Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.297.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) m####.eas####.com.####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) app.91sh####.com:80
- TCP(HTTP/1.1) t####.eas####.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) 08.img####.eas####.####.com:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(TLS/1.0) m####.eas####.com.####.com:443
- TCP(TLS/1.0) ot.dftou####.com:443
- TCP(TLS/1.0) t####.eas####.com:443
- TCP(TLS/1.0) softw####.dftou####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) wapac####.dftou####.com:443
- TCP(TLS/1.0) z####.myz####.com:443
- TCP(TLS/1.0) aboutco####.dftou####.com:443
- TCP(TLS/1.0) tou####.eas####.com:443
Запросы DNS:
- 08.img####.eas####.com
- a####.u####.com
- aboutco####.dftou####.com
- app.91sh####.com
- feed####.u####.com
- hm.b####.com
- imgc####.qq.com
- m####.eas####.com
- mi.g####.qq.com
- ot.dftou####.com
- s####.e.qq.com
- softw####.dftou####.com
- t####.eas####.com
- tou####.eas####.com
- wapac####.dftou####.com
- z####.myz####.com
Запросы HTTP GET:
- app.91sh####.com/index.php/apps/root?json=####
- m####.eas####.com.####.com/mobile/170911232948152.html?qid=####
- m####.eas####.com.####.com/toutiaoh5/channeljs/h5toutiao/h5toutiaocookie...
- m####.eas####.com.####.com/toutiaoh5/channeljs/h5toutiao/xianguo/ttdetai...
- mi.g####.qq.com/gdt_mview.fcg?datatype=####&posid=####&count=####&r=####...
- t####.eas####.com/lpjnmjnpdmchiycjn.js
- t####.eas####.com/p3ds7ahq36.js
- t####.eas####.com/ygdgewvph5.js
Запросы HTTP POST:
- app.91sh####.com/index.php/bitInfomation/list
- s####.e.qq.com/activate
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar.sig
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp.sig
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.sig
- <Package Folder>/app_e_qq_com_setting/gdt_suid
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.sig
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/####/1ab795d771ba98170b40782063ef0ae9.0.tmp
- <Package Folder>/cache/####/1ab795d771ba98170b40782063ef0ae9.1.tmp
- <Package Folder>/cache/####/2b1a5f4bf874c61bbace081975bb0362.0.tmp
- <Package Folder>/cache/####/2b1a5f4bf874c61bbace081975bb0362.1.tmp
- <Package Folder>/cache/####/7a712d09db247999fd0a1c4dd19d509d.0.tmp
- <Package Folder>/cache/####/7a712d09db247999fd0a1c4dd19d509d.1.tmp
- <Package Folder>/cache/####/879de68feafbdbcea68c6e649dd50969.0.tmp
- <Package Folder>/cache/####/879de68feafbdbcea68c6e649dd50969.1.tmp
- <Package Folder>/cache/####/8b5b1797916c0c091ba8b3248a0d0311.0.tmp
- <Package Folder>/cache/####/8b5b1797916c0c091ba8b3248a0d0311.1.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/app_cache.db
- <Package Folder>/databases/app_cache.db-journal
- <Package Folder>/databases/app_folder.db
- <Package Folder>/databases/app_folder.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/databases/xUtils_http_cache.db
- <Package Folder>/databases/xUtils_http_cache.db-journal
- <Package Folder>/databases/xUtils_http_cookie.db
- <Package Folder>/databases/xUtils_http_cookie.db-journal
- <Package Folder>/databases/xUtils_http_cookie.db-journal (deleted)
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/.imprint
- <Package Folder>/files/daemon
- <Package Folder>/files/mobclick_agent_cached_<Package>495
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/Setting.xml
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/memory_warn.xml
- <Package Folder>/shared_prefs/rootname.xml
- <Package Folder>/shared_prefs/umeng_feedback_conversations.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/daemon <Package>/<Package>.service.CoreService
- <Package Folder>/files/daemon <Package>/com.recommended.advert.service.ADCoreService
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/files/daemon
- ps
- sh <Package Folder>/files/daemon <Package>/<Package>.service.CoreService
- sh <Package Folder>/files/daemon <Package>/com.recommended.advert.service.ADCoreService
Загружает динамические библиотеки:
- libjiagu
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS7Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS7Padding
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
