
- <SD-Card>/USBJoyData/SideWinder-Feedback2_JoyPrefsFile_1118_27_0.xml
- <SD-Card>/USBJoyData/SideWinder-Precision2_JoyPrefsFile_1118_56_0.xml
- <SD-Card>/USBJoyData/TrustCTX24_JoyPrefsFile_121_6_0.xml
- <SD-Card>/USBJoyData/Wii-RemotePlus-1st_JoyPrefsFile_1406_774_0.xml
- <SD-Card>/USBJoyData/Wii-RemotePlus-2nd_JoyPrefsFile_1406_774_1.xml
- <SD-Card>/USBJoyData/Wii-RemotePlus-3rd_JoyPrefsFile_1406_774_2.xml
- <SD-Card>/USBJoyData/Wii-RemotePlus-4th_JoyPrefsFile_1406_774_3.xml
- <SD-Card>/USBJoyData/X360-Wired-1stPlayer_JoyPrefsFile_1118_654_0.xml
- <SD-Card>/USBJoyData/X360-Wired-2ndPlayer_JoyPrefsFile_1118_654_1.xml
- <SD-Card>/USBJoyData/X360-Wireless-1stPlayer_JoyPrefsFile_1118_1817_0.xml
- <SD-Card>/USBJoyData/X360-Wireless-1stPlayer_JoyPrefsFile_1118_657_0.xml
- <SD-Card>/USBJoyData/X360-Wireless-2ndPlayer_JoyPrefsFile_1118_1817_1.xml
- <SD-Card>/USBJoyData/X360-Wireless-2ndPlayer_JoyPrefsFile_1118_657_1.xml
- <SD-Card>/USBJoyData/iCade-Mame_JoyPrefsFile_40959_257_0.xml
- <SD-Card>/USBJoyData/iControlPad-JoystickMode_JoyPrefsFile_40958_258_0.xml
- <SD-Card>/USBJoyData/usb_device_ids.txt
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- chmod 755 /data/data/com.poke64738.wbxxy.usbjoy/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Использует специальную библиотеку для скрытия исполняемого байткода.
