Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.247.origin
- Android.Triada.248.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- 1####.####.1
- 1####.####.190:8088
- 1####.####.1:8088
- 1####.####.88
- 1####.####.88:8999
- 6####.####.140
- a####.####.com
- c####.####.com
- i####.####.com
- l####.####.com
- res####.####.com
Запросы HTTP GET:
- 1####.####.190:8088/sdkserver/adData/adInfo/sdk/1501432303194.jar
- 1####.####.88/catServer/upload/images/b4cb02bb-60e4-4428-b2d8-ef0aaf2f76...
- 6####.####.140/ando/i/mon?k=####&d=####
- i####.####.com/ando-res/ads/0/9/837ec120-ccf8-4ad0-b6fd-1303ff645eca/773...
- res####.####.com/v3/ip?key=####
Запросы HTTP POST:
- 1####.####.1/sdkserver/v2/updateSdk
- 1####.####.1:8088/sdkserver/v2/appActive
- 1####.####.88:8999/catServer/recommend!status.action
- a####.####.com/app_logs
- c####.####.com/ad/splash/stats.html
- l####.####.com/sdk.php
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/cache/####/00582cc4f4e9a38eb429283f9d5c9332c8dc801bfcb89e13299af53eea8170d2.0.tmp
- <Package Folder>/cache/####/056e8f7b36c4fb0f11acbb07988aee0106918f6ad06dc17d562d161aa59edfb1.0.tmp
- <Package Folder>/cache/####/0a6527013df727a1c60c80cc05665969030acfb0cbc4b38e3bbff4e45d01d164.0.tmp
- <Package Folder>/cache/####/1620e5071130b02e3a99f795ef7c7130c477ca04e48fd1fcb839c59d9473b4f7.0.tmp
- <Package Folder>/cache/####/16c59c26be623719f3f1f4f2e571e4af34ced2afd4df2ce372129b218e364d95.0.tmp
- <Package Folder>/cache/####/1799ad83db351a8de906409e322f6042224ad1b8df57698089377ed7fc318fe3.0.tmp
- <Package Folder>/cache/####/19095fe735982cc8a543c2ad9c740eeb04ce18fb55910424abf391f9896f8ada.0.tmp
- <Package Folder>/cache/####/1c8addf5c0fc863be99d026db07164f75bf78f2ab18f6c856f537be3f4421f84.0.tmp
- <Package Folder>/cache/####/2a1c335514d38c3c62d5c96eba7735fdf3a07fb166a8f8dcdf35c4a97eee3f1d.0.tmp
- <Package Folder>/cache/####/48a079922c922c2344aa495ee193d1cdf3d3e01a408f6bcc626a57821838d7f6.0.tmp
- <Package Folder>/cache/####/52d5cfa6503b7fb46fc4961f2b72f9b9adf65f6f14d59e55f0cb7d43f4ea82ec.0.tmp
- <Package Folder>/cache/####/531f9947b36503b9c2dccccea2c0c7eb0cc679b0e99f727f7672f99023956e1b.0.tmp
- <Package Folder>/cache/####/54569d5fc4351e4c41b2aa2b60cdf2596df361395427e48490772f3f29a4fe4f.0.tmp
- <Package Folder>/cache/####/65f0854e790a0f39ce76b6d6ac8382d036e4306695b927bd0f9c623d89aed2cb.0.tmp
- <Package Folder>/cache/####/69ed3c1d38cb34cab36086863f6db26e2f744153deb4ab0ee4ee961c43687287.0.tmp
- <Package Folder>/cache/####/75fe8c30f121248139e00893a0723b2438922df355d0f20788b4d5f4142990ea.0.tmp
- <Package Folder>/cache/####/7f9322b79c970cb7bae53e1b777567ba7fd9044bb8382a7318cc053d241dc23a.0.tmp
- <Package Folder>/cache/####/9b484806806ffa6e1212e343d49429d4bcd860042a5e7d9e52dfd0e364fbef59.0.tmp
- <Package Folder>/cache/####/a990adc6e9679d05b21e295633228158f2d717d9129c49c2d61cf691f39ee997.0.tmp
- <Package Folder>/cache/####/b27f04bf4a5dc547d1864632c1360099c394627a975a6a4d982a7bbe1a640334.0.tmp
- <Package Folder>/cache/####/c31c8641406461c3d6a1172e3b3bdbcb2c87559fb495439572c2081a723cf40a.0.tmp
- <Package Folder>/cache/####/d06b2202b57cdd6ad0d6b268b1c09c8103a6232b4c10eedeffe317628bdf4aca.0.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/e336adc1b3f560a3c85718aca708daa08b45c683b7b1dc2eaaf652045596e0f0.0.tmp
- <Package Folder>/cache/####/eda48f3ba03761a50904b29cf53ebb8cccf1709c399cdc869ccc49c1b5e115f8.0.tmp
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/code-615988/OV7My241398KFRlZ
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_34BSyZL39iGB9YYIwSscVcFKUJU=
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_34BSyZL39iGB9YYIwSscVcFKUJU=-journal
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_6Kz-eE6d6l7kTdLgJ8r1TQ==
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_6Kz-eE6d6l7kTdLgJ8r1TQ==-journal
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_E2UNg5g49J2xaFTKcqHe6A==
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_E2UNg5g49J2xaFTKcqHe6A==-journal
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_eHMV8l3HPHA1CcKK
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_eHMV8l3HPHA1CcKK-journal
- <Package Folder>/databases/XGbZrxr0Ugj6S3CDvZasM3nMoItfofT7NKKTfTtRm6A=_qwpwLdwN1P0=-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/download.db-journal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/01qyeJCL7Avv2toPJA3ICjpPDPjUAp7J.new
- <Package Folder>/files/####/0WlhtfnjVgp2BSio.zip
- <Package Folder>/files/####/0xSKJUkgLwWLADxNUFbZjwHi4U-lCxW1.new
- <Package Folder>/files/####/21bb45e3-fb92-4d7d-9c71-05ae0133fe09.pic.temp
- <Package Folder>/files/####/33df772d-4732-459e-bb6c-6cf850ddedab.pic
- <Package Folder>/files/####/3XHGhTVS_mfNuA9XJz9hswFJW_g=.new
- <Package Folder>/files/####/40CffEF8JfC5MJYwQDkAexF_-WatFdCO.new
- <Package Folder>/files/####/4f2CdI-oIsKU5YuNMPXvg0m_0x4=.new
- <Package Folder>/files/####/5KuO6aP_t8wWBjdKl8zz_kduO5ylunJjt12rPg==.new
- <Package Folder>/files/####/60823eb4-60aa-438c-a5e4-20647822b9c2.pic.temp
- <Package Folder>/files/####/722ac97b-4d14-4c9f-a593-6dc98f77be8e.pic.temp
- <Package Folder>/files/####/7RDDWfLNhpZNS_mx5tV0virxN71dBZGcAQzBLMmunJo=.new
- <Package Folder>/files/####/90362345-6bb5-41ea-aa65-8982c92f5188.pic.temp
- <Package Folder>/files/####/90_rpEvDvWqn7f_-.new
- <Package Folder>/files/####/AVPBi795FYhmuVtM_CtGmg==.new
- <Package Folder>/files/####/D3pyU8EGr3ZePVpw
- <Package Folder>/files/####/D3pyU8EGr3ZePVpw.temp
- <Package Folder>/files/####/D4K8ZEUaVatPr353QE50EBsYO0501jwV.new
- <Package Folder>/files/####/G4hskoX5ZJ-SItFh3r82cb5jFj_6JpgJ.new
- <Package Folder>/files/####/HZK4AW_Fm96dngX1PsBYamfTwrQ=
- <Package Folder>/files/####/H_t4lqWxt2UHp1rwJJAJA29dB3xx3NtAKn5cUg==.new
- <Package Folder>/files/####/HonasbibWvgEwNERZzSI_tMtebXfo-jNHDnMVDyvMXA=.new
- <Package Folder>/files/####/UNPYuN5inVGlBkGUHqtaDg==
- <Package Folder>/files/####/UNPYuN5inVGlBkGUHqtaDg==.new
- <Package Folder>/files/####/Uj_hXDnBHAE64grrPaGfrGzUSmG46ktmOr3-HMeumNs=.new
- <Package Folder>/files/####/XsLCYPQZcxuKGoCc6Hs6SYKeTeA8O4ke.new
- <Package Folder>/files/####/ZOw7fflL91xopaQID6tcHJ-VWeo=.new
- <Package Folder>/files/####/b1d1a23c-5710-4546-b449-5fe4c13624f6.pic.temp
- <Package Folder>/files/####/e16a60f4-414a-4749-a41a-a149cca1f726.pic.temp
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/f83ac51e-e8fd-46cf-91ca-1df0f78bc3d5.pic
- <Package Folder>/files/####/gr9Z-HG1eLAjzuwsSSbtv5vniwgfhl6g756-Mg==.new
- <Package Folder>/files/####/gvthDKzyQenis3up6W4zfCGPXJ7NsiDY.new
- <Package Folder>/files/####/he3EGGMU2qlPKce7THE039KdXRLqxX6ShqF2Rr-5eMI=.new
- <Package Folder>/files/####/j1CtV8k6BEaQwwud9Al5KcFoFY8YJG5I
- <Package Folder>/files/####/j1CtV8k6BEaQwwud9Al5KcFoFY8YJG5I.new
- <Package Folder>/files/####/j1CtV8k6BEaQwwud9Al5KcFoFY8YJG5I.old (deleted)
- <Package Folder>/files/####/jKGe5cnBoJmOsoBJ-UASrQ==
- <Package Folder>/files/####/lQv2yBYrdeb08-mZb6tAWg==
- <Package Folder>/files/####/lQv2yBYrdeb08-mZb6tAWg==.new
- <Package Folder>/files/####/n0hfizZl3Lr2XqWzk6uYd95yS0g=.new
- <Package Folder>/files/####/qPs-iXdI-nwbP-z6XqUq5ZGN9OI=
- <Package Folder>/files/####/runner_info.prop.new
- <Package Folder>/files/####/txdcxq_f.zip
- <Package Folder>/files/####/vrBbjE3UQq3hnpX75a2_iA==
- <Package Folder>/files/.imprint
- <Package Folder>/files/exid.dat
- <Package Folder>/files/patch.jar
- <Package Folder>/files/rdata_comandroidsupport.new
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/ad_show_time.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/share_data.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/.armsd/####/5NCMj4FHDAiNMsrjQKob6JdxZXM=.new
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M
- <SD-Card>/.armsd/####/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M.lk
- <SD-Card>/.armsd/####/MP8MtaBuguN9jnuSwtN1kQ==
- <SD-Card>/.armsd/####/ae07c806-7bc0-4987-829a-dbd5bd96955b.res
- <SD-Card>/.armsd/####/ae23f242-b5c4-4512-8337-4ee9303bcd2f.res
- <SD-Card>/.armsd/####/ccf3c107-e24c-419b-9b40-c1745d62e93d.res
- <SD-Card>/.armsd/####/d5efddde-dd30-4144-8c6d-d9a7914a104a.res
- <SD-Card>/.armsd/####/r_pkDgN4OhnkSa0D
- <SD-Card>/.env/.uunique.new
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/code-615988/OV7My241398KFRlZ -p <Package> -c com.android.support.vajdxa.hi.hi.pw.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- sh <Package Folder>/code-615988/OV7My241398KFRlZ -p <Package> -c com.android.support.vajdxa.hi.hi.pw.c -r /storage/emulated/0/.armsd/tjfblFPob85GtAQw/I7HE1pd26tdvkjhloLWlx5UBeDOAmh6M -d /storage/emulated/0/Download/ladung
Загружает динамические библиотеки:
- libjiagu
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- RSA
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS7Padding
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
