Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.HiddenAds.221.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) up####.sdk.jig####.cn:80
- TCP(HTTP/1.1) zhg.ali####.com:80
- TCP(HTTP/1.1) api.b####.com:80
- TCP(HTTP/1.1) ope####.m.ta####.com:80
- TCP(HTTP/1.1) ad####.m.ta####.com:80
- TCP(HTTP/1.1) o####.map.b####.com:80
- TCP(HTTP/1.1) ada####.m.ta####.com:80
- TCP(TLS/1.0) api.map.b####.com:443
- TCP(TLS/1.0) av1.x####.com:443
- TCP(TLS/1.0) c####.x####.com:443
- TCP(TLS/1.0) nbsdk-b####.al####.com:443
- UDP easytom####.com:19000
- UDP s.j####.cn:19000
Запросы DNS:
- acs4bai####.m.ta####.com
- ad####.m.ta####.com
- ada####.m.ta####.com
- api.b####.com
- api.map.b####.com
- av1.x####.com
- c####.x####.com
- easytom####.com
- i.t####.com
- loc.map.b####.com
- nbsdk-b####.al####.com
- o####.map.b####.com
- s.j####.cn
- sis.j####.io
- up####.sdk.jig####.cn
- y####.al####.com
Запросы HTTP GET:
- ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
- ope####.m.ta####.com/gw-open/mtop.taobao.tbk.sdk.config/1.0/?data=####
Запросы HTTP POST:
- ada####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=###...
- api.b####.com/api/app_update?
- api.b####.com/api/get_index_category?
- api.b####.com/api/get_session_id?
- api.b####.com/api/get_visitor_id?
- api.b####.com/api/page_list_result?
- api.b####.com/api/sns/is_notification2?
- o####.map.b####.com/offline_loc
- o####.map.b####.com/sdk.php
- up####.sdk.jig####.cn/v1/push/sdk/postlist
- zhg.ali####.com/saveWb.json
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_SGLib/libsgmainso-5.1.81.so.tmp
- <Package Folder>/app_SGLib/lock.lock
- <Package Folder>/databases/jpush_local_notification.db
- <Package Folder>/databases/jpush_local_notification.db-journal
- <Package Folder>/databases/jpush_local_notification.db-shm
- <Package Folder>/databases/jpush_local_notification.db-wal
- <Package Folder>/databases/jpush_statistics.db
- <Package Folder>/databases/jpush_statistics.db-journal
- <Package Folder>/databases/jpush_statistics.db-shm (deleted)
- <Package Folder>/databases/jpush_statistics.db-wal
- <Package Folder>/databases/ut.db
- <Package Folder>/databases/ut.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/webviewCookiesChromiumPrivate.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/1510835468923_2077
- <Package Folder>/files/####/1510835468964_2077
- <Package Folder>/files/####/1510835469104_2077
- <Package Folder>/files/####/1510835469303_2077
- <Package Folder>/files/####/1510835470048_2077
- <Package Folder>/files/####/1510835470280_2077
- <Package Folder>/files/####/1510835471024_2077
- <Package Folder>/files/####/1510835471042_2077
- <Package Folder>/files/####/1510835471070_2077
- <Package Folder>/files/####/1510835478366_2077
- <Package Folder>/files/####/1510835478393_2077
- <Package Folder>/files/####/1510835478433_2077
- <Package Folder>/files/####/1510835478462_2077
- <Package Folder>/files/####/1510835486878_2077
- <Package Folder>/files/####/1510835486900_2077
- <Package Folder>/files/####/1510835490429_2077
- <Package Folder>/files/####/1510835490460_2077
- <Package Folder>/files/####/1510835490508_2077
- <Package Folder>/files/####/1510835490552_2077
- <Package Folder>/files/####/1510835495479_2077
- <Package Folder>/files/####/1510835495523_2077
- <Package Folder>/files/####/1510835503046_2077
- <Package Folder>/files/####/1510835503074_2077
- <Package Folder>/files/####/1510835503103_2077
- <Package Folder>/files/####/1510835503125_2077
- <Package Folder>/files/####/1510835504039_2077
- <Package Folder>/files/####/1510835504057_2077
- <Package Folder>/files/####/1510835505031_2077
- <Package Folder>/files/####/1510835505052_2077
- <Package Folder>/files/####/1510835505089_2077
- <Package Folder>/files/####/1510835505120_2077
- <Package Folder>/files/####/1510835505553_2077
- <Package Folder>/files/####/1510835505587_2077
- <Package Folder>/files/####/1510835511249_2077
- <Package Folder>/files/####/1510835511286_2077
- <Package Folder>/files/####/1510835511333_2077
- <Package Folder>/files/####/1510835511364_2077
- <Package Folder>/files/####/1510835521775_2077
- <Package Folder>/files/####/1510835521800_2077
- <Package Folder>/files/####/1510835522292_2077
- <Package Folder>/files/####/1510835522320_2077
- <Package Folder>/files/####/1510835522338_2077
- <Package Folder>/files/####/1510835522364_2077
- <Package Folder>/files/####/1510835522796_2077
- <Package Folder>/files/####/1510835522900_2077
- <Package Folder>/files/####/1510835524350_2077
- <Package Folder>/files/####/1510835524366_2077
- <Package Folder>/files/####/1510835524407_2077
- <Package Folder>/files/####/1510835524427_2077
- <Package Folder>/files/####/1510835534413_2271
- <Package Folder>/files/####/firll.dat
- <Package Folder>/files/####/gal.db
- <Package Folder>/files/####/gal.db-journal
- <Package Folder>/files/####/ofl_location.db
- <Package Folder>/files/####/ofl_location.db-journal
- <Package Folder>/files/####/ofl_statistics.db
- <Package Folder>/files/####/ofl_statistics.db-journal
- <Package Folder>/files/0a231bd8575dcf72.txt
- <Package Folder>/files/1d77ea041509fe06.lock
- <Package Folder>/files/21c22f492aba3de8.lock
- <Package Folder>/files/8ef9c457b3bbb403.lock
- <Package Folder>/files/930a31b34bd52c08.lock
- <Package Folder>/files/SGMANAGER_DATA2.tmp
- <Package Folder>/files/ap.Lock
- <Package Folder>/files/appPackageNames
- <Package Folder>/files/jpush_stat_cache.json
- <Package Folder>/files/jpush_stat_cache_history.json
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/sp.lock
- <Package Folder>/files/timestamp
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/AlibcLinkPartner.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/JPushSA_Config.xml
- <Package Folder>/shared_prefs/Shortcut.xml
- <Package Folder>/shared_prefs/TDCloudSettingsConfigAA9E36B6619F...C9.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml
- <Package Folder>/shared_prefs/TDpref_longtime0.xml
- <Package Folder>/shared_prefs/TDpref_shorttime.xml
- <Package Folder>/shared_prefs/TDpref_shorttime0.xml
- <Package Folder>/shared_prefs/UTCommon.xml
- <Package Folder>/shared_prefs/account.pref.xml
- <Package Folder>/shared_prefs/aliTradeConfigSP.xml
- <Package Folder>/shared_prefs/authStatus_<Package>;remote.xml
- <Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.rid.xml
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml
- <Package Folder>/shared_prefs/common.pref.xml
- <Package Folder>/shared_prefs/cookies_pref.xml
- <Package Folder>/shared_prefs/jg_so_upgrade_setting.xml
- <Package Folder>/shared_prefs/jpush_device_info.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/native_cookie.xml
- <Package Folder>/shared_prefs/onesdk_device.xml
- <Package Folder>/shared_prefs/tdid.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/.com.taobao.dp/6c709c11d2d46a7b
- <SD-Card>/.com.taobao.dp/dd7893586a493dc3
- <SD-Card>/.com.taobao.dp/hid.dat
- <SD-Card>/.tcookieid
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
- <SD-Card>/baidu/####/ls.db
- <SD-Card>/baidu/####/ls.db-journal
- <SD-Card>/baidu/####/yoh.dat
- <SD-Card>/baidu/####/yol.dat
- <SD-Card>/baidu/####/yom.dat
- <SD-Card>/data/.push_deviceid
- <SD-Card>/test.0
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- getprop
Загружает динамические библиотеки:
- jcore117
- libjiagu
- locSDK7
- sgmainso-5.1
- ut_c_api
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
