Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.3422
- Android.DownLoader.657.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.m.ta####.com:80
- TCP(HTTP/1.1) x####.a####.com.####.com:80
- TCP(HTTP/1.1) aos.w####.y####.net:80
- TCP(HTTP/1.1) res.we####.cn.####.com:80
- TCP(HTTP/1.1) m.a####.com.####.com:80
- TCP(HTTP/1.1) au.y####.net:80
- TCP(HTTP/1.1) s.y####.net:80
- UDP 2####.0.0.1:9998
Запросы DNS:
- 631.nd####.y####.com
- a####.a####.com
- a####.m.ta####.com
- a####.u####.com
- aos.w####.y####.net
- au.y####.net
- c####.im.ta####.com
- fu1.a####.com
- h####.a####.com
- i####.ww.ta####.com
- ip.ta####.com
- kvt####.m####.a####.com
- log.u####.com
- m####.a####.com
- m.a####.com
- policyc####.a####.com
- res.we####.cn
- s####.gw.y####.net
- s.y####.net
- so.a####.com
- t####.dmp.y####.net
- www.a####.com
- x####.a####.com
- z####.l####.top
Запросы HTTP POST:
- a####.m.ta####.com/rest/gc?dd=####&nsgs=####&ak=####&av=####&c=####&v=##...
- a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_libs/ymdex.jar
- <Package Folder>/cache/####/beef06084026662de89e2c91ea2e0be6012....0.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/cache/be52062a4fa7505a05079ec571af8ce4.0.tmp
- <Package Folder>/cache/be52062a4fa7505a05079ec571af8ce4.1.tmp
- <Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.0.tmp
- <Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.1.tmp
- <Package Folder>/cache/journal.tmp
- <Package Folder>/databases/OxgHkj2lz09F
- <Package Folder>/databases/OxgHkj2lz09F-journal
- <Package Folder>/databases/P15pKIjsm64m
- <Package Folder>/databases/P15pKIjsm64m-journal
- <Package Folder>/databases/T1oX0rhhuXWt
- <Package Folder>/databases/T1oX0rhhuXWt-journal
- <Package Folder>/databases/XKwVoK0huy3R
- <Package Folder>/databases/XKwVoK0huy3R-journal
- <Package Folder>/databases/aipai.db
- <Package Folder>/databases/aipai.db-journal
- <Package Folder>/databases/cd5a2093b8be4bee103d6bc0c6da05ff-journal
- <Package Folder>/databases/d8305c5b3d6c8db862c69f2760ab1f81
- <Package Folder>/databases/d8305c5b3d6c8db862c69f2760ab1f81-journal
- <Package Folder>/databases/e57c34b26a4c8e1b872a8608bae7c4ed
- <Package Folder>/databases/e57c34b26a4c8e1b872a8608bae7c4ed-journal
- <Package Folder>/databases/jqIqJYOT3JpT
- <Package Folder>/databases/jqIqJYOT3JpT-journal
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/databases/wIU6pTyUBYWX
- <Package Folder>/databases/wIU6pTyUBYWX-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/wsUL1uCdKvjD
- <Package Folder>/databases/wsUL1uCdKvjD-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/arrow-left.png
- <Package Folder>/files/####/arrow-right.png
- <Package Folder>/files/####/blank.gif
- <Package Folder>/files/####/close-icon.png
- <Package Folder>/files/####/config.json
- <Package Folder>/files/####/default.png
- <Package Folder>/files/####/detail-wx.html
- <Package Folder>/files/####/detail-wx.js
- <Package Folder>/files/####/detail.html
- <Package Folder>/files/####/detail.js
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/####/feedback.html
- <Package Folder>/files/####/feedback.js
- <Package Folder>/files/####/form.css
- <Package Folder>/files/####/global.js
- <Package Folder>/files/####/lists.css
- <Package Folder>/files/####/lists.html
- <Package Folder>/files/####/lists.js
- <Package Folder>/files/####/md5.js
- <Package Folder>/files/####/pic_m.png
- <Package Folder>/files/####/pic_tips_01.png
- <Package Folder>/files/####/pic_tips_02.png
- <Package Folder>/files/####/result.png
- <Package Folder>/files/####/rule.html
- <Package Folder>/files/####/sdetail.html
- <Package Folder>/files/####/share.css
- <Package Folder>/files/####/share.html
- <Package Folder>/files/####/share.js
- <Package Folder>/files/####/sprite-face.png
- <Package Folder>/files/####/sprite-icons.png
- <Package Folder>/files/####/sprite-icons2.png
- <Package Folder>/files/####/um_cache_1512020011521.env
- <Package Folder>/files/####/wx-step1.jpg
- <Package Folder>/files/####/wx-step2.jpg
- <Package Folder>/files/####/wx-step3.jpg
- <Package Folder>/files/####/wx-step4.jpg
- <Package Folder>/files/####/wx-step5.jpg
- <Package Folder>/files/21e587dc238a9c201463bc70d37de13b.zip
- <Package Folder>/files/6.jar
- <Package Folder>/files/CacheTime.dat
- <Package Folder>/files/aipai.guid
- <Package Folder>/files/sp.lock
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/AppSettings.xml
- <Package Folder>/shared_prefs/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
- <Package Folder>/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/CookiePersistence.xml
- <Package Folder>/shared_prefs/OFFERSCONFIG1.xml
- <Package Folder>/shared_prefs/UTCommon.xml
- <Package Folder>/shared_prefs/UTMCConf2097508659.xml
- <Package Folder>/shared_prefs/UTMCLog2097508659.xml
- <Package Folder>/shared_prefs/ad_system_config.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/qcbq.zag.lxvjg.irkbpu.xml
- <Package Folder>/shared_prefs/rx_sf_account.xml
- <Package Folder>/shared_prefs/rx_sf_app.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/ywPrefsTools.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/.com.taobao.dp/6c709c11d2d46a7b
- <SD-Card>/.com.taobao.dp/dd7893586a493dc3
- <SD-Card>/Android/####/373240561418738c721572c1da14b85e
- <SD-Card>/Android/####/373240561418738c721572c1da14b85e.ymtf
- <SD-Card>/Android/####/CacheTime.dat
- <SD-Card>/Android/####/android
- <SD-Card>/Android/####/i42d45df023jnkdd93la483f9xGFKXI
- <SD-Card>/Android/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/kernel_max
- cat /proc/cpuinfo | grep Serial
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- ls -l /system/xbin/su
Загружает динамические библиотеки:
- abcdefgh
- libjiagu
- securitysdk-3.1
- xifen
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
