Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.564.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.Backdoor.564.origin
Сетевая активность:
Подключается к:
- ad####.####.com
- ada####.####.com
- ap####.####.cn
- api####.####.com
- e####.####.cn
- l####.####.com
- res####.####.com
- t####.####.net
- y####.####.com
Запросы HTTP GET:
- ad####.####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=####&is...
Запросы HTTP POST:
- ada####.####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&sv...
- ap####.####.cn/?st=####&sv=####&tm=####&sid=####&apn=####&ct=####&pi=###...
- api####.####.com/v3/log/init
- e####.####.cn/mcms/index.php/push/bindMac
- l####.####.com/ajax?c=####&k=####
- res####.####.com/v3/config/resource?
- t####.####.net/g/d
- y####.####.com/saveWb.json
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_SGLib/libsgmainso-5.1.96.so.tmp
- <Package Folder>/app_SGLib/libsgsecuritybodyso-5.1.25.so
- <Package Folder>/app_SGLib/lock.lock
- <Package Folder>/app_tbs/####/core_info
- <Package Folder>/app_tbs/####/tbscoreinstall.txt
- <Package Folder>/app_tbs/####/tbslock.txt
- <Package Folder>/database/pushinfo.db
- <Package Folder>/database/pushinfo.db-journal
- <Package Folder>/databases/pushstat_5.7.0.db
- <Package Folder>/databases/pushstat_5.7.0.db-journal
- <Package Folder>/databases/ut.db
- <Package Folder>/databases/ut.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/0a231bd8575dcf72.txt
- <Package Folder>/files/21c22f492aba3de8.lock
- <Package Folder>/files/8ef9c457b3bbb403.lock
- <Package Folder>/files/930a31b34bd52c08.lock
- <Package Folder>/files/Q0VSVC5SU0EK.txt
- <Package Folder>/files/SGMANAGER_DATA2
- <Package Folder>/files/SGMANAGER_DATA2.tmp
- <Package Folder>/files/TDtcagent.db
- <Package Folder>/files/TDtcagent.db-journal
- <Package Folder>/files/ap.Lock
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/lotuseed.apps
- <Package Folder>/files/lotuseed.lock
- <Package Folder>/files/lotuseed.s
- <Package Folder>/files/lotuseed.task
- <Package Folder>/files/sp.lock
- <Package Folder>/files/timestamp
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/<Package>.self_push_sync.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/AlibcLinkPartner.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/PushChannelId.xml
- <Package Folder>/shared_prefs/PushUserId.xml
- <Package Folder>/shared_prefs/UTCommon.xml
- <Package Folder>/shared_prefs/aliTradeConfigSP.xml
- <Package Folder>/shared_prefs/auth_sdk_device.xml
- <Package Folder>/shared_prefs/com.baidu.pushservice.BIND_CACHE.xml
- <Package Folder>/shared_prefs/last_known_location.xml
- <Package Folder>/shared_prefs/lotuseed_global.xml
- <Package Folder>/shared_prefs/lotuseed_main.xml
- <Package Folder>/shared_prefs/notification_builder_storage.xml
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/shared_prefs/pst.xml.bak
- <Package Folder>/shared_prefs/pushclient.xml
- <Package Folder>/shared_prefs/screen.xml
- <Package Folder>/shared_prefs/tbs_download_config.xml
- <Package Folder>/shared_prefs/tbs_download_config.xml.bak
- <Package Folder>/shared_prefs/tbs_download_stat.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/.com.taobao.dp/6c709c11d2d46a7b
- <SD-Card>/.com.taobao.dp/dd7893586a493dc3
- <SD-Card>/.com.taobao.dp/hid.dat
- <SD-Card>/.system/lotuseed.devid
- <SD-Card>/.tid638107681
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- chmod 755 /data/data/com.yek.android.uniqlo/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- getprop ro.product.cpu.abi
- ps
Использует специальную библиотеку для скрытия исполняемого байткода.
