Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Spy.127.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) ap####.sc.p####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) d####.g####.p####.com:80
- TCP(HTTP/1.1) sr3.pp####.cn:80
- TCP(HTTP/1.1) ads.a####.p####.com:80
- TCP(HTTP/1.1) way.p####.com:80
- TCP(HTTP/1.1) gro####.p####.com:80
- TCP(HTTP/1.1) de.as.p####.com:80
- TCP(HTTP/1.1) m####.api.p####.com:80
- TCP(HTTP/1.1) sr2.pp####.cn:80
- TCP(HTTP/1.1) cld####.mo####.p####.com:80
- TCP(HTTP/1.1) w####.p####.com.####.com:80
- TCP(HTTP/1.1) apilo####.a####.com:80
- TCP(HTTP/1.1) sr2.pp####.com:80
- TCP(HTTP/1.1) api.usergr####.p####.com:80
- TCP(HTTP/1.1) epg.api.p####.com:80
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) api.pass####.p####.com:443
Запросы DNS:
- 2.and####.p####.####.org
- a####.u####.com
- ads.a####.p####.com
- and####.cli####.go####.com
- ap####.sc.p####.com
- api####.a####.com
- api.pass####.p####.com
- api.usergr####.p####.com
- cld####.mo####.p####.com
- de.as.p####.com
- epg.api.p####.com
- gas.d####.pp####.com
- gro####.p####.com
- i####.pp####.cn
- ios.syna####.com
- m####.api.p####.com
- mt####.go####.com
- sp####.mo####.p####.com
- sr1.pp####.cn
- sr1.pp####.com
- sr2.pp####.cn
- sr2.pp####.com
- sr3.pp####.cn
- sr3.pp####.com
- sr4.pp####.cn
- sr4.pp####.com
- sta####.pp####.cn
- t####.p####.com
- v.img.pp####.cn
- way.p####.com
Запросы HTTP GET:
- w####.p####.com.####.com/49/31/493177fc6874beeca512c1330f1fcf6b/3.jpg.webp
- w####.p####.com.####.com/cms/14/24/d2b37f1e306938e9e0bf1ade235e24f3.png
- w####.p####.com.####.com/cms/19/13/de5f123f0eea25fd412227ae7e36c196.png
- w####.p####.com.####.com/cms/20/48/3ca7889db8b07c62dc914a2201694f8e.png
- w####.p####.com.####.com/cms/39/35/f5e255e4cbf8c6ace832ba82d318d983.png
- w####.p####.com.####.com/cms/40/08/420462a279acbe7b942cfe917564f7bb.png
- w####.p####.com.####.com/cp308/01/97/0197ca5f68ad49948a388ad81fb6c9e4/3....
- w####.p####.com.####.com/cp308/49/31/493177fc6874beeca512c1330f1fcf6b/3....
- w####.p####.com.####.com/cp308/70/1a/701a5829a55a752aceae32390c842208/3....
- w####.p####.com.####.com/cp308/70/66/7066fa2403b39413d1b1ef2d04522626/15...
- w####.p####.com.####.com/mini/v3/111202/v_20151102160940/js_frame/jquery...
Запросы HTTP POST:
- apilo####.a####.com/v3/log/init
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/index
- <Package Folder>/cache/applog.log
- <Package Folder>/databases/_ire-journal
- <Package Folder>/databases/pptv.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/.imprint
- <Package Folder>/files/configcenter.txt
- <Package Folder>/files/exitadinfo
- <Package Folder>/files/globalConfig.txt
- <Package Folder>/files/libjiagu.so
- <Package Folder>/files/mobclick_agent_cached_<Package>999999999
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/MATSharedPreferences.xml
- <Package Folder>/shared_prefs/USER_BILLING.xml
- <Package Folder>/shared_prefs/cn.com.mma.mobile.tracking.other.xml
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/config.xml.bak
- <Package Folder>/shared_prefs/download.xml
- <Package Folder>/shared_prefs/last_know_location.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/pptv.xml
- <Package Folder>/shared_prefs/speed_test.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/unicom.xml
- <Package Folder>/shared_prefs/view_from.xml
- <Package Folder>/shared_prefs/webp.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/PPTV/####/-1004717201.tmp
- <SD-Card>/PPTV/####/-1013931056
- <SD-Card>/PPTV/####/-1120058866.tmp
- <SD-Card>/PPTV/####/-1178884842.tmp
- <SD-Card>/PPTV/####/-1206800092.tmp
- <SD-Card>/PPTV/####/-1363030419.tmp
- <SD-Card>/PPTV/####/-1367502964
- <SD-Card>/PPTV/####/-1367665156
- <SD-Card>/PPTV/####/-136849812.tmp
- <SD-Card>/PPTV/####/-1372088531.tmp
- <SD-Card>/PPTV/####/-1441862793.tmp
- <SD-Card>/PPTV/####/-1442950262
- <SD-Card>/PPTV/####/-1454352229.tmp
- <SD-Card>/PPTV/####/-145567126.tmp
- <SD-Card>/PPTV/####/-1457798472.tmp
- <SD-Card>/PPTV/####/-1573876240.tmp
- <SD-Card>/PPTV/####/-1624000149
- <SD-Card>/PPTV/####/-1654938622.tmp
- <SD-Card>/PPTV/####/-1693854143.tmp
- <SD-Card>/PPTV/####/-1824633993.tmp
- <SD-Card>/PPTV/####/-1844911933.tmp
- <SD-Card>/PPTV/####/-1871011426.tmp
- <SD-Card>/PPTV/####/-1917343619
- <SD-Card>/PPTV/####/-1920326167.tmp
- <SD-Card>/PPTV/####/-1992238347.tmp
- <SD-Card>/PPTV/####/-1998943599
- <SD-Card>/PPTV/####/-2020577616.tmp
- <SD-Card>/PPTV/####/-2046700463.tmp
- <SD-Card>/PPTV/####/-2106605619.tmp
- <SD-Card>/PPTV/####/-252445440.tmp
- <SD-Card>/PPTV/####/-311146098.tmp
- <SD-Card>/PPTV/####/-434886813.tmp
- <SD-Card>/PPTV/####/-465549933.tmp
- <SD-Card>/PPTV/####/-472017645.tmp
- <SD-Card>/PPTV/####/-492189961
- <SD-Card>/PPTV/####/-50650037.tmp
- <SD-Card>/PPTV/####/-50977411.tmp
- <SD-Card>/PPTV/####/-577683169.tmp
- <SD-Card>/PPTV/####/-582196208.tmp
- <SD-Card>/PPTV/####/-587140642.tmp
- <SD-Card>/PPTV/####/-591460954
- <SD-Card>/PPTV/####/-605536553
- <SD-Card>/PPTV/####/-613110399.tmp
- <SD-Card>/PPTV/####/-645134678.tmp
- <SD-Card>/PPTV/####/-736216026.tmp
- <SD-Card>/PPTV/####/-763530820
- <SD-Card>/PPTV/####/-793054303
- <SD-Card>/PPTV/####/-856833734.tmp
- <SD-Card>/PPTV/####/-874057658.tmp
- <SD-Card>/PPTV/####/-893013318.tmp
- <SD-Card>/PPTV/####/-909848686.tmp
- <SD-Card>/PPTV/####/-918458564
- <SD-Card>/PPTV/####/-973936252.tmp
- <SD-Card>/PPTV/####/1094408075.tmp
- <SD-Card>/PPTV/####/1122221299.tmp
- <SD-Card>/PPTV/####/1172701200
- <SD-Card>/PPTV/####/1178090333
- <SD-Card>/PPTV/####/1277273066
- <SD-Card>/PPTV/####/1331393913
- <SD-Card>/PPTV/####/1357907092.tmp
- <SD-Card>/PPTV/####/1410683537.tmp
- <SD-Card>/PPTV/####/1425710760.tmp
- <SD-Card>/PPTV/####/1485984463.tmp
- <SD-Card>/PPTV/####/1547050581
- <SD-Card>/PPTV/####/154953851
- <SD-Card>/PPTV/####/1553521954.tmp
- <SD-Card>/PPTV/####/1667839436
- <SD-Card>/PPTV/####/1672064533.tmp
- <SD-Card>/PPTV/####/1690931691.tmp
- <SD-Card>/PPTV/####/1749775815.tmp
- <SD-Card>/PPTV/####/1908931340.tmp
- <SD-Card>/PPTV/####/1949761113.tmp
- <SD-Card>/PPTV/####/1992467691
- <SD-Card>/PPTV/####/2012974520.tmp
- <SD-Card>/PPTV/####/2019473557.tmp
- <SD-Card>/PPTV/####/208314102.tmp
- <SD-Card>/PPTV/####/318641848.tmp
- <SD-Card>/PPTV/####/343171302
- <SD-Card>/PPTV/####/347057897.tmp
- <SD-Card>/PPTV/####/443242474
- <SD-Card>/PPTV/####/460567684.tmp
- <SD-Card>/PPTV/####/52136612.tmp
- <SD-Card>/PPTV/####/54939787.tmp
- <SD-Card>/PPTV/####/561934565.tmp
- <SD-Card>/PPTV/####/691890103
- <SD-Card>/PPTV/####/802207835.tmp
- <SD-Card>/PPTV/####/848256716
- <SD-Card>/PPTV/####/911273495.tmp
- <SD-Card>/PPTV/####/965397903.tmp
- <SD-Card>/PPTV/####/_livetab1
- <SD-Card>/PPTV/####/_livetab47
- <SD-Card>/PPTV/####/_livetabtab
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/files/libjiagu.so
Загружает динамические библиотеки:
- breakpad_util_jni
- libjiagu
- libppbox_jni-android-x86-gcc44-mt-1.1.0
- meet
- mresearch
- ppbox_jni-android-x86-gcc44-mt-1.1
- subtitle-jni
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
- DESede-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- DES-CBC-PKCS5Padding
- DESede-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Отрисовывает собственные окна поверх других приложений.
