Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.3394
- Android.DownLoader.635.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sup####.qq.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) pi####.qq.com:80
- TCP(HTTP/1.1) ping####.qq.com:80
- TCP(HTTP/1.1) p####.s####.meiba####.com:80
- TCP(HTTP/1.1) openmo####.qq.com:80
- TCP(HTTP/1.1) c.isds####.qq.com:80
- TCP(HTTP/1.1) img.meiba####.com:80
- TCP(HTTP/1.1) cgi.con####.qq.com:80
- TCP(HTTP/1.1) www.s####.net:80
- TCP(TLS/1.0) x####.tc.qq.com:443
- TCP(TLS/1.0) t####.qq.com:443
- TCP(TLS/1.0) ssl.ptlo####.qq.com:443
- TCP(TLS/1.0) ty.cap####.qq.com:443
- TCP(TLS/1.0) 1####.217.20.78:443
- TCP(TLS/1.0) xui.ptlo####.qq.com:443
- TCP(TLS/1.0) sup####.qq.com:443
- TCP(TLS/1.0) ui.ptlo####.qq.com:443
- TCP(TLS/1.0) ssl.cap####.qq.com:443
- TCP(TLS/1.0) pin####.qq.com:443
- TCP(TLS/1.0) huatuos####.we####.com:443
- TCP(TLS/1.0) p####.tc.qq.com:443
Запросы DNS:
- api.dou####.com
- c.isds####.qq.com
- cap####.g####.com
- cgi.con####.qq.com
- huatuos####.we####.com
- img.meiba####.com
- imgc####.qq.com
- j####.aq.qq.com
- openmo####.qq.com
- p####.s####.meiba####.com
- pi####.qq.com
- pin####.qq.com
- ping####.qq.com
- q####.qq.com
- qzones####.g####.cn
- ssl.cap####.qq.com
- ssl.ptlo####.qq.com
- sup####.qq.com
- t####.qq.com
- ty.cap####.qq.com
- ui.ptlo####.qq.com
- www.s####.net
- xui.ptlo####.qq.com
Запросы HTTP GET:
- c.isds####.qq.com/code.cgi?uin=####&domain=####&rate=####&time=####&code...
- cgi.con####.qq.com/qqconnectopen/openapi/policy_conf?sdkv=####&appid=###...
- img.meiba####.com/bidou/covers/1.jpg?_=####
- img.meiba####.com/bidou/covers/12.jpg?_=####
- img.meiba####.com/bidou/covers/13.jpg?_=####
- img.meiba####.com/bidou/covers/15.jpg?_=####
- img.meiba####.com/bidou/covers/16.jpg?_=####
- img.meiba####.com/bidou/covers/17.jpg?_=####
- img.meiba####.com/bidou/covers/19.jpg?_=####
- img.meiba####.com/bidou/covers/21.jpg?_=####
- img.meiba####.com/bidou/covers/22.jpg?_=####
- img.meiba####.com/bidou/covers/23.jpg?_=####
- img.meiba####.com/bidou/covers/24.jpg?_=####
- img.meiba####.com/bidou/covers/26.jpg?_=####
- img.meiba####.com/bidou/covers/28.jpg?_=####
- img.meiba####.com/bidou/covers/29.jpg?_=####
- img.meiba####.com/bidou/covers/3.jpg?_=####
- img.meiba####.com/bidou/covers/30.jpg?_=####
- img.meiba####.com/bidou/covers/31.jpg?_=####
- img.meiba####.com/bidou/covers/32.jpg?_=####
- img.meiba####.com/bidou/covers/33.jpg?_=####
- img.meiba####.com/bidou/covers/34.jpg?_=####
- img.meiba####.com/bidou/covers/35.jpg?_=####
- img.meiba####.com/bidou/covers/36.jpg?_=####
- img.meiba####.com/bidou/covers/37.jpg?_=####
- img.meiba####.com/bidou/covers/38.jpg?_=####
- img.meiba####.com/bidou/covers/39.jpg?_=####
- img.meiba####.com/bidou/covers/40.jpg?_=####
- img.meiba####.com/bidou/covers/41.jpg?_=####
