Android.Packed.35497

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.589.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 52.52.2####.56:80
TCP(HTTP/1.1) a####.you####.com:80
TCP(HTTP/1.1) w####.q####.dn.####.com:80
TCP(HTTP/1.1) d2.ireader####.com:80
TCP(HTTP/1.1) cdn.app.kac####.####.com:80
TCP(HTTP/1.1) d1.ireader####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) pwe.3####.top:80
TCP(HTTP/1.1) cdn.game####.org:80
TCP(TLS/1.0) www.ireader####.com:443
TCP(TLS/1.0) st####.suiyue####.com.####.com:443

Запросы DNS:

a####.you####.com
cdn.app.kac####.cn
cdn.game####.org
cdn.img.h####.top
d1.ireader####.com
d2.ireader####.com
fb.u####.com
pwe.3####.top
st####.suiyue####.com
t####.qin####.com
www.ireader####.com

Запросы HTTP GET:

a####.you####.com/sx/GetConfigInfo.aspx?ver=####&passID=####&ver=####&cl...
cdn.app.kac####.####.com/sfile/201712/06/all/cp_V2.7.8.txt
cdn.app.kac####.####.com/upload/201711/30/img/20171130182651140.png
cdn.game####.org/strategy/UnknownDev
cdn.game####.org/strategy/base
cdn.game####.org/strategy/dev_root
cdn.game####.org/strategy/dev_root2
cdn.game####.org/strategy/larger4.3
cdn.game####.org/strategy/loss_4.3
cdn.game####.org/strategy/sul18
cdn.game####.org/strategy/symlink-adbd
d1.ireader####.com/GoodBooks/Books/cover/2012-06-25/d3a1b42a-e503-4125-b...
d1.ireader####.com/GoodBooks/Books/cover/2014-07-02/6c00f3c7-e039-4b1d-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-04-02/840f5430-8648-49ea-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-04-08/cce5c79c-0a09-4a81-a...
d1.ireader####.com/GoodBooks/Books/cover/2015-04-23/f896fa13-a651-4ad7-b...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/aaa523be-fb80-4f68-8...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/feb8ad64-d0ef-4236-9...
d1.ireader####.com/GoodBooks/Books/cover/2015-06-26/4149d7aa-b8f1-4f61-b...
d1.ireader####.com/GoodBooks/Books/cover/2016-01-05/a500173b-6baf-45d5-b...
d1.ireader####.com/GoodBooks/Books/cover/2016-10-17/d62fd8b2-fb02-481b-9...
d1.ireader####.com/GoodBooks/Books/cover/2016-11-23/e1eaa80c-1002-42ca-8...
d1.ireader####.com/GoodBooks/Books/cover/2017-05-22/55a82816-0a93-4fa0-8...
d1.ireader####.com/GoodBooks/Books/cover/2017-10-09/4a7923a1-326e-4f2d-8...
d1.ireader####.com/GoodBooks/Books/cover/2017-10-12/fc3bbda5-fc0e-412a-9...
d1.ireader####.com/GoodBooks/Books/cover/2017-12-18/596a22fe-7825-4e68-b...
d2.ireader####.com/GoodBooks/Books/cover/2013-12-05/22a870fb-3888-40e7-b...
d2.ireader####.com/GoodBooks/Books/cover/2013-12-05/8a38ac20-d57b-4ae8-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-04-02/52a2d0c9-7ce8-4811-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-04-02/840f5430-8648-49ea-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-04-14/85e98bf8-1633-475a-9...
d2.ireader####.com/GoodBooks/Books/cover/2015-06-18/ef532b8f-a1fc-46b6-8...
d2.ireader####.com/GoodBooks/Books/cover/2015-09-02/f2f58913-a8f4-4287-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-12-07/fc981fb9-119b-4b8e-a...
d2.ireader####.com/GoodBooks/Books/cover/2015-12-08/b9fcef3a-61fe-46a6-a...
d2.ireader####.com/GoodBooks/Books/cover/2015-12-08/d0349774-f39a-412b-a...
d2.ireader####.com/GoodBooks/Books/cover/2015-12-15/a4da05e6-81f7-4b19-8...
d2.ireader####.com/GoodBooks/Books/cover/2016-12-23/f6c3d1b6-d4b6-48f0-9...
d2.ireader####.com/GoodBooks/Books/cover/2017-10-30/8e0e93f4-a2f8-46f8-b...
d2.ireader####.com/GoodBooks/Books/cover/2017-11-06/db40c632-52db-4fbe-a...
d2.ireader####.com/GoodBooks/Books/cover/2017-11-21/3e90b965-ff34-4f54-b...
d2.ireader####.com/GoodBooks/Books/cover/2017-12-18/3030074b-7bb5-4ac5-b...
d2.ireader####.com/GoodBooks/Books/cover/2017-12-18/3b9b9d7e-542e-4592-b...
d2.ireader####.com/GoodBooks/Books/cover/2017-12-18/8e889024-137b-4aec-9...
d2.ireader####.com/GoodBooks/Books/cover/2017-12-18/ca1cab54-43dc-4d0c-8...
w####.q####.dn.####.com/sxsplash20160727_579817d469bca.jpg
w####.q####.dn.####.com/sxsplash20160727_579817da499fb.jpg
w####.q####.dn.####.com/sxsplash20160727_579817de0f457.jpg
w####.q####.dn.####.com/sxsplash20160727_579817e1da72a.jpg
w####.q####.dn.####.com/sxsplash20160727_57981808344f4.jpg

