Android.Packed.35509

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.589.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) h####.a####.com:80
TCP(HTTP/1.1) x####.a####.com.####.com:80
TCP(HTTP/1.1) kvt####.m####.a####.com:80
TCP(HTTP/1.1) t####.dmp.y####.net:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) cs228-####.a####.com:80
TCP(HTTP/1.1) au.y####.net:80
TCP(HTTP/1.1) sdk.st####.y####.com:80
TCP(HTTP/1.1) aos.w####.y####.net:80
TCP(HTTP/1.1) a####.a####.com:80
TCP(HTTP/1.1) s####.gw.y####.####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) 47.92.1####.96:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) cdnapph####.b0.a####.com:80
TCP(HTTP/1.1) nb4500-####.a####.com:80
TCP(HTTP/1.1) a####.m.ta####.com:80
TCP(HTTP/1.1) nb4051-####.a####.com:80
TCP(HTTP/1.1) cdn.game####.org:80
TCP(HTTP/1.1) app.w####.cn:80
TCP(HTTP/1.1) fu1.a####.com:80
TCP(HTTP/1.1) s.y####.net:80
TCP(HTTP/1.1) nb4520-####.a####.com:80
TCP(TLS/1.0) 1####.217.20.78:443
TCP(TLS/1.0) c####.im.ta####.com:443
TCP(TLS/1.0) y####.e####.top:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) i####.ww.ta####.com:443
UDP 2####.0.0.1:9998

Запросы DNS:

9####.nd####.y####.com
a####.a####.com
a####.m.ta####.com
a####.u####.com
aos.w####.y####.net
app.w####.cn
au.y####.net
c####.im.ta####.com
cdn.app.e####.top
cdn.game####.org
cs228-####.a####.com
fu1.a####.com
h####.a####.com
h####.a####.com
h####.a####.com
i####.ww.ta####.com
ip.ta####.com
kvt####.m####.a####.com
m####.a####.com
nb4051-####.a####.com
nb4500-####.a####.com
nb4520-####.a####.com
res.we####.cn
s####.gw.y####.net
s.y####.net
sdk.st####.y####.com
t####.dmp.y####.net
www.a####.com
www.go####.com
x####.a####.com
y####.e####.top

Запросы HTTP GET:

a####.a####.com/atiws/atiappcommon?platform=####&appver=####&gameid=####...
aos.w####.y####.net/v3/zip_upd?s=####
app.w####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=#...
au.y####.net/offer/dist/aos/pkg/2.6.1/offers_2.6.1.zip
cdn.game####.org/strategy/base
cdn.game####.org/strategy/dev_root2
cdn.game####.org/strategy/loss_4.3
cdn.game####.org/strategy/sul18
cdnapph####.b0.a####.com/sfile/201711/16/all/cp_V3.0.0.txt
cs228-####.a####.com/user/493/20751493/1006/card/47378037/47378037_800.jpg
fu1.a####.com/account/116/43486116/account/43486116_normal.jpg
fu1.a####.com/account/181/13493181/account/13493181_normal.jpg
fu1.a####.com/account/185/10844185/account/10844185_normal.jpg
fu1.a####.com/account/20/21066020/account/21066020_normal.jpg
fu1.a####.com/account/282/47030282/account/47030282_normal.jpg
fu1.a####.com/account/382/29276382/account/29276382_normal.jpg
fu1.a####.com/account/485/31201485/account/31201485_normal.jpg
fu1.a####.com/account/493/20751493/account/20751493_normal.jpg
fu1.a####.com/account/611/35647611/account/35647611_normal.jpg
fu1.a####.com/account/706/29940706/account/29940706_normal.jpg
fu1.a####.com/account/987/9642987/account/9642987_normal.jpg
h####.a####.com/user/185/10844185/1006/card/47374898/47374898_800.jpg
h####.a####.com/user/485/31201485/1004/card/47375715/47375715_800.jpg
h####.a####.com/user/493/20751493/1006/card/47372779/47372779_800.jpg
h####.a####.com/user/493/20751493/1006/card/47378037/47378037_800.jpg
h####.a####.com/user/706/29940706/1005/card/47373771/47373771_800.jpg
ip.ta####.com/service/getIpInfo2.php?ip=####
kvt####.m####.a####.com/kvinfo.php
nb4051-####.a####.com/user/485/31201485/1004/card/47375715/47375715_800....
nb4500-####.a####.com/user/706/29940706/1005/card/47373771/47373771_800....
nb4520-####.a####.com/user/185/10844185/1006/card/47374898/47374898_800....
s####.gw.y####.####.com/aos/v3/initf?s=####
s####.gw.y####.####.com/stat/v3/udt2?appid=####&s=####
s.y####.net/stat/aos/v3/pkc?s=####
s.y####.net/stat/aos/v3/pku?s=####
sdk.st####.y####.com/core/aos-dex/1701/7011/6f830529.jar
x####.a####.com.####.com/api/framework/adConf/35?platform=####&appver=##...
x####.a####.com.####.com/api/framework/jifen/enter/35?platform=####&appv...
x####.a####.com.####.com/api/hot/bannerItem/661?platform=####&appver=###...
x####.a####.com.####.com/api/hot/titleItem/662?platform=####&appver=####...
x####.a####.com.####.com/api/hot/videos/12541?appId=####&xifenId=####&pl...
x####.a####.com.####.com/api/jifen/firstInstallInit?platform=####&appver...
x####.a####.com.####.com/api/specialTopic/itemList/664?platform=####&app...
x####.a####.com.####.com/api/star/list/12541?appId=####&xifenId=####&pla...
x####.a####.com.####.com/common/img/upload/xifen/1483429773_541.png
x####.a####.com.####.com/common/img/upload/xifen/1495889588_39.jpg
x####.a####.com.####.com/common/img/upload/xifen/1496931177_676.jpg
x####.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&app=...
x####.a####.com.####.com/mobile/apps/apps_module-badDomain.html

