Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) b.sm####.cn:80
- TCP(HTTP/1.1) 2####.243.193.31:80
- TCP(HTTP/1.1) d.xiongj####.com.####.com:80
- TCP(HTTP/1.1) a.sm####.cn:80
- TCP(HTTP/1.1) a.appj####.com:80
- TCP(TLS/1.0) d####.fl####.com:443
- TCP(TLS/1.0) rep####.crashly####.com:443
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) l####.chartb####.com:443
Запросы DNS:
- a####.u####.com
- a.appj####.com
- a.sm####.cn
- b.sm####.cn
- d####.fl####.com
- d.xiongj####.com.cn
- l####.chartb####.com
- rep####.crashly####.com
- sett####.crashly####.com
Запросы HTTP GET:
- d.xiongj####.com.####.com/jfile/giantt.jar
Запросы HTTP POST:
- a.appj####.com/ad-service/ad/mark
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/####/cb_previous_session_info
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/598469D603B3-0001-0843-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469D603B3-0001-0843-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/598469DA0315-0002-0843-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469DB028F-0001-0894-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469DB028F-0001-0894-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/598469DF0177-0002-0894-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469E000D1-0001-08D9-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469E000D1-0001-08D9-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/598469E303B0-0002-08D9-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469E4032B-0001-091D-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469E4032B-0001-091D-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/598469E80205-0002-091D-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469E90167-0001-0963-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469E90167-0001-0963-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/598469ED0120-0002-0963-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469EE00DF-0001-09A9-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469EE00DF-0001-09A9-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/598469F2003C-0002-09A9-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469F30001-0001-09ED-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469F30001-0001-09ED-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/598469F6035E-0002-09ED-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469F702DA-0001-0A31-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469F702DA-0001-0A31-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/598469FB0246-0002-0A31-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469FC0211-0001-0A77-01FA69BF3E48...s_temp
- <Package Folder>/files/####/598469FC0211-0001-0A77-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/59846A000121-0002-0A77-01FA69BF3E48...s_temp
- <Package Folder>/files/####/59846A01006C-0001-0ABC-01FA69BF3E48...s_temp
- <Package Folder>/files/####/59846A01006C-0001-0ABC-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/59846A05001B-0002-0ABC-01FA69BF3E48...s_temp
- <Package Folder>/files/####/59846A060015-0001-0B00-01FA69BF3E48...s_temp
- <Package Folder>/files/####/59846A060015-0001-0B00-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/59846A090302-0002-0B00-01FA69BF3E48...s_temp
- <Package Folder>/files/####/59846A0A02DE-0001-0B44-01FA69BF3E48...s_temp
- <Package Folder>/files/####/59846A0A02DE-0001-0B44-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/59846A0E0290-0002-0B44-01FA69BF3E48...s_temp
- <Package Folder>/files/####/59846A0F01E9-0001-0B8A-01FA69BF3E48...s_temp
- <Package Folder>/files/####/59846A0F01E9-0001-0B8A-01FA69BF3E48.cls_temp
- <Package Folder>/files/####/59846A1603C4-0002-0B8A-01FA69BF3E48...s_temp
- <Package Folder>/files/####/com.crashlytics.settings.json
- <Package Folder>/files/####/crash_marker
- <Package Folder>/files/####/initialization_marker
- <Package Folder>/files/####/sa_0606e764-6ef4-43d5-a5f3-ff0f5476...66.tap
- <Package Folder>/files/####/session_analytics.tap
- <Package Folder>/files/####/session_analytics.tap.tmp
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_Y...3P_216
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/files/.imprint
- <Package Folder>/files/.yflurrydatasenderblock.0989c644-51f3-47...e53d3c
- <Package Folder>/files/.yflurrydatasenderblock.100a4c73-645b-4f...86b2f5
- <Package Folder>/files/.yflurrydatasenderblock.2eea44fa-e97b-43...e6c177
- <Package Folder>/files/.yflurrydatasenderblock.3376bac4-0ee5-4b...28f0d5
- <Package Folder>/files/.yflurrydatasenderblock.47a22382-4436-43...084372
- <Package Folder>/files/.yflurrydatasenderblock.56daf18e-f545-4b...be3b5f
- <Package Folder>/files/.yflurrydatasenderblock.63b03b10-a0ec-47...d21c73
- <Package Folder>/files/.yflurrydatasenderblock.72aab0a3-1ef0-45...01b318
- <Package Folder>/files/.yflurrydatasenderblock.85c5d032-58fd-40...1fd5f7
- <Package Folder>/files/.yflurrydatasenderblock.87750f2e-046f-4a...de7712
- <Package Folder>/files/.yflurrydatasenderblock.889331bc-a3be-49...2b6bce
- <Package Folder>/files/.yflurrydatasenderblock.8e7df47c-fa31-4f...8716bc
- <Package Folder>/files/.yflurrydatasenderblock.8f2860de-6d53-48...99513b
- <Package Folder>/files/.yflurrydatasenderblock.9372a5a4-ddb4-40...02165a
- <Package Folder>/files/.yflurrydatasenderblock.a240b85f-8c42-41...c58c28
- <Package Folder>/files/.yflurrydatasenderblock.a7f65e9c-3568-49...4532c4
- <Package Folder>/files/.yflurrydatasenderblock.af3058a8-01b5-4e...4135a9
- <Package Folder>/files/.yflurrydatasenderblock.aff6ebd9-b324-4c...f081e3
- <Package Folder>/files/.yflurrydatasenderblock.b45781a4-be7a-43...b13a65
- <Package Folder>/files/.yflurrydatasenderblock.b6c6d90b-f184-42...c30d0d
- <Package Folder>/files/.yflurrydatasenderblock.c2b482d6-444b-4b...d0306c
- <Package Folder>/files/.yflurrydatasenderblock.d4c743ec-13af-4b...862225
- <Package Folder>/files/.yflurrydatasenderblock.db5becd2-88b2-4d...5f6952
- <Package Folder>/files/.yflurrydatasenderblock.dbe2274f-b68e-49...7b737e
- <Package Folder>/files/.yflurrydatasenderblock.e30406f1-64eb-4b...5fcef0
- <Package Folder>/files/.yflurrydatasenderblock.f317a70e-88ee-49...cf6aa0
- <Package Folder>/files/.yflurryreport.-81019eae7dff1e7
- <Package Folder>/files/mobclick_agent_cached_<Package>118
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/shared_prefs/TwitterAdvertisingInfoPreferences.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/cbPrefs.xml
- <Package Folder>/shared_prefs/cbPrefs.xml.bak
- <Package Folder>/shared_prefs/com.crashlytics.prefs.xml
- <Package Folder>/shared_prefs/com.crashlytics.sdk.android;answe...gs.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics....ml.bak
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/shared_prefs/io.fabric.sdk.android;fabric;io.f...ng.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/qihoo_jiagu_crash_report.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/Download/####/4.5_giantt.jar.tmp
- <SD-Card>/dt/restime.dat
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- bot
- cocos2dcpp
- crashlytics
- libjiagu
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
