Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.79.origin
Загружает из Интернета следующие детектируемые угрозы:
- Android.HiddenAds.79.origin
Сетевая активность:
Подключается к:
- 1####.####.99
- 1####.####.99:8023
- 3460dc7####.####.com
- 94d9733####.####.com
- 9f367e7####.####.com
- a####.####.com
- a42f327####.####.net
- aboutco####.org
- acedc7b####.####.net
- adecf96####.####.net
- af9c94b####.####.net
- afb41b8####.####.net
- api-ce####.####.org
- c####.####.com
- c####.####.net
- c####.####.org
- c2f2208####.####.com
- ce####.####.org
- cloudfr####.####.com
- con####.####.net
- d####.####.com
- d####.####.net
- f####.####.com
- h####.com
- i####.####.cc
- m####.####.com
- p####.####.cc
- p####.####.com
- st####.####.com
- stat####.####.com
- syn####.####.net
- t####.####.com
- tra####.####.com
- u####.####.com
Запросы HTTP GET:
- 1####.####.99/m/umeng:5719f92667e58e5665000543/601/AtAhBRe5vHuAu4sEX-2C2...
- 1####.####.99:8023/m/umeng:5719f92667e58e5665000543/601/AtAhBRe5vHuAu4sE...
- 3460dc7####.####.com/598148bd761f5548030a0edd_500x333.jpg
- 94d9733####.####.com/5982d3b0761f5548033353a0_500x312.jpg
- 9f367e7####.####.com/5980dc14761f554803ff65aa_500x331.jpg
- a42f327####.####.net/test.png
- aboutco####.org/
- acedc7b####.####.net/test.png
- adecf96####.####.net/test.png
- af9c94b####.####.net/test.png
- afb41b8####.####.net/test.png
- api-ce####.####.org/v3/commentlist-1511717-0c9c6df324b6f4e5969c160a9eb2f...
- c####.####.com/cms?partner_id=####
- c####.####.com/dp/navegg.php?pid=####&uid=####
- c####.####.com/files/6c556240a16103d254f6b583c15258ba
- c####.####.net/pixel?google_nid=####&google_cm=####&id=####&google_tc=####
- c####.####.org/2015-12-12/2dbb64e898aeda520b8e85f60106a439.jpeg!240
- c####.####.org/v2/content/list-0-0-0-NL-5-0-1.json?1501143####
- c2f2208####.####.com/54d9f5ac07830f2c0a000093.ico
- ce####.####.org/v3/system/initcountrytopic.json
- cloudfr####.####.com/x.png
- con####.####.net/en_US/sdk.js
- d####.####.com/r/dd/id/L2NzaWQvMS9jaWQvMjYzNTYzMzIvdC8y/dpuid/33571368652/
- d####.####.net/demconf.jpg?et:ibs%7cdata:dpid=####&dpuuid=####&redir=####
- f####.####.com/css?family=####
- f####.####.com/s/opensans/v14/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwjgmXLRnT...
- h####.com/_a/news/trends/articles?trends[]=####&trends[]=####&trends[]=#...
- i####.####.cc/s
- p####.####.cc/api/ads/check?md5=####&secret=####&app_v=####&app=####&sdk...
- p####.####.com/aa/y8a2thbi7v8xdodcoa82
- p####.####.com/sync/img?redir=####&mm####&mm####
- p####.####.com/ups/19764/sync?uid=####&_origin=####&redir=####&verify=####
- st####.####.com/c/hotjar-113364.js?sv=####
- stat####.####.com/connect/xd_arbiter/r/XBwzv5Yrm_1.js?version=####
- syn####.####.net/upi/pid/DuqQKWX7/?redir=####
- t####.####.com/site/31436?dt=####&r=####&sig=####&bkca=####
- t####.####.com/sync?prtid=####&admid=####
- tra####.####.com/redir/?tgds=####&tgda=####&tgdid=####&tgdredir=####
- u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
Запросы HTTP POST:
- a####.####.com/app_logs
- m####.####.com/v2/register
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/app_dex/mocean-sdk.zip
- <Package Folder>/app_dex/mocean-sdk.zip.tmp
- <Package Folder>/app_tmpdex/mocean-sdk.zip
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_0 (deleted)
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_1 (deleted)
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_2 (deleted)
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/data_3 (deleted)
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/index (deleted)
- <Package Folder>/databases/MsgLogStore.db-journal
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/databases/Zuoyoo_db
- <Package Folder>/databases/Zuoyoo_db-journal
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/databases/mocean.database.ad-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/DaemonServer
- <Package Folder>/files/agoo.pid
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/AGOO_CONNECT.xml
- <Package Folder>/shared_prefs/AGOO_HOST.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/shared_prefs/BSModelForPlaced.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/CountryRelevant.xml
- <Package Folder>/shared_prefs/CurArticleInfo.xml
- <Package Folder>/shared_prefs/GATHER.xml
- <Package Folder>/shared_prefs/GATHER.xml.bak
- <Package Folder>/shared_prefs/Game_recommend.xml
- <Package Folder>/shared_prefs/Game_recommend.xml.bak
- <Package Folder>/shared_prefs/MASTER_DATA.xml
- <Package Folder>/shared_prefs/MO.xml
- <Package Folder>/shared_prefs/MO.xml.bak
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml.bak
- <Package Folder>/shared_prefs/PhoneUtil.xml
- <Package Folder>/shared_prefs/Prophet.xml
- <Package Folder>/shared_prefs/coolook.minisite.xml
- <Package Folder>/shared_prefs/test.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/updateVer.xml
- <Package Folder>/shared_prefs/v2_local_login.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/<Package>/####/9098e514a90a687f951299c684e2c0d8.jpg
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1z6zvfpz292r66bw5lmgi6f8b.0.tmp
- <SD-Card>/Android/####/25rq5n07ym2zjjisy8bf92jc0.0.tmp
- <SD-Card>/Android/####/2ql0blcc9oztuoqwf5zxfinte.0.tmp
- <SD-Card>/Android/####/4iy7jxd7mwrjkadxsu7xh0o2j.0.tmp
- <SD-Card>/Android/####/59bdjkv1xkb26ovo7t487fgha.0.tmp
- <SD-Card>/Android/####/5j5d90d4rstsz20wimgudy55o.0.tmp
- <SD-Card>/Android/####/5pkon9g2vsjkxno38qbwi40nh.0
- <SD-Card>/Android/####/6i37snv1m9z7hxvuic474q7jn.0.tmp
- <SD-Card>/Android/####/72ua7q3op5xoe7k7l5r4xq8ne.0.tmp
- <SD-Card>/Android/####/delay_20170727081959250_0c9c6df324b6f4e5969c160a9eb2f89d_s.dat
- <SD-Card>/Android/####/delay_20170727082009893_0c9c6df324b6f4e5969c160a9eb2f89d_s.dat
- <SD-Card>/Android/####/delay_20170727082010459_0c9c6df324b6f4e5969c160a9eb2f89d_s.dat
- <SD-Card>/Android/####/delay_20170727082014837_0c9c6df324b6f4e5969c160a9eb2f89d_s.dat
- <SD-Card>/Android/####/delay_20170727082019964_0c9c6df324b6f4e5969c160a9eb2f89d_s.dat
- <SD-Card>/Android/####/delay_20170727082027056_0c9c6df324b6f4e5969c160a9eb2f89d_s.dat
- <SD-Card>/Android/####/delay_20170727082027231_0c9c6df324b6f4e5969c160a9eb2f89d_s.dat
- <SD-Card>/Android/####/delay_20170727082027397_0c9c6df324b6f4e5969c160a9eb2f89d_s.dat
- <SD-Card>/Android/####/delay_20170727082028036_0c9c6df324b6f4e5969c160a9eb2f89d_s.dat
- <SD-Card>/Android/####/delay_20170727082028053_0c9c6df324b6f4e5969c160a9eb2f89d_s.dat
- <SD-Card>/Android/####/delay_20170727082028148_0c9c6df324b6f4e5969c160a9eb2f89d_s.dat
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Android/####/z5oujy8oo58vhcjy9nlo1dwi.0.tmp
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D %7B%22package%22%3A%22<Package>%22%2C%22appKey%22%3A%22umeng%3A5719f92667e58e5665000543%22%2C%22utdid%22%3A%22WXmiLGRwTXUDAGdzx1FA6EGf%22%2C%22sdkVersion%22%3A%2220151015%22%7D -I 100.69.168.33 -O 80 -T -Z
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 755 /data/data/com.poboo.news.headline/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- sh
Загружает динамические библиотеки:
- libjiagu
- tnet-2.1.20
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- DES
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
