Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.589.origin
- Android.SmsSend.1567.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.DownLoader.589.origin
- Android.SmsSend.1567.origin
Сетевая активность:
Подключается к:
- 3db####.com
- a####.####.com
- c####.####.cn
- c####.####.com
- h####.com
- imgc####.####.com
- s####.####.com
Запросы HTTP GET:
- 3db####.com/user_info/81908/avatar/c10e79a7d50ecc89f6ebb2cc11c5dca8
- c####.####.cn/upload/201706/5/app/20170605115942974.apk
- c####.####.com/product_resources2/com.idddx.lwp.planetofhuman/342e3d4779...
- h####.com/cgi-bin/cell?sk=####&sn=####&ev=####&op=####&ts=####&wl=####&a...
- imgc####.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his...
Запросы HTTP POST:
- a####.####.com/api/check_app_update
- a####.####.com/app_logs
- c####.####.com/ad/splash/stats.html
- s####.####.com/activate
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar.sig
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp.sig
- <Package Folder>/app_e_qq_com_plugin/update_lc
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.sig
- <Package Folder>/app_e_qq_com_setting/gdt_suid
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.sig
- <Package Folder>/cache/####/2092103641
- <Package Folder>/cache/####/818579719
- <Package Folder>/cache/V2.8.8.1.txt
- <Package Folder>/databases/StoreProvider.db-journal
- <Package Folder>/databases/dynamic.db
- <Package Folder>/databases/dynamic.db-journal
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/.imprint
- <Package Folder>/files/nw.jar
- <Package Folder>/files/ta.jar
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/TrineaAndroidCommon.xml
- <Package Folder>/shared_prefs/TrineaAndroidCommon.xml.bak
- <Package Folder>/shared_prefs/ad_show_time.xml
- <Package Folder>/shared_prefs/dynamic_prefers.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/shared_prefs/preferences_app.xml
- <Package Folder>/shared_prefs/preferences_flags.xml
- <Package Folder>/shared_prefs/preferences_splash.xml
- <Package Folder>/shared_prefs/preferences_user.xml
- <Package Folder>/shared_prefs/umeng_feedback_conversations.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/vbz.xml
- <SD-Card>/Android/####/045f5bd3f5eac
- <SD-Card>/Android/####/b.tmp
- <SD-Card>/Android/####/f5f21f4da05cc95cb5e52be795165517.apk
- <SD-Card>/myShareLWP/####/-1037345029.tmp
- <SD-Card>/myShareLWP/####/-1226219835.tmp
- <SD-Card>/myShareLWP/####/-1374405786.tmp
- <SD-Card>/myShareLWP/####/-1518385526.tmp
- <SD-Card>/myShareLWP/####/-1581566925.tmp
- <SD-Card>/myShareLWP/####/-1673835504.tmp
- <SD-Card>/myShareLWP/####/-1769107585.tmp
- <SD-Card>/myShareLWP/####/-339584328.tmp
- <SD-Card>/myShareLWP/####/-476921498.tmp
- <SD-Card>/myShareLWP/####/-484173488.tmp
- <SD-Card>/myShareLWP/####/-520729391.tmp
- <SD-Card>/myShareLWP/####/-609251044.tmp
- <SD-Card>/myShareLWP/####/-619177697.tmp
- <SD-Card>/myShareLWP/####/-681575914.tmp
- <SD-Card>/myShareLWP/####/-963799904.tmp
- <SD-Card>/myShareLWP/####/1009690730.tmp
- <SD-Card>/myShareLWP/####/1053237881.tmp
- <SD-Card>/myShareLWP/####/1076536409.tmp
- <SD-Card>/myShareLWP/####/1129458240.tmp
- <SD-Card>/myShareLWP/####/113083234.tmp
- <SD-Card>/myShareLWP/####/1156992332.tmp
- <SD-Card>/myShareLWP/####/1198401360.tmp
- <SD-Card>/myShareLWP/####/1474728320
- <SD-Card>/myShareLWP/####/1489310279.tmp
- <SD-Card>/myShareLWP/####/1613229792.tmp
- <SD-Card>/myShareLWP/####/1664975463.tmp
- <SD-Card>/myShareLWP/####/2011845047.tmp
- <SD-Card>/myShareLWP/####/2052628378.tmp
- <SD-Card>/myShareLWP/####/246576227.tmp
- <SD-Card>/myShareLWP/####/250226076.tmp
- <SD-Card>/myShareLWP/####/521083265.tmp
- <SD-Card>/myShareLWP/####/6266221.tmp
- <SD-Card>/myShareLWP/####/632972744
- <SD-Card>/myShareLWP/####/684453695.tmp
- <SD-Card>/myShareLWP/####/705577004.tmp
- <SD-Card>/myShareLWP/####/866650521.tmp
Другие:
Запускает следующие shell-скрипты:
- <dexopt>
- chmod 755 /data/data/com.idddx.usglsvappstore.myshare.cn/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/f5f21f4da05cc95cb5e52be795165517.apk
- chmod 777 /storage/emulated/0/Android/data/com.idddx.usglsvappstore.myshare.cn/files/Download/Android/azb/f5f21f4da05cc95cb5e52be795165517.apk
Использует специальную библиотеку для скрытия исполняемого байткода.
