Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Moplus.1
Сетевая активность:
Подключается к:
- a####.####.com
Запросы HTTP POST:
- a####.####.com/amdc/mobileDispatch?appkey=####&platform=####&v=####&devi...
- a####.####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/cache/####/-1119943412-1026428099
- <Package Folder>/cache/####/-1119943412-1106754948
- <Package Folder>/cache/####/-1119943412-1587334280
- <Package Folder>/cache/####/-1119943412-1780367107
- <Package Folder>/cache/####/-1119943412-204550339
- <Package Folder>/cache/####/-1119943412-244553023
- <Package Folder>/cache/####/-1119943412-677036031
- <Package Folder>/cache/####/-11199434121155825149
- <Package Folder>/cache/####/-11199434121188670143
- <Package Folder>/cache/####/-11199434121266014782
- <Package Folder>/cache/####/-11199434121383691677
- <Package Folder>/cache/####/-11199434122137630685
- <Package Folder>/cache/####/-1625470471-2011215720
- <Package Folder>/cache/####/-358507287-585707238
- <Package Folder>/cache/####/-358507292973364059
- <Package Folder>/cache/####/-556173619-1555133159
- <Package Folder>/cache/####/-556173619-710661288
- <Package Folder>/cache/####/-5561736191050890395
- <Package Folder>/cache/####/-556173619133810583
- <Package Folder>/cache/####/-5561736191895362266
- <Package Folder>/cache/####/1783174223-1826332699
- <Package Folder>/cache/####/1783174223-2013177653
- <Package Folder>/cache/####/1783174223-631010513
- <Package Folder>/cache/####/1783174223-820150320
- <Package Folder>/cache/####/17831742231375694516
- <Package Folder>/cache/####/17831742231485320164
- <Package Folder>/cache/####/17831742231850744012
- <Package Folder>/cache/####/17831742232069526648
- <Package Folder>/cache/####/1783174223792545094
- <Package Folder>/cache/####/178317422393978298
- <Package Folder>/cache/####/1783174230-903732747
- <Package Folder>/cache/####/17831742301802886647
- <Package Folder>/cache/####/17831742302037924852
- <Package Folder>/cache/####/1783174230449576950
- <Package Folder>/cache/####/1783174230684615155
- <Package Folder>/cache/####/4syRMQO7-mXrViTJ39MYRGPnk2M.-1974402123.tmp
- <Package Folder>/cache/####/855605097-768983534
- <Package Folder>/cache/####/958462991-1269181978
- <Package Folder>/cache/####/958462991-1423907682
- <Package Folder>/cache/####/958462991-1524032961
- <Package Folder>/cache/####/958462991-1569169344
- <Package Folder>/cache/####/958462991-1603486103
- <Package Folder>/cache/####/958462991-1669841034
- <Package Folder>/cache/####/958462991-1755041352
- <Package Folder>/cache/####/958462991-1765227384
- <Package Folder>/cache/####/958462991-1768405147
- <Package Folder>/cache/####/958462991-1819679401
- <Package Folder>/cache/####/958462991-1881529412
- <Package Folder>/cache/####/958462991-1909720293
- <Package Folder>/cache/####/958462991-1911804084
- <Package Folder>/cache/####/958462991-2095755411
- <Package Folder>/cache/####/958462991-229786526
- <Package Folder>/cache/####/958462991-259510188
- <Package Folder>/cache/####/958462991-341223208
- <Package Folder>/cache/####/958462991-531823694
- <Package Folder>/cache/####/958462991-694580022
- <Package Folder>/cache/####/9584629911180017287
- <Package Folder>/cache/####/9584629911257635437
- <Package Folder>/cache/####/9584629911540540327
- <Package Folder>/cache/####/9584629911659341467
- <Package Folder>/cache/####/9584629911767948139
- <Package Folder>/cache/####/9584629911807988920
- <Package Folder>/cache/####/9584629911827701799
- <Package Folder>/cache/####/9584629911883663852
- <Package Folder>/cache/####/9584629911962440092
- <Package Folder>/cache/####/958462991368627299
- <Package Folder>/cache/####/958462991448852627
- <Package Folder>/cache/####/958462991725707609
- <Package Folder>/cache/####/958462991847926541
- <Package Folder>/cache/####/958462991917233357
- <Package Folder>/cache/####/958462991925771077
- <Package Folder>/cache/####/958462991964384150
- <Package Folder>/cache/####/Lhr3jqTkBVSsSjzGZU7Cw67AWwE.-1660647497.tmp
- <Package Folder>/cache/####/MOvXJ8Ru2H1nDhD2RvBR-d9xMoU.1236621888.tmp
- <Package Folder>/cache/####/Rk_agrNTSzwP_OfIkQj31txm59E.-897062792.tmp
- <Package Folder>/cache/####/cffYP2VVXzuspZbrh33zVXYigkA.-149569960.tmp
- <Package Folder>/cache/####/qu226Vp5JVtAyTVvEiZ_Rn5NlXc.1018560420.tmp
- <Package Folder>/cache/####/qxz7XNnJypC5e9nJVtPvWtoUb3w.-868643145.tmp
- <Package Folder>/cache/####/wNgJpRHE_-_fvlXbdTyz1GCbRT8.1903399532.tmp
- <Package Folder>/cache/####/xYKzU6ME5_wuZpCa_cSocNBbiHk.1888283443.tmp
- <Package Folder>/databases/MessageStore.db-journal
- <Package Folder>/databases/MsgLogStore.db-journal
- <Package Folder>/databases/accs.db-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/kf_9801_ISME9754_guest947919653820030414256097187703540371123-journal
- <Package Folder>/databases/meici.db-journal
- <Package Folder>/databases/message_accs_db
- <Package Folder>/databases/message_accs_db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal (deleted)
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/DaemonServer
- <Package Folder>/files/agoo.pid
- <Package Folder>/files/exid.dat
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/ACCS_LOAD_SO.xml
- <Package Folder>/shared_prefs/ACCS_SDK.xml
- <Package Folder>/shared_prefs/ACCS_SDK_CHANNEL.xml
- <Package Folder>/shared_prefs/ACCS_SDK_CHANNEL.xml.bak
- <Package Folder>/shared_prefs/Agoo_AppStore.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/XNSDKStore1.0.xml
- <Package Folder>/shared_prefs/XNclientid.xml
- <Package Folder>/shared_prefs/XNmachineid.xml
- <Package Folder>/shared_prefs/app_share.xml
- <Package Folder>/shared_prefs/com.networkbench.agent.impl.v2_<Package>.xml
- <Package Folder>/shared_prefs/com.networkbench.agent.impl.v2_<Package>.xml.bak
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/umeng_socialize.xml
- <Package Folder>/shared_prefs/xnsdkconfig.xml
- <Package Folder>/shared_prefs/xnsdkconfig.xml.bak
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/0.png
- <SD-Card>/Android/####/1.png
- <SD-Card>/Android/####/2.png
- <SD-Card>/Android/####/3.png
- <SD-Card>/Android/####/39fcbfd4cff747f1a4d8f6a554d02d82
- <SD-Card>/Android/####/4.png
- <SD-Card>/Android/####/6b4e2b1599d64b1584b77b6db625b7bd
Другие:
Запускает следующие shell-скрипты:
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- sh
Загружает динамические библиотеки:
- bitmaps
- gifimage
- libjiagu
- memchunk
- nbsdc2.0
- tnet-3.1
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- DES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- DES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
