Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.3394
- Android.DownLoader.635.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) a.appj####.com:80
- TCP(TLS/1.0) api.growi####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) t####.growi####.com:443
Запросы DNS:
- a####.u####.com
- a.appj####.com
- api.growi####.com
- t####.growi####.com
- www.go####.com
Запросы HTTP POST:
- a####.u####.com/app_logs
- a.appj####.com/ad-service/ad/mark
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/databases/growing.db
- <Package Folder>/databases/growing.db-journal
- <Package Folder>/databases/pg_effect.db
- <Package Folder>/databases/pg_effect.db-journal
- <Package Folder>/databases/pg_lenses.db
- <Package Folder>/databases/pg_lenses.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaskMaterial_10@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaskMaterial_14@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaskMaterial_15@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaskMaterial_18@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaskMaterial_20@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_10@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_11@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_12@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_13@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_14@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_15@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_16@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_17@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_18@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_19@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_1@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_20@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_21@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_22@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_23@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_24@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_2@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_3@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_4@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_5@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_6@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_7@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_8@2x.jpg
- <Package Folder>/files/####/SC_ImageEdit_MissEyeMaterial_9@2x.jpg
- <Package Folder>/files/####/decomp-1053796257.tmp
- <Package Folder>/files/####/decomp-1260725684.tmp
- <Package Folder>/files/####/decomp-1374713406.tmp
- <Package Folder>/files/####/decomp-1460210192.tmp
- <Package Folder>/files/####/decomp-1517656057.tmp
- <Package Folder>/files/####/decomp-1798627291.tmp
- <Package Folder>/files/####/decomp-1804711934.tmp
- <Package Folder>/files/####/decomp-1828115687.tmp
- <Package Folder>/files/####/decomp-1878293082.tmp
- <Package Folder>/files/####/decomp-1945467154.tmp
- <Package Folder>/files/####/decomp-1962243917.tmp
- <Package Folder>/files/####/decomp-203433186.tmp
- <Package Folder>/files/####/decomp-2099467197.tmp
- <Package Folder>/files/####/decomp-2121413346.tmp
- <Package Folder>/files/####/decomp-2131406557.tmp
- <Package Folder>/files/####/decomp-21979005.tmp
- <Package Folder>/files/####/decomp-227858067.tmp
- <Package Folder>/files/####/decomp-235965895.tmp
- <Package Folder>/files/####/decomp-294557854.tmp
- <Package Folder>/files/####/decomp-752664120.tmp
- <Package Folder>/files/####/decomp-75382562.tmp
- <Package Folder>/files/####/decomp-759455860.tmp
- <Package Folder>/files/####/decomp-814349951.tmp
- <Package Folder>/files/####/decomp1114797375.tmp
- <Package Folder>/files/####/decomp1238610847.tmp
- <Package Folder>/files/####/decomp1307124221.tmp
- <Package Folder>/files/####/decomp1328653757.tmp
- <Package Folder>/files/####/decomp1356269373.tmp
- <Package Folder>/files/####/decomp1407893941.tmp
- <Package Folder>/files/####/decomp1493446003.tmp
- <Package Folder>/files/####/decomp1496743747.tmp
- <Package Folder>/files/####/decomp163424289.tmp
- <Package Folder>/files/####/decomp1863275424.tmp
- <Package Folder>/files/####/decomp1864157984.tmp
- <Package Folder>/files/####/decomp1910789744.tmp
- <Package Folder>/files/####/decomp2013856076.tmp
- <Package Folder>/files/####/decomp2073905313.tmp
- <Package Folder>/files/####/decomp2090024241.tmp
- <Package Folder>/files/####/decomp2124804631.tmp
- <Package Folder>/files/####/decomp329176612.tmp
- <Package Folder>/files/####/decomp385672304.tmp
- <Package Folder>/files/####/decomp401054323.tmp
- <Package Folder>/files/####/decomp416044163.tmp
- <Package Folder>/files/####/decomp484725411.tmp
- <Package Folder>/files/####/decomp493883711.tmp
- <Package Folder>/files/####/decomp527638768.tmp
- <Package Folder>/files/####/decomp581820344.tmp
- <Package Folder>/files/####/decomp645996593.tmp
- <Package Folder>/files/####/decomp691450829.tmp
- <Package Folder>/files/####/decomp695467407.tmp
- <Package Folder>/files/####/decomp707897380.tmp
- <Package Folder>/files/####/decomp715203976.tmp
- <Package Folder>/files/####/decomp763470069.tmp
- <Package Folder>/files/####/decomp783955160.tmp
- <Package Folder>/files/####/decomp804367976.tmp
- <Package Folder>/files/####/decomp883706049.tmp
- <Package Folder>/files/####/decomp914629150.tmp
- <Package Folder>/files/####/decomp930067666.tmp
- <Package Folder>/files/####/decomp944684826.tmp
- <Package Folder>/files/####/decomp955093622.tmp
- <Package Folder>/files/####/lenses.json
- <Package Folder>/files/####/lenses.zip
- <Package Folder>/files/####/sdkEffect.zip
- <Package Folder>/files/####/textures.zip
- <Package Folder>/files/.imprint
- <Package Folder>/files/mobclick_agent_cached_<Package>110
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/app_preference.xml
- <Package Folder>/shared_prefs/camera_preferences.xml
- <Package Folder>/shared_prefs/device_id.xml.xml
- <Package Folder>/shared_prefs/growing_profile.xml
- <Package Folder>/shared_prefs/growingio_diagnose.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/.growingio/<Package>.install
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/selfie-1510835235391.txt
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- logcat -v time
Загружает динамические библиотеки:
- libjiagu
Использует специальную библиотеку для скрытия исполняемого байткода.
Изменяет настройки громкости и вибрации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