- img.meiba####.com/bidou/covers/42.jpg?_=####
- img.meiba####.com/bidou/covers/43.jpg?_=####
- img.meiba####.com/bidou/covers/44.jpg?_=####
- img.meiba####.com/bidou/covers/45.jpg?_=####
- img.meiba####.com/bidou/covers/46.jpg?_=####
- img.meiba####.com/bidou/covers/47.jpg?_=####
- img.meiba####.com/bidou/covers/48.jpg?_=####
- img.meiba####.com/bidou/covers/49.jpg?_=####
- img.meiba####.com/bidou/covers/5.jpg?_=####
- img.meiba####.com/bidou/covers/50.jpg?_=####
- img.meiba####.com/bidou/covers/51.jpg?_=####
- img.meiba####.com/bidou/covers/52.jpg?_=####
- img.meiba####.com/bidou/covers/56.jpg?_=####
- img.meiba####.com/bidou/covers/57.jpg?_=####
- img.meiba####.com/bidou/covers/58.jpg?_=####
- img.meiba####.com/bidou/covers/59.jpg?_=####
- img.meiba####.com/bidou/covers/61.jpg?_=####
- img.meiba####.com/bidou/covers/62.jpg?_=####
- img.meiba####.com/bidou/covers/63.jpg?_=####
- img.meiba####.com/bidou/covers/64.jpg?_=####
- img.meiba####.com/bidou/covers/65.jpg?_=####
- img.meiba####.com/bidou/covers/66.jpg?_=####
- img.meiba####.com/bidou/covers/67.jpg?_=####
- img.meiba####.com/bidou/covers/68.jpg?_=####
- img.meiba####.com/bidou/covers/69.jpg?_=####
- img.meiba####.com/bidou/covers/70.jpg?_=####
- img.meiba####.com/bidou/covers/71.jpg?_=####
- img.meiba####.com/bidou/covers/72.jpg?_=####
- img.meiba####.com/bidou/covers/73.jpg?_=####
- img.meiba####.com/bidou/covers/74.jpg?_=####
- img.meiba####.com/bidou/covers/75.jpg?_=####
- img.meiba####.com/bidou/covers/76.jpg?_=####
- img.meiba####.com/bidou/covers/77.jpg?_=####
- img.meiba####.com/bidou/covers/78.jpg?_=####
- img.meiba####.com/bidou/covers/79.jpg?_=####
- img.meiba####.com/bidou/covers/80.jpg?_=####
- img.meiba####.com/bidou/covers/83.jpg?_=####
- img.meiba####.com/bidou/covers/84.jpg?_=####
- img.meiba####.com/bidou/covers/85.jpg?_=####
- img.meiba####.com/bidou/covers/86.jpg?_=####
- img.meiba####.com/bidou/covers/87.jpg?_=####
- img.meiba####.com/bidou/covers/88.jpg?_=####
- img.meiba####.com/bidou/covers/89.jpg?_=####
- img.meiba####.com/bidou/covers/90.jpg?_=####
- img.meiba####.com/bidou/covers/91.jpg?_=####
- img.meiba####.com/bidou/covers/92.jpg?_=####
- img.meiba####.com/bidou/covers/93.jpg?_=####
- img.meiba####.com/bidou/covers/94.jpg?_=####
- img.meiba####.com/shinetpl/88/88_1.jpg
- img.meiba####.com/shinetpl/88/88_2.jpg
- img.meiba####.com/shinetpl/88/88_3.jpg
- img.meiba####.com/shinetpl/88/88_4.jpg
- img.meiba####.com/shinetpl/88/88_5.jpg
- img.meiba####.com/shinetpl/88/88_6.jpg
- img.meiba####.com/shinetpl/88/88_7.jpg
- img.meiba####.com/shinetpl/88/88_7.jpg?_=####&t=####
- img.meiba####.com/shinetpl/88/88_8.jpg
- img.meiba####.com/shinetpl/88/88_8.jpg?_=####&t=####
- img.meiba####.com/shinetpl/88/88_9.jpg
- openmo####.qq.com/oauth2.0/m_jump_by_version?sdkv=####&status_machine=##...
- p####.s####.meiba####.com/face?u=####&md5=####&id=####
- p####.s####.meiba####.com/index?uuid=####&callback=####&_=####
- p####.s####.meiba####.com/list?cid=####&u=####&md5=####&callback=####&_=...
- p####.s####.meiba####.com/start.gif?v=####&c=####&u=####&t=####&model=##...
- p####.tc.qq.com/open/mobile/sdk_common/down_qq.htm?sdkv=####&status_mach...
- p####.tc.qq.com/open/portal/common/copyright.js
- p####.tc.qq.com/open_proj/qqconnect/h5login/css/jump2.css?t=####
- p####.tc.qq.com/open_proj/qqconnect/h5login/css/sprite/jump2.png?max_age...
- ping####.qq.com/pingd?dm=####&pvi=####&si=####&url=####&arg=fid####&url=...
- sup####.qq.com/include/js/all.js
- sup####.qq.com/include/js/qmtool.js
- sup####.qq.com/include/qqmaileditor/editor.js
- sup####.qq.com/include/style/comm2010.css
- sup####.qq.com/js/forum/forum_780.js
- sup####.qq.com/js/isd_speed.js
- sup####.qq.com/login.shtml?fid=780&url=http://support.qq.com/write.shtml...
- sup####.qq.com/write.shtml?fid=####&ADPUBNO=####
Запросы HTTP POST:
- p####.s####.meiba####.com/update
- pi####.qq.com/mstat/report
- sup####.qq.com/cgi-bin/loginInfo
- www.s####.net/Mini/niouy.action?key=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_database/CachedGeoposition.db
- <Package Folder>/app_database/CachedGeoposition.db-journal
- <Package Folder>/app_mxcsjlpl/<Package>.apk
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/f_000032
- <Package Folder>/cache/####/f_000033
- <Package Folder>/cache/####/f_000034
- <Package Folder>/cache/####/f_000035
- <Package Folder>/cache/####/f_000036
- <Package Folder>/cache/####/f_000037
- <Package Folder>/cache/####/f_000038
- <Package Folder>/cache/####/f_000039
- <Package Folder>/cache/####/f_00003a
- <Package Folder>/cache/####/f_00003b
- <Package Folder>/cache/####/f_00003c
- <Package Folder>/cache/####/f_00003d
- <Package Folder>/cache/####/f_00003e
- <Package Folder>/cache/####/f_00003f
- <Package Folder>/cache/####/f_000040
- <Package Folder>/cache/####/f_000041
- <Package Folder>/cache/####/f_000042
- <Package Folder>/cache/####/f_000043
- <Package Folder>/cache/####/f_000044
- <Package Folder>/cache/####/f_000045
- <Package Folder>/cache/####/f_000046
- <Package Folder>/cache/####/f_000047
- <Package Folder>/cache/####/f_000048
- <Package Folder>/cache/####/f_000049
- <Package Folder>/cache/####/f_00004a
- <Package Folder>/cache/####/f_00004b
- <Package Folder>/cache/####/f_00004c
- <Package Folder>/cache/####/f_00004d
- <Package Folder>/cache/####/f_00004e
- <Package Folder>/cache/####/f_00004f
- <Package Folder>/cache/####/f_000050
- <Package Folder>/cache/####/f_000051
- <Package Folder>/cache/####/f_000052
- <Package Folder>/cache/####/f_000053
- <Package Folder>/cache/####/f_000054
- <Package Folder>/cache/####/index
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/tencent_analysis.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/com.tencent.open.config.json.1105178777
- <Package Folder>/files/mobclick_agent_cached_<Package>200129
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/Android/####/.nomedia
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- MtaNativeCrash
- jpush217
- libjiagu
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
