Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) www.data####.cn:80
- TCP(HTTP/1.1) ads.w####.cn:80
- TCP(HTTP/1.1) d.g####.qq.com:80
- TCP(HTTP/1.1) v.g####.qq.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) ejm.dol####.com:80
- TCP(HTTP/1.1) dd.m####.t####.####.com:80
- TCP(HTTP/1.1) get.dol####.com.####.com:80
- TCP(HTTP/1.1) 2####.205.151.214:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) c.g####.qq.com:80
- TCP(HTTP/1.1) loc.map.b####.com:80
- TCP(HTTP/1.1) app.w####.cn:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(TLS/1.0) s####.map.b####.com:443
Запросы DNS:
- ads.w####.cn
- app.w####.cn
- c.g####.qq.com
- d.g####.qq.com
- dd.m####.com
- ejm.dol####.com
- get.dol####.com
- imgc####.qq.com
- loc.map.b####.com
- mi.g####.qq.com
- p####.g####.cn
- pp.m####.com
- qzones####.g####.cn
- s####.e.qq.com
- s####.map.b####.com
- v.g####.qq.com
- www.data####.cn
Запросы HTTP GET:
- c.g####.qq.com/gdt_mclick.fcg?viewid=####&jtype=####&i=####&os=####&asi=...
- c.g####.qq.com/gdt_trace_a.fcg?actionid=####&targettype=####&tagetid=###...
- d.g####.qq.com/fcg-bin/gdt_appdetail.fcg?ico=####&op_appid=####
- dd.m####.t####.####.com/16891/89CDF0B033024B9BCDF5091EA0AFACA1.apk?fsnam...
- get.dol####.com.####.com/download/jarFile/SDKAutoUpdate/for_dex36.19.tar...
- mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
Запросы HTTP POST:
- ejm.dol####.com/cooguogw/interface.action?advertModule=####
- ejm.dol####.com/cooguogw/iris.action?g=####
- loc.map.b####.com/sdk.php
- s####.e.qq.com/activate?queueSize=####
- s####.e.qq.com/click?queueSize=####
- s####.e.qq.com/msg?queueSize=####
- v.g####.qq.com/gdt_stats.fcg
- www.data####.cn/bjc.action/iris.action?g=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.lib/libexec.so
- <Package Folder>/.lib/libexecmain.so
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar.sig
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp.sig
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.sig
- <Package Folder>/app_e_qq_com_setting/gdt_suid
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.sig
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/index
- <Package Folder>/databases/GDTSDK.db
- <Package Folder>/databases/GDTSDK.db-journal
- <Package Folder>/databases/ldownloads
- <Package Folder>/databases/ldownloads-journal
- <Package Folder>/databases/pdownloads
- <Package Folder>/databases/pdownloads-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/DVDirectory.cfg
- <Package Folder>/files/####/DVHotcity.cfg
- <Package Folder>/files/####/DVVersion.cfg
- <Package Folder>/files/####/ResPack.rs
- <Package Folder>/files/####/mapstyle.sty
- <Package Folder>/files/####/satellitestyle.sty
- <Package Folder>/files/####/trafficstyle.sty
- <Package Folder>/files/CMRequire.dat
- <Package Folder>/files/CacheTime.dat
- <Package Folder>/files/VerDatset.dat
- <Package Folder>/files/imei.dat
- <Package Folder>/files/mdatainitalizethis
- <Package Folder>/files/ver.dat
- <Package Folder>/shared_prefs/AppSettings.xml
- <Package Folder>/shared_prefs/L_Key.xml
- <Package Folder>/shared_prefs/PaySettings.xml
- <Package Folder>/shared_prefs/ShowAdFlag.xml
- <Package Folder>/shared_prefs/authStatus_<Package>.xml
- <Package Folder>/shared_prefs/bids.xml
- <Package Folder>/shared_prefs/coo_id.xml
- <Package Folder>/shared_prefs/jar_root.xml
- <Package Folder>/shared_prefs/jar_version.xml
- <Package Folder>/shared_prefs/ki.xml
- <Package Folder>/shared_prefs/kj.xml
- <Package Folder>/shared_prefs/kp_shortcut.xml
- <Package Folder>/shared_prefs/ljk.xml
- <Package Folder>/shared_prefs/map_pref.xml
- <Package Folder>/shared_prefs/new_l_req_st.xml
- <Package Folder>/shared_prefs/perference.xml
- <Package Folder>/shared_prefs/request_prefs.xml
- <Package Folder>/shared_prefs/toggle_flag_pref.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/AppPackage.dat
- <SD-Card>/Android/####/ApplicationCache.db-journal
- <SD-Card>/Android/####/CacheTime.dat
- <SD-Card>/Android/####/KI.DAT
- <SD-Card>/Android/####/UnPackage.dat
- <SD-Card>/Android/####/android
- <SD-Card>/Android/####/ljk.dat
- <SD-Card>/BaiduMapSDK/####/.nomedia
- <SD-Card>/BaiduMapSDK/####/DMTempdat.dat
- <SD-Card>/BaiduMapSDK/####/DMTempdat.idx
- <SD-Card>/BaiduMapSDK/####/DTBakTempdat.dat
- <SD-Card>/BaiduMapSDK/####/DTBakTempdat.idx
- <SD-Card>/BaiduMapSDK/####/DTLabTempdat.dat
- <SD-Card>/BaiduMapSDK/####/DTLabTempdat.idx
- <SD-Card>/BaiduMapSDK/####/DTTempdat.dat
- <SD-Card>/BaiduMapSDK/####/DTTempdat.idx
- <SD-Card>/BaiduMapSDK/####/ITTempdat.dat
- <SD-Card>/BaiduMapSDK/####/ITTempdat.idx
- <SD-Card>/Download/####/clst.dat
- <SD-Card>/Download/####/icp.dat
- <SD-Card>/Download/####/jar_dex.tar.gz
- <SD-Card>/Download/####/rt.dat
- <SD-Card>/Download/####/st.dat
- <SD-Card>/Download/####/test.jar
- <SD-Card>/Download/####/u.dat
- <SD-Card>/GDTDOWNLOAD/####/90f45721bfe3b8ca93a6e32a408668f0
- <SD-Card>/baidu/####/ls.db
- <SD-Card>/baidu/####/ls.db-journal
- <SD-Card>/baidu/.cuid
- <SD-Card>/ljk/####/reqt.dat
- <SD-Card>/ljk/####/spt.dat
- <SD-Card>/test.0
Другие:
Запускает следующие shell-скрипты:
- getprop ro.product.cpu.abi
Загружает динамические библиотеки:
- BaiduMapSDK_v3_0_0
- entryexstd
- libexec
- libexecmain
- locSDK3
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
