Android.Packed.29789

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.Spy.127.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(GCM) <Google Host>
TCP(HTTP/1.1) d####.g####.p####.com:80
TCP(HTTP/1.1) sdk.o####.lbs.####.com:80
TCP(HTTP/1.1) cld####.mo####.p####.com:80
TCP(HTTP/1.1) sr2.pp####.cn:80
TCP(HTTP/1.1) sr2.pp####.com:80
TCP(HTTP/1.1) api.usergr####.p####.com:80
TCP(HTTP/1.1) ap####.sc.p####.com:80
TCP(HTTP/1.1) i####.clou####.su####.cn:80
TCP(HTTP/1.1) recom####.p####.com:80
TCP(HTTP/1.1) t####.c####.l####.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) ac.vip.p####.com:80
TCP(HTTP/1.1) sr3.pp####.cn:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) and####.co####.syna####.com:80
TCP(HTTP/1.1) gro####.p####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sr1.pp####.cn:80
TCP(HTTP/1.1) m.i####.com:80
TCP(HTTP/1.1) s####.p####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) apm.su####.cn:80
TCP(HTTP/1.1) apilo####.a####.com:80
TCP(HTTP/1.1) w####.p####.com.####.com:80
TCP(HTTP/1.1) int.d####.s####.####.cn:80
UDP(NTP) 2.and####.p####.####.org:123
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) api.pass####.p####.com:443
TCP(TLS/1.0) 1####.96.131.30:19602
TCP c####.g####.ig####.com:5224
TCP sdk.o####.t####.####.com:5224
TCP ppmess####.p####.com:19601

Запросы DNS:

2.and####.p####.####.org
30.131.96.####.arpa
7j####.c####.z0.####.com
a####.u####.com
ac.vip.p####.com
and####.cli####.go####.com
and####.co####.syna####.com
ap####.sc.p####.com
api####.a####.com
api.pass####.p####.com
api.usergr####.p####.com
apm.su####.cn
c####.g####.ig####.com
c-h####.g####.com
cld####.mo####.p####.com
epg.api.p####.com
gro####.p####.com
i####.pp####.cn
i####.pp####.cn
i####.pp####.cn
i####.pp####.cn
i####.su####.cn
int.d####.s####.####.cn
ios.syna####.com
m####.api.p####.com
m.i####.com
mt####.go####.com
plt.d####.pp####.com
ppmess####.p####.com
recom####.p####.com
s####.p####.com
sdk.c####.ig####.com
sdk.o####.lbs.####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sp####.mo####.p####.com
sr1.pp####.cn
sr1.pp####.com
sr2.pp####.cn
sr2.pp####.com
sr3.pp####.cn
sr3.pp####.com
sr4.pp####.cn
sr4.pp####.com
t####.p####.com
v.img.pp####.cn
vas.d####.pp####.com
way.p####.com

Запросы HTTP GET:

int.d####.s####.####.cn/iplookup/iplookup.php?format=####
t####.c####.l####.####.com/config/hz-hzv3.conf
w####.p####.com.####.com/2008/06/19/14183671316.jpg.webp
w####.p####.com.####.com/2013/06/28/11215911183_230X306.jpg.webp
w####.p####.com.####.com/2016/01/22/14385884645.jpg.webp
w####.p####.com.####.com/2016/07/05/16561636731_230X306.jpg.webp
w####.p####.com.####.com/2016/07/29/11025340412.jpg.webp
w####.p####.com.####.com/2017/03/02/14574724094.jpg.webp
w####.p####.com.####.com/cms/11/69/5bf97bf564ef8c28b34602220b5e7c66.jpg....
w####.p####.com.####.com/cms/11/82/498e9bc11b86c89e1534848c19f05919.png
w####.p####.com.####.com/cms/12/29/c7c5c302c5f8d5e85a2acaca2701f72d.png
w####.p####.com.####.com/cms/18/58/ec1c4e42822e782f3e2dd1e555b82d34.png
w####.p####.com.####.com/cms/19/13/de5f123f0eea25fd412227ae7e36c196.png
w####.p####.com.####.com/cms/19/52/7b768fcbcfa72e2eb3f1b0c3e0b5c1e7.png
w####.p####.com.####.com/cms/20/31/a51d01af15f30998525d863bf3d597f7.png
w####.p####.com.####.com/cms/20/79/cc02f82784de9abd9983cc87518ba3f4.png
w####.p####.com.####.com/cms/21/79/4fdd9c009d1cb7c961d5520eeb813c5d.png
w####.p####.com.####.com/cms/23/19/dae517a48e2352fbaf08f4687f62cf7c.png
w####.p####.com.####.com/cms/26/70/4ecd91c3eae8fa4ef77fc215d655cff3.png
w####.p####.com.####.com/cms/37/03/9efd8384a6d9897060e02f6cffb73bfb.png
w####.p####.com.####.com/cms/39/35/f5e255e4cbf8c6ace832ba82d318d983.png
w####.p####.com.####.com/cms/40/08/420462a279acbe7b942cfe917564f7bb.png
w####.p####.com.####.com/cms/41/46/ae9dc76632409e0815c42d5655d5c4fa.png
w####.p####.com.####.com/cms/80/21/deda2ec14ae08a2fc854290f10224838.png
w####.p####.com.####.com/cp308/28/f4/28f41908c3c4d53718582c409d0961eb/14...
w####.p####.com.####.com/cp308/4d/3b/4d3bc3fa8b4a656d92fdb8e158989765/15...
w####.p####.com.####.com/cp308/76/a9/76a9a25509593c8c1df2e68e98425f74/14...
w####.p####.com.####.com/cp308/a8/06/a806391118ad8737725a5988c7aa8229/15...
w####.p####.com.####.com/cp308/b8/e5/b8e5a3d9f3a48f942585ed9c38762b44/14...
w####.p####.com.####.com/cp308/bb/21/bb21f98cc8c1b14b14064eecf5f02a67/14...
w####.p####.com.####.com/sp342/2013/06/28/11215911183.jpg.webp
w####.p####.com.####.com/sp342/2013/10/17/10492208691.jpg.webp
w####.p####.com.####.com/sp342/2014/12/12/14492710077.jpg.webp
w####.p####.com.####.com/sp342/2016/04/12/15431559015.jpg.webp
w####.p####.com.####.com/sp342/2016/11/14/14304583342.jpg.webp
w####.p####.com.####.com/sp342/2017/02/27/14062277948.jpg.webp
w####.p####.com.####.com/sp342/2017/08/23/18214619263.jpg.webp

Запросы HTTP POST:

apilo####.a####.com/v3/log/init
apm.su####.cn/httpSampling.gif
sdk.o####.lbs.####.com/api.htm?format=####&t=####

