Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Triada.243
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) up####.sdk.jig####.cn:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) 1####.23.136.190:8088
- TCP(HTTP/1.1) res####.a####.com:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) 1####.74.136.1:8088
- TCP(TLS/1.0) s####.j####.cn:443
- UDP easytom####.com:19000
- TCP 1####.46.30.57:7007
- UDP s.j####.cn:19000
Запросы DNS:
- a####.u####.com
- easytom####.com
- imgc####.qq.com
- mi.g####.qq.com
- res####.a####.com
- s####.e.qq.com
- s####.j####.cn
- s.j####.cn
- sis.j####.io
- up####.sdk.jig####.cn
Запросы HTTP GET:
- mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
- p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
- res####.a####.com/v3/ip?key=####
Запросы HTTP POST:
- a####.u####.com/app_logs
- s####.e.qq.com/activate
- s####.e.qq.com/msg
- up####.sdk.jig####.cn/v1/push/sdk/postlist
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar.sig
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp.sig
- <Package Folder>/app_e_qq_com_plugin/update_lc
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.sig
- <Package Folder>/app_e_qq_com_setting/gdt_suid
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.sig
- <Package Folder>/cache/####/03fac2ade9f064fb44faee9d20a06a1aca5....0.tmp
- <Package Folder>/cache/####/0746d29cfe1646cdc5b8f506fbdbec19f76....0.tmp
- <Package Folder>/cache/####/205bc3067c84ec4d062ae4c0c7203a1f811....0.tmp
- <Package Folder>/cache/####/21b84f7b4f7215184ca698a45f0fe5577cc....0.tmp
- <Package Folder>/cache/####/28fabcf75a6d4e98b7e464b19a168eeee88....0.tmp
- <Package Folder>/cache/####/36eae7222928a949ff39e505bb29253d7f6....0.tmp
- <Package Folder>/cache/####/3c66df40f4898fe147fd404c39d4623ef6d....0.tmp
- <Package Folder>/cache/####/3e0884553b283be5df271fa7382cc0ad9e1....0.tmp
- <Package Folder>/cache/####/3e18b1d2c0447d8b73df031826a380265b4....0.tmp
- <Package Folder>/cache/####/432c2d26d0d0b9f51d667e9017dcc790afb....0.tmp
- <Package Folder>/cache/####/45401623926814d19d4181f0bf1c1ddc86c....0.tmp
- <Package Folder>/cache/####/4b64ed82700449c3d44e40e8478cd9a96bd....0.tmp
- <Package Folder>/cache/####/56d5e2a903077e2cdf21ead20048b390984....0.tmp
- <Package Folder>/cache/####/5c68d87ec213a92d86ae7d6ab1f5de88b65....0.tmp
- <Package Folder>/cache/####/628df7d090a636414b5d4fbbfc38045bcd3....0.tmp
- <Package Folder>/cache/####/83b602ccfbfe382ec973ad14d7e5bfbc2f3....0.tmp
- <Package Folder>/cache/####/86c6d296cc1fbfd43983ca8d997e436f936....0.tmp
- <Package Folder>/cache/####/88d2915cc93d1899193b2d759866423bac9....0.tmp
- <Package Folder>/cache/####/8dd4b9e868e178bca8b7502b832f98197f9....0.tmp
- <Package Folder>/cache/####/9ccacc22c96ac96fc8a9b88def687cd9a94....0.tmp
- <Package Folder>/cache/####/a2bde4fc8442ec128412682a3b0543b054b....0.tmp
- <Package Folder>/cache/####/a62aebbaee002846e79e68525d1e90aad86....0.tmp
- <Package Folder>/cache/####/a66b6e9c504707371889338e07aab4400b6....0.tmp
- <Package Folder>/cache/####/b0797d1af7a14e56bb1a949e711c03f92ed....0.tmp
- <Package Folder>/cache/####/b6919503b4a264d23ffc69972695b526652....0.tmp
- <Package Folder>/cache/####/c27253f40a01d70c8c03271a8f3706118f2....0.tmp
- <Package Folder>/cache/####/c49fe13fb6ad90e0886b235372795990f1f....0.tmp
- <Package Folder>/cache/####/c4c8384d1f6201b2e76491fb4aebece9bb9....0.tmp
- <Package Folder>/cache/####/cf8e50f67283937bb30681a22aeb3493b48....0.tmp
- <Package Folder>/cache/####/d14c40af613ad36d55c02874a0e25470b63....0.tmp
- <Package Folder>/cache/####/da95e53ed511914ecf8bfb1aea654659088....0.tmp
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/df34f7a3c0b12f2b48a28523dc0bca56b8c....0.tmp
- <Package Folder>/cache/####/edbc0399a2bd680a8d5eec32dd73104b71e....0.tmp
- <Package Folder>/cache/####/f1bf759eab9bbabfe52e40f8bd9ed4e6ca4....0.tmp
- <Package Folder>/cache/####/f52d947aff3755084acf79c43ad8ed1327f....0.tmp
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/fba44fa66625dc0c4f5f29eb446187e7ee0....0.tmp
- <Package Folder>/cache/####/index
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/GDTSDK.db
- <Package Folder>/databases/GDTSDK.db-journal
- <Package Folder>/databases/cc.db
- <Package Folder>/databases/cc.db-journal
- <Package Folder>/databases/jpush_local_notification.db
- <Package Folder>/databases/jpush_local_notification.db-journal
- <Package Folder>/databases/jpush_local_notification.db-wal
- <Package Folder>/databases/jpush_statistics.db
- <Package Folder>/databases/jpush_statistics.db-journal
- <Package Folder>/databases/jpush_statistics.db-shm (deleted)
- <Package Folder>/databases/jpush_statistics.db-wal
- <Package Folder>/databases/ua.db
- <Package Folder>/databases/ua.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/appPackageNames
- <Package Folder>/files/exid.dat
- <Package Folder>/files/jpush_stat_cache.json
- <Package Folder>/files/jpush_stat_cache_history.json
- <Package Folder>/files/patch.jar
- <Package Folder>/files/patch.jar (deleted)
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/BuglySdkInfos.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/JPushSA_Config.xml
- <Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.rid.xml
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml (deleted)
- <Package Folder>/shared_prefs/jpush_device_info.xml
- <Package Folder>/shared_prefs/share_data.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/data/.push_deviceid
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- jcore117
- libjiagu
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
