Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.79.origin
Сетевая активность:
Подключается к:
- 1####.####.92
- 1####.####.92:8023
- 94d9733####.####.com
- 9fbf979####.####.com
- a####.####.com
- a329b86####.####.net
- a6a0e0f####.####.net
- a6b2eed####.####.net
- api-ce####.####.org
- c####.####.com
- c####.####.net
- c####.####.org
- c2f2208####.####.com
- ce####.####.org
- cloudfr####.####.com
- con####.####.net
- d####.####.com
- d####.####.net
- f####.####.com
- h####.com
- i####.####.cc
- lo####.####.org
- m####.####.com
- p####.####.cc
- p####.####.com
- st####.####.com
- syn####.####.net
- t####.####.com
- tra####.####.com
- u####.####.com
Запросы HTTP GET:
- 1####.####.92/m/umeng:5719f92667e58e5665000543/601/AsKxPUfbmyWbDF3P4HbpK...
- 1####.####.92:8023/m/umeng:5719f92667e58e5665000543/601/AsKxPUfbmyWbDF3P...
- 94d9733####.####.com/5982e22c761f5548033496ad_500x333.jpg
- 9fbf979####.####.com/5983bb66761f55480346d98b_500x500.jpg
- a####.####.com/articles/59839a14761f554803447188
- a329b86####.####.net/test.png
- a6a0e0f####.####.net/test.png
- a6b2eed####.####.net/test.png
- api-ce####.####.org/v3/commentlist-1511720-dcbe4cdcdad9482d015c23f2b6eb3...
- c####.####.com/cms?partner_id=####
- c####.####.com/dp/navegg.php?pid=####&uid=####
- c####.####.com/files/6c556240a16103d254f6b583c15258ba
- c####.####.com/sync?prtid=####&yahid=####
- c####.####.net/pixel?google_nid=####&google_cm=####&id=####&google_tc=####
- c####.####.org/2015-12-12/45efd03f1bee372fb59b43442692aa75.jpeg!240
- c####.####.org/v2/content/list-0-0-0-NL-1-0-1.json?1501143####
- c2f2208####.####.com/51652252bbddbd1468000b79.ico
- ce####.####.org/v2/content/recommend-dcbe4cdcdad9482d015c23f2b6eb3cb5-NL...
- cloudfr####.####.com/x.png
- con####.####.net/en_US/sdk.js
- d####.####.com/r/dd/id/L2NzaWQvMS9jaWQvMjYzNTYzMzIvdC8y/dpuid/33590649995/
- d####.####.net/demconf.jpg?et:ibs%7cdata:dpid=####&dpuuid=####&redir=####
- f####.####.com/css?family=####
- f####.####.com/s/opensans/v14/cJZKeOuBrn4kERxqtaUH3SZ2oysoEQEeKwjgmXLRnT...
- h####.com/js/bundles/article.js?bust=####
- i####.####.cc/s
- lo####.####.org/api/search/KeywordSearch?MaxHits=####&QueryString=####
- p####.####.cc/api/ads/check?md5=####&secret=####&app_v=####&app=####&sdk...
- p####.####.com/aa/y8a2thbi7v8xdodcoa82
- p####.####.com/sync/img?redir=####
- p####.####.com/ups/19764/sync?uid=####&_origin=####&redir=####
- st####.####.com/c/hotjar-113364.js?sv=####
- syn####.####.net/upi/pid/DuqQKWX7/?redir=####
- t####.####.com/site/31435?id=####&redir=####
- t####.####.com/usr?v=####&acc=####&id=####&jds=####&wst=####
- tra####.####.com/redir/?bl=####&tgds=####&tgda=####&tgdid=####&tgdredir=...