Запросы HTTP POST:

a####.m.ta####.com/rest/gc?dd=####&nsgs=####&ak=####&av=####&c=####&v=##...
a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
a####.u####.com/app_logs
app.w####.cn/action/user_info
kvt####.m####.a####.com/i.gif
t####.dmp.y####.net/v1/android/packages?rt=####&sign=####
t####.dmp.y####.net/v2/android/pkgtime?rt=####&sign=####

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_3247dff8-4b75-4c54-ba65-f401c2f82483/Matrix
<Package Folder>/app_3247dff8-4b75-4c54-ba65-f401c2f82483/ddexe
<Package Folder>/app_3247dff8-4b75-4c54-ba65-f401c2f82483/debuggerd
<Package Folder>/app_3247dff8-4b75-4c54-ba65-f401c2f82483/device.db
<Package Folder>/app_3247dff8-4b75-4c54-ba65-f401c2f82483/fileWork
<Package Folder>/app_3247dff8-4b75-4c54-ba65-f401c2f82483/insta...ery.sh
<Package Folder>/app_3247dff8-4b75-4c54-ba65-f401c2f82483/pidof
<Package Folder>/app_3247dff8-4b75-4c54-ba65-f401c2f82483/root3
<Package Folder>/app_3247dff8-4b75-4c54-ba65-f401c2f82483/su
<Package Folder>/app_3247dff8-4b75-4c54-ba65-f401c2f82483/supolicy
<Package Folder>/app_3247dff8-4b75-4c54-ba65-f401c2f82483/toolbox
<Package Folder>/app_3247dff8-4b75-4c54-ba65-f401c2f82483/wsroot.sh
<Package Folder>/app_a469e655-ff74-4c1e-bc9a-a84f06b7cf36/b886e...ba3e61
<Package Folder>/app_a469e655-ff74-4c1e-bc9a-a84f06b7cf36/bf616...29.jar
<Package Folder>/app_dbd8f5ab-3b36-40c5-8c3a-c8ddc7d888e0/Matrix
<Package Folder>/app_dbd8f5ab-3b36-40c5-8c3a-c8ddc7d888e0/ddexe
<Package Folder>/app_dbd8f5ab-3b36-40c5-8c3a-c8ddc7d888e0/debuggerd
<Package Folder>/app_dbd8f5ab-3b36-40c5-8c3a-c8ddc7d888e0/fileWork
<Package Folder>/app_dbd8f5ab-3b36-40c5-8c3a-c8ddc7d888e0/insta...ery.sh
<Package Folder>/app_dbd8f5ab-3b36-40c5-8c3a-c8ddc7d888e0/pidof
<Package Folder>/app_dbd8f5ab-3b36-40c5-8c3a-c8ddc7d888e0/su
<Package Folder>/app_dbd8f5ab-3b36-40c5-8c3a-c8ddc7d888e0/supolicy
<Package Folder>/app_dbd8f5ab-3b36-40c5-8c3a-c8ddc7d888e0/toolbox
<Package Folder>/app_dbd8f5ab-3b36-40c5-8c3a-c8ddc7d888e0/wsroot.sh
<Package Folder>/app_libs/ymdex.jar
<Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
<Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
<Package Folder>/app_subox_download/1804f3f8-a7e9-4fff-bb8d-5489233930dd
<Package Folder>/app_subox_download/38cf3b81-9b84-4ec8-aacb-db2e4fe8b057
<Package Folder>/app_subox_download/572179cd-fc94-4cd0-816c-47d68b69b71c
<Package Folder>/app_subox_download/db58bcdf-ae94-40a9-9010-e730370721f9
<Package Folder>/cache/####/10c5ba31ac6d38257625ae18099c23223e1....0.tmp
<Package Folder>/cache/####/287caf5e5cd481a8ac237bf05eb2d1023d3....0.tmp
<Package Folder>/cache/####/4736b7d81d71a6b7fd1e8992534d4ee3fb8....0.tmp
<Package Folder>/cache/####/4b169ac7607a7b19d511d164c2c5e0988f0....0.tmp
<Package Folder>/cache/####/4d8fa7e1253e6b6b187bff5acaff1448c23....0.tmp
<Package Folder>/cache/####/4ea2ccc23671c40ae9d3c0030f351d0af95....0.tmp
<Package Folder>/cache/####/77ab5d6cc319858a884d324920160cb7881....0.tmp
<Package Folder>/cache/####/7b95d32c0cda3c880fdaa6a35f60d9cde96....0.tmp
<Package Folder>/cache/####/85e8effd26542756640ed3c421a3b9e5a38....0.tmp
<Package Folder>/cache/####/9114872ca4b3325a75471890ee8435cbf2a....0.tmp
<Package Folder>/cache/####/91a604f1a8d538d45dc9be2ee2de2694416....0.tmp
<Package Folder>/cache/####/add35a64dbf79d7edd98a73417ce9df886a....0.tmp
<Package Folder>/cache/####/b36edeb1595d3e352aa30ac943335a65aae....0.tmp
<Package Folder>/cache/####/bae1764e1be86390dcea5dc0696139394eb....0.tmp
<Package Folder>/cache/####/beef06084026662de89e2c91ea2e0be6012....0.tmp
<Package Folder>/cache/####/ca9a940bd9dc59a657d089a684fd9a4587d....0.tmp
<Package Folder>/cache/####/e9b1c61ae2c5b607e97392b19d4613d1392....0.tmp
<Package Folder>/cache/####/ff553734cf2d71e145cc1f22cb834e9e085....0.tmp
<Package Folder>/cache/####/journal.tmp
<Package Folder>/cache/V3.0.0.txt
<Package Folder>/cache/a61b3783488a4aaaeae09a124505e468.0.tmp
<Package Folder>/cache/a61b3783488a4aaaeae09a124505e468.1.tmp
<Package Folder>/cache/c7199a038676db93dfe2646c4e71021a.0.tmp
<Package Folder>/cache/c7199a038676db93dfe2646c4e71021a.1.tmp
<Package Folder>/cache/cce6cfc2e14e8aeb66d96e52663c8f05.0.tmp
<Package Folder>/cache/cce6cfc2e14e8aeb66d96e52663c8f05.1.tmp
<Package Folder>/cache/d629dc32723f4d706b261cf2284b4fa2.0.tmp
<Package Folder>/cache/d629dc32723f4d706b261cf2284b4fa2.1.tmp
<Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.0.tmp
<Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.1.tmp
<Package Folder>/cache/journal.tmp
<Package Folder>/databases/2d30dd34bfca97f9a733070bb719d89a-journal
<Package Folder>/databases/OxgHkj2lz09F
<Package Folder>/databases/OxgHkj2lz09F-journal
<Package Folder>/databases/P15pKIjsm64m
<Package Folder>/databases/P15pKIjsm64m-journal
<Package Folder>/databases/T1oX0rhhuXWt
<Package Folder>/databases/T1oX0rhhuXWt-journal
<Package Folder>/databases/XKwVoK0huy3R
<Package Folder>/databases/XKwVoK0huy3R-journal
<Package Folder>/databases/d8305c5b3d6c8db862c69f2760ab1f81
<Package Folder>/databases/d8305c5b3d6c8db862c69f2760ab1f81-journal
<Package Folder>/databases/e57c34b26a4c8e1b872a8608bae7c4ed
<Package Folder>/databases/e57c34b26a4c8e1b872a8608bae7c4ed-journal
<Package Folder>/databases/jqIqJYOT3JpT
<Package Folder>/databases/jqIqJYOT3JpT-journal
<Package Folder>/databases/t_u.db-journal
<Package Folder>/databases/wIU6pTyUBYWX
<Package Folder>/databases/wIU6pTyUBYWX-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/wsUL1uCdKvjD
<Package Folder>/databases/wsUL1uCdKvjD-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/arrow-left.png
<Package Folder>/files/####/arrow-right.png
<Package Folder>/files/####/blank.gif
<Package Folder>/files/####/close-icon.png
<Package Folder>/files/####/config.json
<Package Folder>/files/####/default.png
<Package Folder>/files/####/detail-wx.html
<Package Folder>/files/####/detail-wx.js
<Package Folder>/files/####/detail.html
<Package Folder>/files/####/detail.js
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/####/feedback.html
<Package Folder>/files/####/feedback.js
<Package Folder>/files/####/form.css
<Package Folder>/files/####/global.js
<Package Folder>/files/####/lists.css
<Package Folder>/files/####/lists.html
<Package Folder>/files/####/lists.js
<Package Folder>/files/####/md5.js
<Package Folder>/files/####/pic_m.png
<Package Folder>/files/####/pic_tips_01.png
<Package Folder>/files/####/pic_tips_02.png
<Package Folder>/files/####/result.png
<Package Folder>/files/####/rule.html
<Package Folder>/files/####/sdetail.html
<Package Folder>/files/####/share.css
<Package Folder>/files/####/share.html
<Package Folder>/files/####/share.js
<Package Folder>/files/####/sprite-face.png
<Package Folder>/files/####/sprite-icons.png
<Package Folder>/files/####/sprite-icons2.png
<Package Folder>/files/####/wx-step1.jpg
<Package Folder>/files/####/wx-step2.jpg
<Package Folder>/files/####/wx-step3.jpg
<Package Folder>/files/####/wx-step4.jpg
<Package Folder>/files/####/wx-step5.jpg
<Package Folder>/files/.imprint
<Package Folder>/files/5a291eff3eb138f09267c769a812199e.zip
<Package Folder>/files/CacheTime.dat
<Package Folder>/files/RptKVStrategy.txt
<Package Folder>/files/SUBOXLOG_
<Package Folder>/files/aipai.btconfig
<Package Folder>/files/aipai.guid
<Package Folder>/files/ho.jar
<Package Folder>/files/ov.jar
<Package Folder>/files/sp.lock
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/AppSettings.xml
<Package Folder>/shared_prefs/C0XKJAO3JLZKJPDKJFXLINQCJIOAOD.xml
<Package Folder>/shared_prefs/CE94557724F842149D690D0E8CBB1CBD.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/CookiePersistence.xml
<Package Folder>/shared_prefs/OFFERSCONFIG1.xml
<Package Folder>/shared_prefs/ShowAdFlag.xml
<Package Folder>/shared_prefs/UTCommon.xml
<Package Folder>/shared_prefs/UTMCConf1852563426.xml
<Package Folder>/shared_prefs/UTMCLog1852563426.xml
<Package Folder>/shared_prefs/ad_system_config.xml
<Package Folder>/shared_prefs/kr.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/rx_sf_account.xml
<Package Folder>/shared_prefs/rx_sf_app.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/vbz.xml
<Package Folder>/shared_prefs/ywPrefsTools.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.com.taobao.dp/6c709c11d2d46a7b
<SD-Card>/.com.taobao.dp/dd7893586a493dc3
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/373240561418738c721572c1da14b85e
<SD-Card>/Android/####/373240561418738c721572c1da14b85e.ymtf
<SD-Card>/Android/####/AppPackage.dat
<SD-Card>/Android/####/CacheTime.dat
<SD-Card>/Android/####/DXTX902KJZX9JASLDJF.ymtf
<SD-Card>/Android/####/UnPackage.dat
<SD-Card>/Android/####/android
<SD-Card>/Android/####/i42d45df023jnkdd93la483f9xGFKXI
<SD-Card>/Android/####/s92TjjdfoP2n3o9dfji2l9s1olkjf0p

Другие:

Запускает следующие shell-скрипты:

/system/bin/cat /sys/devices/system/cpu/kernel_max
cat /proc/cpuinfo | grep Serial
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
ls -l /system/xbin/su
sh

Загружает динамические библиотеки:

abcdefgh
libjiagu
securitysdk-3.1
xifen

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о геолокации.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Добавляет задания в системный планировщик.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней