Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.79.origin
Сетевая активность:
Подключается к:
- 1####.####.93
- 1####.####.93:8023
- 3460dc7####.####.com
- 94d9733####.####.com
- 9f367e7####.####.com
- a####.####.com
- a2c6d88####.####.net
- a4d5079####.####.net
- aca3599####.####.net
- c####.####.com
- c####.####.net
- c####.####.org
- c2f2208####.####.com
- ce####.####.org
- cloudfr####.####.com
- con####.####.net
- d####.####.com
- d####.####.net
- e####.####.com
- f####.####.com
- google-####.com
- h####.com
- i####.####.cc
- m####.####.com
- m####.####.nl
- n####.nl
- p####.####.cc
- p####.####.com
- po####.####.com:84
- st####.####.com
- syn####.####.net
- t####.####.com
- tra####.####.com
- u####.####.com
Запросы HTTP GET:
- 1####.####.93/m/umeng:59818d6482b63570ad00062f/601/An5xEsp8M279wsL42J8fY...
- 1####.####.93:8023/m/umeng:59818d6482b63570ad00062f/601/An5xEsp8M279wsL4...
- 3460dc7####.####.com/59821193761f5548031ecea6_500x331.jpg
- 94d9733####.####.com/59827bd2761f55480329c875_500x281.jpg
- 9f367e7####.####.com/5980e320761f554803000a90_500x333.jpg
- a2c6d88####.####.net/test.png
- a4d5079####.####.net/test.png
- aca3599####.####.net/test.png
- c####.####.com/cms?partner_id=####
- c####.####.com/dp/navegg.php?pid=####&uid=####
- c####.####.com/files/6c556240a16103d254f6b583c15258ba
- c####.####.com/js/4751656579.js
- c####.####.com/sync?prtid=####&id=####&google_gid=####&google_cver=####
- c####.####.net/pixel?google_nid=####&google_cm=####&id=####&google_tc=####
- c####.####.org/2015-12-12/32dda1e5bb68a459e1a14d919c1259b2.jpeg!240
- c####.####.org/v2/content/article1-1511718-b878e06fdc740cdbfbdc2208f44ea...
- c2f2208####.####.com/51652252bbddbd1468000b7a.ico
- ce####.####.org/v3/commentlist-1511718-b878e06fdc740cdbfbdc2208f44ea603-...
- cloudfr####.####.com/x.png
- con####.####.net/en_US/sdk.js
- d####.####.com/r/dd/id/L2NzaWQvMS9jaWQvMjYzNTYzMzIvdC8y/dpuid/33569588496/
- d####.####.net/demconf.jpg?et:ibs%7cdata:dpid=####&dpuuid=####&redir=####
- f####.####.com/css?family=####
- f####.####.com/s/opensans/v14/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwjgmXLRnT...
- google-####.com/analytics.js
- h####.com/_a/insights/publications?publicationIds=####
- i####.####.cc/s
- m####.####.nl/m/zddxdssa0hj6_std320.jpg
- n####.nl/static/img/atoms/images/logos/logosprite_menu.svg?v=####
- p####.####.cc/api/ads/check?md5=####&secret=####&app_v=####&app=####&sdk...
- p####.####.com/sync/img?redir=####
- p####.####.com/ul_cb/aa/y8a2thbi7v8xdodcoa82
- p####.####.com/ups/19764/sync?uid=####&_origin=####&redir=####
- st####.####.com/c/hotjar-113364.js?sv=####
- syn####.####.net/ct/upi/pid/DuqQKWX7/?redir=####&_test=####
- t####.####.com/site/31435?id=####&redir=####
- t####.####.com/usr?v=####&acc=####&id=####&jds=####&wst=####
- t####.####.com/utag/sanoma/nu-nl/prod/utag.js
- tra####.####.com/redir/?tgds=####&tgda=####&tgdid=####&tgdredir=####
- u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
Запросы HTTP POST:
- a####.####.com/app_logs
- e####.####.com/e
- m####.####.com/v2/register
- po####.####.com:84/sdk/aff_getpolicy
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/app_cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/app_dex/mocean-sdk.zip
- <Package Folder>/app_dex/mocean-sdk.zip.tmp
- <Package Folder>/app_tmpdex/mocean-sdk.zip
- <Package Folder>/cache/####/542324769-1749282151
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/index
- <Package Folder>/databases/MsgLogStore.db-journal
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/databases/Zuoyoo_db
- <Package Folder>/databases/Zuoyoo_db-journal
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/databases/mocean.database.ad-journal
- <Package Folder>/databases/track_event
- <Package Folder>/databases/track_event-journal
- <Package Folder>/databases/virgo_mpsp.db
- <Package Folder>/databases/virgo_mpsp.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/DaemonServer
- <Package Folder>/files/agoo.pid
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/AGOO_CONNECT.xml
- <Package Folder>/shared_prefs/AGOO_HOST.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/shared_prefs/AppStore.xml.bak
- <Package Folder>/shared_prefs/BSModelForPlaced.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/CountryRelevant.xml
- <Package Folder>/shared_prefs/CurArticleInfo.xml
- <Package Folder>/shared_prefs/EVENTS_EXT_SP.xml
- <Package Folder>/shared_prefs/GATHER.xml
- <Package Folder>/shared_prefs/Game_recommend.xml
- <Package Folder>/shared_prefs/Game_recommend.xml.bak
- <Package Folder>/shared_prefs/MASTER_DATA.xml
- <Package Folder>/shared_prefs/MO.xml
- <Package Folder>/shared_prefs/MO.xml.bak
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml
- <Package Folder>/shared_prefs/PhoneUtil.xml
- <Package Folder>/shared_prefs/Prophet.xml
- <Package Folder>/shared_prefs/WebViewSettings.xml
- <Package Folder>/shared_prefs/coolook.minisite.xml
- <Package Folder>/shared_prefs/test.xml
- <Package Folder>/shared_prefs/track_event.<Package>.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/updateVer.xml
- <Package Folder>/shared_prefs/v2_local_login.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/<Package>/####/9098e514a90a687f951299c684e2c0d8.jpg
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1z6zvfpz292r66bw5lmgi6f8b.0.tmp
- <SD-Card>/Android/####/25rq5n07ym2zjjisy8bf92jc0.0.tmp
- <SD-Card>/Android/####/2ql0blcc9oztuoqwf5zxfinte.0.tmp
- <SD-Card>/Android/####/4iy7jxd7mwrjkadxsu7xh0o2j.0
- <SD-Card>/Android/####/59bdjkv1xkb26ovo7t487fgha.0.tmp
- <SD-Card>/Android/####/5j5d90d4rstsz20wimgudy55o.0.tmp
- <SD-Card>/Android/####/5pkon9g2vsjkxno38qbwi40nh.0.tmp
- <SD-Card>/Android/####/6i37snv1m9z7hxvuic474q7jn.0.tmp
- <SD-Card>/Android/####/72ua7q3op5xoe7k7l5r4xq8ne.0.tmp
- <SD-Card>/Android/####/delay_20170727082000352_b878e06fdc740cdbfbdc2208f44ea603_s.dat
- <SD-Card>/Android/####/delay_20170727082005867_b878e06fdc740cdbfbdc2208f44ea603_s.dat
- <SD-Card>/Android/####/delay_20170727082010098_b878e06fdc740cdbfbdc2208f44ea603_s.dat
- <SD-Card>/Android/####/delay_20170727082010951_b878e06fdc740cdbfbdc2208f44ea603_s.dat
- <SD-Card>/Android/####/delay_20170727082014354_b878e06fdc740cdbfbdc2208f44ea603_s.dat
- <SD-Card>/Android/####/delay_20170727082015223_b878e06fdc740cdbfbdc2208f44ea603_s.dat
- <SD-Card>/Android/####/delay_20170727082015446_b878e06fdc740cdbfbdc2208f44ea603_s.dat
- <SD-Card>/Android/####/delay_20170727082015827_b878e06fdc740cdbfbdc2208f44ea603_s.dat
- <SD-Card>/Android/####/delay_20170727082018454_b878e06fdc740cdbfbdc2208f44ea603_s.dat
- <SD-Card>/Android/####/delay_20170727082018800_b878e06fdc740cdbfbdc2208f44ea603_s.dat
- <SD-Card>/Android/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D %7B%22package%22%3A%22<Package>%22%2C%22appKey%22%3A%22umeng%3A59818d6482b63570ad00062f%22%2C%22utdid%22%3A%22WXmiLfF9S1wDAGdzx1EJGYJL%22%2C%22sdkVersion%22%3A%2220151015%22%7D -I 100.69.168.33 -O 80 -T -Z
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 755 /data/data/com.cknews.headline.buzz/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- sh
Загружает динамические библиотеки:
- libjiagu
- tnet-2.1.20
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- DES
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