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/cache/applog.log
<Package Folder>/databases/_ire-journal
<Package Folder>/databases/jks.db-journal
<Package Folder>/databases/pptv.db-journal
<Package Folder>/databases/pushext.db-journal
<Package Folder>/databases/pushsdk.db-journal
<Package Folder>/databases/tmpd8.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal (deleted)
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/<Package>.log
<Package Folder>/files/####/pp_push_msg.db-journal
<Package Folder>/files/####/ppmessager.keystore
<Package Folder>/files/.imprint
<Package Folder>/files/configcenter.txt
<Package Folder>/files/exitadinfo
<Package Folder>/files/gdaemon_20151105
<Package Folder>/files/globalConfig.txt
<Package Folder>/files/init.pid
<Package Folder>/files/mobclick_agent_cached_<Package>99999
<Package Folder>/files/push.pid
<Package Folder>/files/run.pid
<Package Folder>/files/static_config
<Package Folder>/files/tdata_Bpa453.jar
<Package Folder>/files/tdata_Bpa453.tmp
<Package Folder>/files/tdata_SEy321.jar
<Package Folder>/files/tdata_SEy321.tmp
<Package Folder>/files/tdata_aVK029.jar
<Package Folder>/files/tdata_aVK029.tmp
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/<Package>_preferences.xml.bak
<Package Folder>/shared_prefs/MATSharedPreferences.xml
<Package Folder>/shared_prefs/USER_BILLING.xml
<Package Folder>/shared_prefs/USER_BILLING.xml.bak
<Package Folder>/shared_prefs/cn.com.mma.mobile.tracking.other.xml
<Package Folder>/shared_prefs/com.suning.statistics.Cloudytrace...ml.bak
<Package Folder>/shared_prefs/com.suning.statistics.Cloudytrace...or.xml
<Package Folder>/shared_prefs/config.xml
<Package Folder>/shared_prefs/config.xml.bak
<Package Folder>/shared_prefs/last_know_location.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/pptv.xml
<Package Folder>/shared_prefs/speed_test.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<Package Folder>/shared_prefs/unicom.xml
<Package Folder>/shared_prefs/view_from.xml
<Package Folder>/shared_prefs/webp.xml
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/journal.tmp
<SD-Card>/libs/<Package>.db
<SD-Card>/libs/app.db
<SD-Card>/libs/com.getui.sdk.deviceId.db
<SD-Card>/libs/com.igexin.sdk.deviceId.db
<SD-Card>/pptv/####/-1004717201.tmp
<SD-Card>/pptv/####/-1036967398.tmp
<SD-Card>/pptv/####/-1037279435
<SD-Card>/pptv/####/-1108343276
<SD-Card>/pptv/####/-1120058866.tmp
<SD-Card>/pptv/####/-1178884842.tmp
<SD-Card>/pptv/####/-119484607.tmp
<SD-Card>/pptv/####/-1206800092.tmp
<SD-Card>/pptv/####/-1233550756
<SD-Card>/pptv/####/-1243351796.tmp
<SD-Card>/pptv/####/-1271227147.tmp
<SD-Card>/pptv/####/-1358871578
<SD-Card>/pptv/####/-1363030419.tmp
<SD-Card>/pptv/####/-1367104051.tmp
<SD-Card>/pptv/####/-136849812.tmp
<SD-Card>/pptv/####/-136986924.tmp
<SD-Card>/pptv/####/-1372088531.tmp
<SD-Card>/pptv/####/-1441379360.tmp
<SD-Card>/pptv/####/-1441862793
<SD-Card>/pptv/####/-1452780041.tmp
<SD-Card>/pptv/####/-1454352229.tmp
<SD-Card>/pptv/####/-145567126.tmp
<SD-Card>/pptv/####/-1467149311.tmp
<SD-Card>/pptv/####/-147703128.tmp
<SD-Card>/pptv/####/-1483501869.tmp
<SD-Card>/pptv/####/-1490279760
<SD-Card>/pptv/####/-1503229472.tmp
<SD-Card>/pptv/####/-1558292689.tmp
<SD-Card>/pptv/####/-156154151.tmp
<SD-Card>/pptv/####/-1596413530
<SD-Card>/pptv/####/-159931846.tmp
<SD-Card>/pptv/####/-1608118072.tmp
<SD-Card>/pptv/####/-1624000149
<SD-Card>/pptv/####/-1641879776
<SD-Card>/pptv/####/-1654938622.tmp
<SD-Card>/pptv/####/-1665463696
<SD-Card>/pptv/####/-1669075779
<SD-Card>/pptv/####/-1693854143.tmp
<SD-Card>/pptv/####/-1701798464.tmp
<SD-Card>/pptv/####/-1757782753.tmp
<SD-Card>/pptv/####/-1777290316
<SD-Card>/pptv/####/-1791147138.tmp
<SD-Card>/pptv/####/-1795488464.tmp
<SD-Card>/pptv/####/-1811377773.tmp
<SD-Card>/pptv/####/-1824633993.tmp
<SD-Card>/pptv/####/-1871011426.tmp
<SD-Card>/pptv/####/-1877752018.tmp
<SD-Card>/pptv/####/-1898507689.tmp
<SD-Card>/pptv/####/-1904167746.tmp
<SD-Card>/pptv/####/-1917343619
<SD-Card>/pptv/####/-1920326167.tmp
<SD-Card>/pptv/####/-1922571145.tmp
<SD-Card>/pptv/####/-1930998761.tmp
<SD-Card>/pptv/####/-1978098382.tmp
<SD-Card>/pptv/####/-1983045393.tmp
<SD-Card>/pptv/####/-1992238347.tmp
<SD-Card>/pptv/####/-1996355210
<SD-Card>/pptv/####/-2012747632.tmp
<SD-Card>/pptv/####/-2019131903
<SD-Card>/pptv/####/-2020577616.tmp
<SD-Card>/pptv/####/-2046700463.tmp
<SD-Card>/pptv/####/-2067361484.tmp
<SD-Card>/pptv/####/-2137758513.tmp
<SD-Card>/pptv/####/-231211459.tmp
<SD-Card>/pptv/####/-27645915
<SD-Card>/pptv/####/-290231163
<SD-Card>/pptv/####/-311146098.tmp
<SD-Card>/pptv/####/-381138321.tmp
<SD-Card>/pptv/####/-3880095.tmp
<SD-Card>/pptv/####/-427717600.tmp
<SD-Card>/pptv/####/-434886813.tmp
<SD-Card>/pptv/####/-465549933.tmp
<SD-Card>/pptv/####/-472017645.tmp
<SD-Card>/pptv/####/-478169813.tmp
<SD-Card>/pptv/####/-502190469.tmp
<SD-Card>/pptv/####/-50650037.tmp
<SD-Card>/pptv/####/-50977411.tmp
<SD-Card>/pptv/####/-514111992.tmp
<SD-Card>/pptv/####/-526401856
<SD-Card>/pptv/####/-577683169.tmp
<SD-Card>/pptv/####/-584537158.tmp
<SD-Card>/pptv/####/-587140642
<SD-Card>/pptv/####/-605536553
<SD-Card>/pptv/####/-645134678.tmp
<SD-Card>/pptv/####/-64979327
<SD-Card>/pptv/####/-652752564.tmp
<SD-Card>/pptv/####/-672239339.tmp
<SD-Card>/pptv/####/-736216026.tmp
<SD-Card>/pptv/####/-74495691.tmp
<SD-Card>/pptv/####/-763530820.tmp
<SD-Card>/pptv/####/-777338175
<SD-Card>/pptv/####/-780476692.tmp
<SD-Card>/pptv/####/-80539926.tmp
<SD-Card>/pptv/####/-806212160.tmp
<SD-Card>/pptv/####/-815568645
<SD-Card>/pptv/####/-843096761.tmp
<SD-Card>/pptv/####/-861170564
<SD-Card>/pptv/####/-863441216.tmp
<SD-Card>/pptv/####/-874057658.tmp
<SD-Card>/pptv/####/-878472514.tmp
<SD-Card>/pptv/####/-893013318.tmp
<SD-Card>/pptv/####/-909848686.tmp
<SD-Card>/pptv/####/-92155046.tmp
<SD-Card>/pptv/####/-973936252.tmp
<SD-Card>/pptv/####/1038548501.tmp
<SD-Card>/pptv/####/1047143315.tmp
<SD-Card>/pptv/####/104902702.tmp
<SD-Card>/pptv/####/1056567229.tmp
<SD-Card>/pptv/####/1094408075.tmp
<SD-Card>/pptv/####/1122221299.tmp
<SD-Card>/pptv/####/1172701200.tmp
<SD-Card>/pptv/####/1175736104.tmp
<SD-Card>/pptv/####/1226236619.tmp
<SD-Card>/pptv/####/1229611798.tmp
<SD-Card>/pptv/####/1239383810.tmp
<SD-Card>/pptv/####/1277273066.tmp
<SD-Card>/pptv/####/1289902038.tmp
<SD-Card>/pptv/####/1341940983.tmp
<SD-Card>/pptv/####/1342424124.tmp
<SD-Card>/pptv/####/1355443009
<SD-Card>/pptv/####/1357907092.tmp
<SD-Card>/pptv/####/138660250
<SD-Card>/pptv/####/1392277265
<SD-Card>/pptv/####/1425710760.tmp
<SD-Card>/pptv/####/1450153685
<SD-Card>/pptv/####/1466785697.tmp
<SD-Card>/pptv/####/146772559.tmp
<SD-Card>/pptv/####/147227850.tmp
<SD-Card>/pptv/####/1485813683.tmp
<SD-Card>/pptv/####/1485984463.tmp
<SD-Card>/pptv/####/1512034042.tmp
<SD-Card>/pptv/####/1530102674.tmp
<SD-Card>/pptv/####/1539716190.tmp
<SD-Card>/pptv/####/1540411789.tmp
<SD-Card>/pptv/####/1547050581.tmp
<SD-Card>/pptv/####/1622361229.tmp
<SD-Card>/pptv/####/1640857441.tmp
<SD-Card>/pptv/####/1644975282.tmp
<SD-Card>/pptv/####/1648015199
<SD-Card>/pptv/####/1652994369.tmp
<SD-Card>/pptv/####/1672064533.tmp
<SD-Card>/pptv/####/1676179064
<SD-Card>/pptv/####/1690931691.tmp
<SD-Card>/pptv/####/174066307.tmp
<SD-Card>/pptv/####/1741847549
<SD-Card>/pptv/####/1742009741
<SD-Card>/pptv/####/175277923.tmp
<SD-Card>/pptv/####/177078345.tmp
<SD-Card>/pptv/####/1846601013.tmp
<SD-Card>/pptv/####/1851641946.tmp
<SD-Card>/pptv/####/1871374450.tmp
<SD-Card>/pptv/####/1875605070.tmp
<SD-Card>/pptv/####/1890914625.tmp
<SD-Card>/pptv/####/19073745.tmp
<SD-Card>/pptv/####/191419125.tmp
<SD-Card>/pptv/####/1949761113.tmp
<SD-Card>/pptv/####/1973162421.tmp
<SD-Card>/pptv/####/2016200689.tmp
<SD-Card>/pptv/####/2019473557.tmp
<SD-Card>/pptv/####/2020651956.tmp
<SD-Card>/pptv/####/2041154575.tmp
<SD-Card>/pptv/####/208314102.tmp
<SD-Card>/pptv/####/214665683.tmp
<SD-Card>/pptv/####/226602695.tmp
<SD-Card>/pptv/####/235320745.tmp
<SD-Card>/pptv/####/240487855.tmp
<SD-Card>/pptv/####/249554715.tmp
<SD-Card>/pptv/####/252758304.tmp
<SD-Card>/pptv/####/254239018
<SD-Card>/pptv/####/260042166.tmp
<SD-Card>/pptv/####/285016042.tmp
<SD-Card>/pptv/####/308834345.tmp
<SD-Card>/pptv/####/318641848.tmp
<SD-Card>/pptv/####/404431585.tmp
<SD-Card>/pptv/####/418632311.tmp
<SD-Card>/pptv/####/448136324
<SD-Card>/pptv/####/464947707.tmp
<SD-Card>/pptv/####/52136612.tmp
<SD-Card>/pptv/####/54939787.tmp
<SD-Card>/pptv/####/555113545
<SD-Card>/pptv/####/618269777
<SD-Card>/pptv/####/653866255.tmp
<SD-Card>/pptv/####/667715317.tmp
<SD-Card>/pptv/####/689314839.tmp
<SD-Card>/pptv/####/691890103
<SD-Card>/pptv/####/748943791
<SD-Card>/pptv/####/76152113
<SD-Card>/pptv/####/775904265
<SD-Card>/pptv/####/802207835.tmp
<SD-Card>/pptv/####/804994485
<SD-Card>/pptv/####/826396535.tmp
<SD-Card>/pptv/####/848256716.tmp
<SD-Card>/pptv/####/882956491.tmp
<SD-Card>/pptv/####/883435046
<SD-Card>/pptv/####/942518277.tmp
<SD-Card>/pptv/####/965397903.tmp
<SD-Card>/pptv/####/992749924.tmp
<SD-Card>/pptv/####/_livetab1
<SD-Card>/pptv/####/_livetab47
<SD-Card>/pptv/####/_livetabtab
<SD-Card>/system/####/tdata_Bpa453
<SD-Card>/system/####/tdata_SEy321
<SD-Card>/system/####/tdata_aVK029

Другие:

Запускает следующие shell-скрипты:

<Package Folder>/files/gdaemon_20151105 0 <Package>/com.igexin.sdk.PushService 25342 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20151105
chmod 755 <Package Folder>/.jiagu/libjiagu.so
sh <Package Folder>/files/gdaemon_20151105 0 <Package>/com.igexin.sdk.PushService 25342 300 0

Загружает динамические библиотеки:

audioeffect_jni
breakpad_util_jni
libjiagu
libppbox_jni-android-x86-gcc44-mt-1.1.0
meet
mresearch
ppbox_jni-android-x86-gcc44-mt-1.1
subtitle-jni

Использует следующие алгоритмы для шифрования данных:

AES-ECB-PKCS5Padding
DES-CBC-PKCS5Padding
DESede-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

DES-CBC-PKCS5Padding
DESede-CBC-PKCS5Padding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации о настроках APN.

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней