Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.2083
- Android.DownLoader.546.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) image####.p####.ao####.net:80
- TCP(HTTP/1.1) diy.p####.cn:80
- TCP(HTTP/1.1) i####.p####.cn:80
- TCP(HTTP/1.1) image22####.p####.ao####.net:80
- TCP(HTTP/1.1) p####.p####.cn:80
Запросы DNS:
- diy.p####.cn
- entry####.p####.cn
- i####.p####.cn
- image####.p####.cn
- image####.p####.cn
- image####.p####.cn
- image####.p####.cn
- image22####.p####.cn
- p####.p####.cn
Запросы HTTP GET:
- diy.p####.cn/livephoto/babycamera/gif/gif.xml?random=####
- diy.p####.cn/livephoto/babycamera/milestone/milestone.xml?random=####
- diy.p####.cn/livephoto/babycamera/phone/update.php?os_ver=####&update_ve...
- diy.p####.cn/livephoto/babycamera/phone/update2.2.php?r=####
- diy.p####.cn/livephoto/babycamera/polygons/templates.xml?random=####
- diy.p####.cn/livephoto/babycamera/polygons/thumb_08.jpg
- diy.p####.cn/livephoto/babycamera/polygons/thumb_09.jpg
- diy.p####.cn/livephoto/babycamera/polygons/thumb_10.jpg
- diy.p####.cn/livephoto/babycamera/polygons/thumb_11.jpg
- diy.p####.cn/livephoto/babycamera/polygons/thumb_12.jpg
- diy.p####.cn/livephoto/babycamera/polygons/thumb_13.jpg
- diy.p####.cn/livephoto/babycamera/polygons/thumb_14.jpg
- diy.p####.cn/livephoto/babycamera/polygons/thumb_15.jpg
- diy.p####.cn/livephoto/babycamera/polygons/thumb_16.jpg
- diy.p####.cn/livephoto/babycamera/polygons/thumb_17.jpg
- diy.p####.cn/livephoto/babycamera/polygons/thumb_18.jpg
- diy.p####.cn/livephoto/babycamera/polygons/thumb_20.jpg
- diy.p####.cn/livephoto/babycamera/polygons/thumb_21.jpg
- diy.p####.cn/livephoto/babycamera/puzzlesbg/backgrounds.xml?random=####
- diy.p####.cn/livephoto/babycamera/puzzlesbg/thumb16.jpg
- diy.p####.cn/livephoto/babycamera/puzzlesbg/thumb17.jpg
- diy.p####.cn/livephoto/babycamera/puzzlesbg/thumb18.jpg
- diy.p####.cn/livephoto/babycamera/puzzlesbg/thumb21.jpg
- diy.p####.cn/livephoto/babycamera/puzzlesbg/thumb22.jpg
- diy.p####.cn/livephoto/pococamera/cameraplus/get_info.php?model=Z####&fp...
- i####.p####.cn/mypoco/mtmpfile/API/poco_baby_camera/poco_baby_camera_dec...
- i####.p####.cn/mypoco/mtmpfile/API/poco_baby_camera/poco_baby_camera_fra...
- i####.p####.cn/mypoco/mtmpfile/API/poco_babycamera_en/topic_list_utf8.xml
- i####.p####.cn/mypoco/mtmpfile/API/weather/get_simple_weather_by_city_na...
- i####.p####.cn/mypoco/mtmpfile/MobileAPI/ApplePush/token_save.php?cid=##...
- image####.p####.ao####.net/best_pocoers/20130305/10222013030510272146787...
- image####.p####.ao####.net/best_pocoers/20130305/57022013030510241976758...
- image####.p####.ao####.net/best_pocoers/20130305/70352013030510284161821...
- image####.p####.ao####.net/best_pocoers/20130305/85652013030510254091396...
- image####.p####.ao####.net/best_pocoers/20130305/95992013030510261790874...
- image####.p####.ao####.net/best_pocoers/20130312/18302013031217550529447...
- image####.p####.ao####.net/best_pocoers/20130312/26132013031213484924413...
- image####.p####.ao####.net/best_pocoers/20130312/26542013031214370572229...
- image####.p####.ao####.net/best_pocoers/20130312/33692013031217532468169...
- image####.p####.ao####.net/best_pocoers/20130312/50182013031213474065715...
- image####.p####.ao####.net/best_pocoers/20130312/54092013031214364041944...
- image####.p####.ao####.net/best_pocoers/20130312/62072013031214323269094...
- image####.p####.ao####.net/best_pocoers/20130312/62502013031217520930894...
- image####.p####.ao####.net/best_pocoers/20130312/62802013031213464927820...
- image####.p####.ao####.net/best_pocoers/20130312/65922013031217524464613...
- image####.p####.ao####.net/best_pocoers/20130312/77752013031214343447662...
- image####.p####.ao####.net/best_pocoers/20130312/79462013031213471234760...
- image####.p####.ao####.net/best_pocoers/20130312/85222013031217513299786...
- image####.p####.ao####.net/best_pocoers/20130312/86512013031213482536514...
- image####.p####.ao####.net/best_pocoers/20130312/91092013031214333361165...
- image####.p####.ao####.net/best_pocoers/20130313/22242013031310291483547...
- image####.p####.ao####.net/best_pocoers/20130313/36192013031309513948307...
- image####.p####.ao####.net/best_pocoers/20130313/36192013031309523248142...
- image####.p####.ao####.net/best_pocoers/20130313/37762013031310282384544...
- image####.p####.ao####.net/best_pocoers/20130313/58852013031309520631370...
- image####.p####.ao####.net/best_pocoers/20130313/59502013031310294362416...
- image####.p####.ao####.net/best_pocoers/20130313/67442013031309532785375...
- image####.p####.ao####.net/best_pocoers/20130313/73042013031310304367170...
- image####.p####.ao####.net/best_pocoers/20130313/74872013031310300742318...
- image####.p####.ao####.net/best_pocoers/20130313/89732013031310273144848...
- image####.p####.ao####.net/best_pocoers/20130313/96212013031309525736959...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_config/config.xml
- <Package Folder>/app_hrfu/<Package>.odex
- <Package Folder>/app_hrfu/<Package>.zip
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/databases/db_public-journal
- <Package Folder>/files/events_tongji.txt
- <Package Folder>/shared_prefs/BabyPushService.xml
- <Package Folder>/shared_prefs/UserRun.xml
- <Package Folder>/shared_prefs/UserUse.xml
- <Package Folder>/shared_prefs/WebReturnUse.xml
- <Package Folder>/shared_prefs/app_tongji_poco.xml
- <Package Folder>/shared_prefs/app_tongji_poco.xml.bak
- <Package Folder>/shared_prefs/camerapatch.xml
- <Package Folder>/shared_prefs/camerapatch.xml.bak
- <SD-Card>/BabyCamera/####/10222013030510272146787659_80.img
- <SD-Card>/BabyCamera/####/1325201509231919215629665_80.img
- <SD-Card>/BabyCamera/####/15342014101110595499020318_80.img
- <SD-Card>/BabyCamera/####/18302013031217550529447619_80.img
- <SD-Card>/BabyCamera/####/22242013031310291483547018_80.img
- <SD-Card>/BabyCamera/####/24772013030415462180566692_80.img
- <SD-Card>/BabyCamera/####/26132013031213484924413071_80.img
- <SD-Card>/BabyCamera/####/26542013031214370572229259_80.img
- <SD-Card>/BabyCamera/####/27842013030415471632184521_80.img
- <SD-Card>/BabyCamera/####/29062014101111042833157036_80.img
- <SD-Card>/BabyCamera/####/31772015021615520821306740_80.img
- <SD-Card>/BabyCamera/####/33692013031217532468169191_80.img
- <SD-Card>/BabyCamera/####/36192013031309513948307050_80.img
- <SD-Card>/BabyCamera/####/36192013031309523248142495_80.img
- <SD-Card>/BabyCamera/####/37762013031310282384544783_80.img
- <SD-Card>/BabyCamera/####/41792015092319194777935394_80.img
- <SD-Card>/BabyCamera/####/41822015092319184864584581_80.img
- <SD-Card>/BabyCamera/####/42942013030415493398776375_80.img
- <SD-Card>/BabyCamera/####/43532014101111053688171724_80.img
- <SD-Card>/BabyCamera/####/45322016052011095714509842_80.img
- <SD-Card>/BabyCamera/####/501820130312134740657151_80.img
- <SD-Card>/BabyCamera/####/54092013031214364041944818_80.img
- <SD-Card>/BabyCamera/####/54702014101111033949237430_80.img
- <SD-Card>/BabyCamera/####/5702201303051024197675838_80.img
- <SD-Card>/BabyCamera/####/58542015030310581473925979_80.img
- <SD-Card>/BabyCamera/####/58852013031309520631370166_80.img
- <SD-Card>/BabyCamera/####/59502013031310294362416554_80.img
- <SD-Card>/BabyCamera/####/62072013031214323269094629_80.img
- <SD-Card>/BabyCamera/####/62502013031217520930894357_80.img
- <SD-Card>/BabyCamera/####/62502014053009421411533164_80.img
- <SD-Card>/BabyCamera/####/62802013031213464927820125_80.img
- <SD-Card>/BabyCamera/####/64672016052011123814624414_80.img
- <SD-Card>/BabyCamera/####/65922013031217524464613916_80.img
- <SD-Card>/BabyCamera/####/66172014032014130441141879_80.img
- <SD-Card>/BabyCamera/####/67442013031309532785375723_80.img
- <SD-Card>/BabyCamera/####/70352013030510284161821129_80.img
- <SD-Card>/BabyCamera/####/7284201506191641149553353_80.img
- <SD-Card>/BabyCamera/####/73042013031310304367170553_80.img
- <SD-Card>/BabyCamera/####/74872013031310300742318218_80.img
- <SD-Card>/BabyCamera/####/76172014032014124295512444_80.img
- <SD-Card>/BabyCamera/####/77752013031214343447662349_80.img
- <SD-Card>/BabyCamera/####/79462013031213471234760793_80.img
- <SD-Card>/BabyCamera/####/80732014032014113437990810_80.img
- <SD-Card>/BabyCamera/####/82132015092319205837333589_80.img
- <SD-Card>/BabyCamera/####/82542013030415484855989319_80.img
- <SD-Card>/BabyCamera/####/82612015092318502085124471_80.img
- <SD-Card>/BabyCamera/####/83072015092319201162891213_80.img
- <SD-Card>/BabyCamera/####/85222013031217513299786679_80.img
- <SD-Card>/BabyCamera/####/85652013030510254091396386_80.img
- <SD-Card>/BabyCamera/####/85982016052011110389638156_80.img
- <SD-Card>/BabyCamera/####/86512013031213482536514117_80.img
- <SD-Card>/BabyCamera/####/89732013031310273144848126_80.img
- <SD-Card>/BabyCamera/####/90482014101111040240406997_80.img
- <SD-Card>/BabyCamera/####/91092013031214333361165516_80.img
- <SD-Card>/BabyCamera/####/93712014032014122373328461_80.img
- <SD-Card>/BabyCamera/####/93992014053009381031787924_80.img
- <SD-Card>/BabyCamera/####/95992013030510261790874420_80.img
- <SD-Card>/BabyCamera/####/96212013031309525736959046_80.img
- <SD-Card>/BabyCamera/####/97062016052011114857654867_80.img
- <SD-Card>/BabyCamera/####/99672014053009370392249467_80.img
- <SD-Card>/BabyCamera/####/babys.xml
- <SD-Card>/BabyCamera/####/decorates.xml
- <SD-Card>/BabyCamera/####/frames.xml
- <SD-Card>/BabyCamera/####/gif.xml
- <SD-Card>/BabyCamera/####/music.xml
- <SD-Card>/BabyCamera/####/photos.db-journal
- <SD-Card>/BabyCamera/####/templates.xml
- <SD-Card>/BabyCamera/####/thumb16.img
- <SD-Card>/BabyCamera/####/thumb17.img
- <SD-Card>/BabyCamera/####/thumb18.img
- <SD-Card>/BabyCamera/####/thumb21.img
- <SD-Card>/BabyCamera/####/thumb22.img
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- libjiagu
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