- u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
Запросы HTTP POST:
- a####.####.com/app_logs
- m####.####.com/v2/register
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/app_cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/app_dex/mocean-sdk.zip
- <Package Folder>/app_dex/mocean-sdk.zip.tmp
- <Package Folder>/app_tmpdex/mocean-sdk.zip
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/index
- <Package Folder>/databases/MsgLogStore.db-journal
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/databases/Zuoyoo_db
- <Package Folder>/databases/Zuoyoo_db-journal
- <Package Folder>/databases/app.manager-journal
- <Package Folder>/databases/mocean.database.ad-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/DaemonServer
- <Package Folder>/files/agoo.pid
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/AGOO_CONNECT.xml
- <Package Folder>/shared_prefs/AGOO_HOST.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/shared_prefs/AppStore.xml.bak
- <Package Folder>/shared_prefs/BSModelForPlaced.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/CountryRelevant.xml
- <Package Folder>/shared_prefs/CurArticleInfo.xml
- <Package Folder>/shared_prefs/GATHER.xml
- <Package Folder>/shared_prefs/GATHER.xml.bak
- <Package Folder>/shared_prefs/Game_recommend.xml
- <Package Folder>/shared_prefs/Game_recommend.xml.bak
- <Package Folder>/shared_prefs/MASTER_DATA.xml
- <Package Folder>/shared_prefs/MO.xml
- <Package Folder>/shared_prefs/MO.xml.bak
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml
- <Package Folder>/shared_prefs/Module_Switch_DATA.xml.bak
- <Package Folder>/shared_prefs/PhoneUtil.xml
- <Package Folder>/shared_prefs/Prophet.xml
- <Package Folder>/shared_prefs/WebViewSettings.xml
- <Package Folder>/shared_prefs/coolook.minisite.xml
- <Package Folder>/shared_prefs/test.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/updateVer.xml
- <Package Folder>/shared_prefs/v2_local_login.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/<Package>/####/51ade19fa9f51127a193bac0089d245e.jpg
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1z6zvfpz292r66bw5lmgi6f8b.0.tmp
- <SD-Card>/Android/####/25rq5n07ym2zjjisy8bf92jc0.0.tmp
- <SD-Card>/Android/####/2ql0blcc9oztuoqwf5zxfinte.0.tmp
- <SD-Card>/Android/####/4iy7jxd7mwrjkadxsu7xh0o2j.0.tmp
- <SD-Card>/Android/####/59bdjkv1xkb26ovo7t487fgha.0.tmp
- <SD-Card>/Android/####/5j5d90d4rstsz20wimgudy55o.0.tmp
- <SD-Card>/Android/####/5pkon9g2vsjkxno38qbwi40nh.0.tmp
- <SD-Card>/Android/####/6i37snv1m9z7hxvuic474q7jn.0.tmp
- <SD-Card>/Android/####/72ua7q3op5xoe7k7l5r4xq8ne.0.tmp
- <SD-Card>/Android/####/delay_20170727081849701_dcbe4cdcdad9482d015c23f2b6eb3cb5_s.dat
- <SD-Card>/Android/####/delay_20170727081900842_dcbe4cdcdad9482d015c23f2b6eb3cb5_s.dat
- <SD-Card>/Android/####/delay_20170727081902715_dcbe4cdcdad9482d015c23f2b6eb3cb5_s.dat
- <SD-Card>/Android/####/delay_20170727081904337_dcbe4cdcdad9482d015c23f2b6eb3cb5_s.dat
- <SD-Card>/Android/####/delay_20170727081922526_dcbe4cdcdad9482d015c23f2b6eb3cb5_s.dat
- <SD-Card>/Android/####/delay_20170727081922895_dcbe4cdcdad9482d015c23f2b6eb3cb5_s.dat
- <SD-Card>/Android/####/delay_20170727081923036_dcbe4cdcdad9482d015c23f2b6eb3cb5_s.dat
- <SD-Card>/Android/####/delay_20170727081923366_dcbe4cdcdad9482d015c23f2b6eb3cb5_s.dat
- <SD-Card>/Android/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D %7B%22package%22%3A%22<Package>%22%2C%22appKey%22%3A%22umeng%3A5719f92667e58e5665000543%22%2C%22utdid%22%3A%22WXmh36XP2wIDAGdzx1FpVZ5Z%22%2C%22sdkVersion%22%3A%2220151015%22%7D -I 100.69.168.33 -O 80 -T -Z
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 755 /data/data/com.poboo.news.headline/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- sh
Загружает динамические библиотеки:
- libjiagu
- tnet-2.1.20
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- DES
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