Запросы HTTP POST:

pwe.3####.top/hadat/ii/jwtkw
pwe.3####.top/hadat/nvd/jin
pwe.3####.top/jzbdt/bhym/x/vhpdf
pwe.3####.top/jzbdt/p/jit
pwe.3####.top/jzbdt/rt/njwe
pwe.3####.top/sdf/i

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_1c9e77be-33f2-4541-b9f3-c1d62e9c921d/Matrix
<Package Folder>/app_1c9e77be-33f2-4541-b9f3-c1d62e9c921d/ddexe
<Package Folder>/app_1c9e77be-33f2-4541-b9f3-c1d62e9c921d/debuggerd
<Package Folder>/app_1c9e77be-33f2-4541-b9f3-c1d62e9c921d/fileWork
<Package Folder>/app_1c9e77be-33f2-4541-b9f3-c1d62e9c921d/insta...ery.sh
<Package Folder>/app_1c9e77be-33f2-4541-b9f3-c1d62e9c921d/pidof
<Package Folder>/app_1c9e77be-33f2-4541-b9f3-c1d62e9c921d/su
<Package Folder>/app_1c9e77be-33f2-4541-b9f3-c1d62e9c921d/supolicy
<Package Folder>/app_1c9e77be-33f2-4541-b9f3-c1d62e9c921d/toolbox
<Package Folder>/app_1c9e77be-33f2-4541-b9f3-c1d62e9c921d/wsroot.sh
<Package Folder>/app_283de437-79e1-4f10-b06c-8b86f8379c07/Matrix
<Package Folder>/app_283de437-79e1-4f10-b06c-8b86f8379c07/ddexe
<Package Folder>/app_283de437-79e1-4f10-b06c-8b86f8379c07/debuggerd
<Package Folder>/app_283de437-79e1-4f10-b06c-8b86f8379c07/fileWork
<Package Folder>/app_283de437-79e1-4f10-b06c-8b86f8379c07/insta...ery.sh
<Package Folder>/app_283de437-79e1-4f10-b06c-8b86f8379c07/pidof
<Package Folder>/app_283de437-79e1-4f10-b06c-8b86f8379c07/su
<Package Folder>/app_283de437-79e1-4f10-b06c-8b86f8379c07/supolicy
<Package Folder>/app_283de437-79e1-4f10-b06c-8b86f8379c07/toolbox
<Package Folder>/app_283de437-79e1-4f10-b06c-8b86f8379c07/wsroot.sh
<Package Folder>/app_3f08ea88-aa6a-45ea-abd8-9c1e2f69a9b4/Matrix
<Package Folder>/app_3f08ea88-aa6a-45ea-abd8-9c1e2f69a9b4/ddexe
<Package Folder>/app_3f08ea88-aa6a-45ea-abd8-9c1e2f69a9b4/debuggerd
<Package Folder>/app_3f08ea88-aa6a-45ea-abd8-9c1e2f69a9b4/device.db
<Package Folder>/app_3f08ea88-aa6a-45ea-abd8-9c1e2f69a9b4/fileWork
<Package Folder>/app_3f08ea88-aa6a-45ea-abd8-9c1e2f69a9b4/insta...ery.sh
<Package Folder>/app_3f08ea88-aa6a-45ea-abd8-9c1e2f69a9b4/pidof
<Package Folder>/app_3f08ea88-aa6a-45ea-abd8-9c1e2f69a9b4/root3
<Package Folder>/app_3f08ea88-aa6a-45ea-abd8-9c1e2f69a9b4/su
<Package Folder>/app_3f08ea88-aa6a-45ea-abd8-9c1e2f69a9b4/supolicy
<Package Folder>/app_3f08ea88-aa6a-45ea-abd8-9c1e2f69a9b4/toolbox
<Package Folder>/app_3f08ea88-aa6a-45ea-abd8-9c1e2f69a9b4/wsroot.sh
<Package Folder>/app_54ae180e-99c3-44e4-a97e-83ceb00c4e0d/Matrix
<Package Folder>/app_54ae180e-99c3-44e4-a97e-83ceb00c4e0d/ddexe
<Package Folder>/app_54ae180e-99c3-44e4-a97e-83ceb00c4e0d/debuggerd
<Package Folder>/app_54ae180e-99c3-44e4-a97e-83ceb00c4e0d/fileWork
<Package Folder>/app_54ae180e-99c3-44e4-a97e-83ceb00c4e0d/insta...ery.sh
<Package Folder>/app_54ae180e-99c3-44e4-a97e-83ceb00c4e0d/pidof
<Package Folder>/app_54ae180e-99c3-44e4-a97e-83ceb00c4e0d/su
<Package Folder>/app_54ae180e-99c3-44e4-a97e-83ceb00c4e0d/supolicy
<Package Folder>/app_54ae180e-99c3-44e4-a97e-83ceb00c4e0d/toolbox
<Package Folder>/app_54ae180e-99c3-44e4-a97e-83ceb00c4e0d/wsroot.sh
<Package Folder>/app_7b18e5cc-9b55-45be-9579-ca9d0873dd3e/Matrix
<Package Folder>/app_7b18e5cc-9b55-45be-9579-ca9d0873dd3e/ddexe
<Package Folder>/app_7b18e5cc-9b55-45be-9579-ca9d0873dd3e/debuggerd
<Package Folder>/app_7b18e5cc-9b55-45be-9579-ca9d0873dd3e/fileWork
<Package Folder>/app_7b18e5cc-9b55-45be-9579-ca9d0873dd3e/insta...ery.sh
<Package Folder>/app_7b18e5cc-9b55-45be-9579-ca9d0873dd3e/pidof
<Package Folder>/app_7b18e5cc-9b55-45be-9579-ca9d0873dd3e/su
<Package Folder>/app_7b18e5cc-9b55-45be-9579-ca9d0873dd3e/supolicy
<Package Folder>/app_7b18e5cc-9b55-45be-9579-ca9d0873dd3e/toolbox
<Package Folder>/app_7b18e5cc-9b55-45be-9579-ca9d0873dd3e/wsroot.sh
<Package Folder>/app_b34ec0f7-d6ea-4780-8e3d-e01c55d61e55/checker.jar
<Package Folder>/app_b872c79c-3aae-4a07-be7d-c602f21abb35/Matrix
<Package Folder>/app_b872c79c-3aae-4a07-be7d-c602f21abb35/ddexe
<Package Folder>/app_b872c79c-3aae-4a07-be7d-c602f21abb35/debuggerd
<Package Folder>/app_b872c79c-3aae-4a07-be7d-c602f21abb35/fileWork
<Package Folder>/app_b872c79c-3aae-4a07-be7d-c602f21abb35/insta...ery.sh
<Package Folder>/app_b872c79c-3aae-4a07-be7d-c602f21abb35/pidof
<Package Folder>/app_b872c79c-3aae-4a07-be7d-c602f21abb35/su
<Package Folder>/app_b872c79c-3aae-4a07-be7d-c602f21abb35/supolicy
<Package Folder>/app_b872c79c-3aae-4a07-be7d-c602f21abb35/toolbox
<Package Folder>/app_b872c79c-3aae-4a07-be7d-c602f21abb35/wsroot.sh
<Package Folder>/app_jgls/.log.lock
<Package Folder>/app_jgls/.log.ls
<Package Folder>/app_plugin_download/4f934f32-aeaa-4f0d-ad6f-d886cf1970ea
<Package Folder>/app_plugin_download/c74c7ef0-d8ab-4d21-9e0a-72458631920d
<Package Folder>/app_sslcache/www.ireadercity.com.443
<Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
<Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
<Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
<Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
<Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
<Package Folder>/app_subox/c61913b615fb6224701377a119081f36
<Package Folder>/app_subox_download/124da77c-973f-430d-9861-52ec6aaa2199
<Package Folder>/app_subox_download/14ad36ee-150c-406b-ab23-04862af93236
<Package Folder>/app_subox_download/3993312b-23ed-4ae7-aeee-f9a91db32839
<Package Folder>/app_subox_download/3cb93756-00ea-4b29-b0a6-5a8cef3c7b1c
<Package Folder>/app_subox_download/670b632b-b953-4bfe-a35d-558d896a5818
<Package Folder>/app_subox_download/8e1bb43b-60ce-41bd-9aa8-8db31564a09c
<Package Folder>/app_subox_download/be353a98-02c8-4223-902b-b4462834865b
<Package Folder>/app_subox_download/f2e7f3a9-72e3-49cc-9d2a-cee84194df00
<Package Folder>/databases/aireader_v2-journal
<Package Folder>/databases/ireader.db-journal
<Package Folder>/databases/t_u.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/SUBOXLOG_
<Package Folder>/files/ru.jar
<Package Folder>/files/ub.jar
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/com_ireader_city_you_qi.xml
<Package Folder>/shared_prefs/dsi.xml
<Package Folder>/shared_prefs/kr.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/sfe.xml
<Package Folder>/shared_prefs/subox.xml
<Package Folder>/shared_prefs/umeng_feedback_conversations.xml
<Package Folder>/shared_prefs/umeng_feedback_user_info.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_message_state.xml
<Package Folder>/shared_prefs/wv.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.SystemConfig/.did
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.system/.did
<SD-Card>/AIReader/####/.did
<SD-Card>/AIReader/####/00171dfcbd3b4e0cb590802aa1828b93jpgx.tmp
<SD-Card>/AIReader/####/046336a8d6684dc880da735dd1a5a72bjpgx.tmp
<SD-Card>/AIReader/####/05dfcf29930c4ce2a9540c14d8a09486jpgx.tmp
<SD-Card>/AIReader/####/063fb8ddef244ad789cd1b986cfe156djpgx.tmp
<SD-Card>/AIReader/####/0afe25005d8d42558e0f3eaa1917fbc2jpgx.tmp
<SD-Card>/AIReader/####/0b4de200b7e54dcf958b3d4017d44286jpgx.tmp
<SD-Card>/AIReader/####/0b6af9c4f2f14426bb575026d6b36250jpgx.tmp
<SD-Card>/AIReader/####/0c2f764876184edc876b69f7dc96584bjpgx.tmp
<SD-Card>/AIReader/####/0d9a736a7dff46ad83dfe94e8e02e439jpgx
<SD-Card>/AIReader/####/0d9a736a7dff46ad83dfe94e8e02e439jpgx.tmp
<SD-Card>/AIReader/####/1da2779c282442cb8f52afdffc972633jpgx.tmp
<SD-Card>/AIReader/####/2e8c2831f269461281fcd26c71d58e90jpgx.tmp
<SD-Card>/AIReader/####/3892231fd56e4444b543d64f2f7956e4jpgx.tmp
<SD-Card>/AIReader/####/3cffce0eded34b8dbfd95248b3cee34fjpgx.tmp
<SD-Card>/AIReader/####/401a689833b343d19a4a25fffd366894jpgx.tmp
<SD-Card>/AIReader/####/41b63d4e07a44a3383992bea7bceb60bjpgx.tmp
<SD-Card>/AIReader/####/46e11afa427441f0a4e93d1cdc1a78b8jpgx.tmp
<SD-Card>/AIReader/####/4c8790dd43174e03b8aee7bd4bed9859jpgx.tmp
<SD-Card>/AIReader/####/581ca85234bd4924a32c3ad5c6cbf850jpgx.tmp
<SD-Card>/AIReader/####/650e2819079b417faac91b846e6935e5jpgx.tmp
<SD-Card>/AIReader/####/6605e52c75cb422b938ef86847c525fcjpgx.tmp
<SD-Card>/AIReader/####/8580904df1e34ce8bd099db945e96209jpgx.tmp
<SD-Card>/AIReader/####/88f8b2824ded4a1db0a8b248a5cdf1fbjpgx.tmp
<SD-Card>/AIReader/####/acf2fd46a3354bbaba0de745e83f2decjpgx.tmp
<SD-Card>/AIReader/####/adv_self_config.dat
<SD-Card>/AIReader/####/af17756cf1d54d08bdde8b66867aefbfjpgx.tmp
<SD-Card>/AIReader/####/b9d11f6f063b405f805043801144a289jpgx.tmp
<SD-Card>/AIReader/####/bf263976d7324759acdc18807eeeca41jpgx.tmp
<SD-Card>/AIReader/####/c8fa56f9aff940bda8886977bbeccb02jpgx.tmp
<SD-Card>/AIReader/####/cb1a3b55aa454984b0e66b4393a02d6bjpgx.tmp
<SD-Card>/AIReader/####/config.data
<SD-Card>/AIReader/####/da3c76c0815c465582f28b8af86ddefajpgx.tmp
<SD-Card>/AIReader/####/de426f63da064635a21286a6d63b9392jpgx.tmp
<SD-Card>/AIReader/####/e03c9aafe456471e9f2336ff1f14cd21jpgx.tmp
<SD-Card>/AIReader/####/ea9f13ac102b46d280b42b0af37c8bddjpgx.tmp
<SD-Card>/AIReader/####/fbab7044fc64448f8f1fa1b8a7454f0djpgx.tmp
<SD-Card>/AIReader/####/home_infos_2.dat
<SD-Card>/AIReader/####/home_infos_22.dat
<SD-Card>/AIReader/####/import.dat
<SD-Card>/AIReader/####/sxsplash20160727_579817d469bca.jpgx_bak
<SD-Card>/AIReader/####/sxsplash20160727_579817da499fb.jpgx_bak
<SD-Card>/AIReader/####/sxsplash20160727_579817de0f457.jpgx_bak
<SD-Card>/AIReader/####/sxsplash20160727_579817e1da72a.jpgx_bak
<SD-Card>/AIReader/####/sxsplash20160727_57981808344f4.jpgx_bak
<SD-Card>/Android/####/V2.7.8.txt
<SD-Card>/Android/####/b.tmp
<SD-Card>/Android/####/b08ffbe76bc53
<SD-Card>/Android/.did
<SD-Card>/data/.did

Другие:

Запускает следующие shell-скрипты:

chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
sh

Загружает динамические библиотеки:

_r964
libjiagu
smssdk

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней