Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.20
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) api.f####.w####.####.cn:80
- TCP(HTTP/1.1) c####.w####.360.cn:80
- TCP(HTTP/1.1) sh####.360t####.com:80
- TCP(HTTP/1.1) s.ssl.q####.com:80
- TCP(HTTP/1.1) p3.q####.com:80
- TCP(HTTP/1.1) s.3####.cn:80
- TCP(HTTP/1.1) d####.360####.com:80
- TCP(HTTP/1.1) f.xingch####.com.####.com:80
- TCP(HTTP/1.1) yes.yuchan####.com.cn:80
- TCP(HTTP/1.1) p7.q####.com:80
- TCP(HTTP/1.1) p1.q####.com:80
- TCP(HTTP/1.1) and####.api.36####.com:80
- TCP(HTTP/1.1) p0.q####.com:80
- TCP(HTTP/1.1) md.ope####.360.cn:80
- TCP(HTTP/1.1) gd.a.s####.com:80
- TCP(HTTP/1.1) apilo####.a####.com:80
- TCP(HTTP/1.1) e.tf.3####.cn:80
- TCP(HTTP/1.1) p17.q####.com.####.com:80
- TCP(HTTP/1.1) p4.q####.com:80
- TCP(HTTP/1.1) s0.q####.com:80
- TCP(TLS/1.0) s.ssl.q####.com:443
- TCP 1####.39.205.52:443
Запросы DNS:
- and####.api.36####.com
- api####.a####.com
- api.f####.w####.####.cn
- c####.w####.360.cn
- d####.360####.com
- e.tf.3####.cn
- f.xingch####.com
- free####.360.cn
- fzb.leidi####.com
- i.qs####.org
- md.ope####.360.cn
- p0.q####.com
- p0.qhi####.com
- p1.q####.com
- p1.qhi####.com
- p17.q####.com
- p2.qhi####.com
- p3.q####.com
- p4.q####.com
- p7.q####.com
- pv.s####.com
- r.eli####.cn
- s.3####.cn
- s.ssl.q####.com
- s0.q####.com
- sh####.360t####.com
- sta####.leidi####.com
- web.f####.w####.####.cn
- yes.yuchan####.com.cn
Запросы HTTP GET:
- and####.api.36####.com/group/?method=####&n=d01HT####
- api.f####.w####.####.cn/conf/browser.html
- api.f####.w####.####.cn/newsfeed/youLikeDown?referer=####&m2=####&action...
- api.f####.w####.####.cn/resource/js/newsfeed/dataManager.js
- api.f####.w####.####.cn/resource/js/newsfeed/downApp.js
- api.f####.w####.####.cn/resource/js/newsfeed/loadList.js
- api.f####.w####.####.cn/resource/js/newsfeed/logForDJ.js
- api.f####.w####.####.cn/topbanner.php?_=####&callback=####
- api.f####.w####.####.cn/vest/index?t=####
- c####.w####.360.cn/intf.php?check_update_key=####&qid=####&devtype=####&...
- d####.360####.com/360mse/360mse_nb00091.apk
- e.tf.3####.cn/b/click?m2=####&st=####&pid=####&cid=####&cookieid=####&ct...
- f.xingch####.com.####.com/2011/gou.jar
- gd.a.s####.com/cityjson?ie=####
- p0.q####.com/t01207ab6afdc5a8fd4.png
- p0.q####.com/t01510ee2b01ec14bd8.png
- p0.q####.com/t01b04ae369638be428.png
- p1.q####.com/t011167741cc899ca95.jpg
- p17.q####.com.####.com/dr/160_160_/t0127d6d26cbd6fc34a.png
- p3.q####.com/t0134e6ded5523259bf.png
- p4.q####.com/t01c0c5cec0f2a8280a.png
- p7.q####.com/dmfd/182_136_/t0185e3cfe43d614329.jpg
- s.3####.cn/w360/c.htm?p=####&u=####&id=####&guid=####&f=####&c=####&cId=...
- s.3####.cn/w360/s.htm?p=####&u=####&id=####&guid=####&b=####&c=####&r=##...
- s.ssl.q####.com/dmfd/182_136_/t010912d4719fc51331.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t010c81cdacc431efab.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t0115c6cb866bee3df6.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t012058530a9a58af4a.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t0120df7f7a07ea88f9.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t0129c594c658dd2549.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t0157db62c1b4beb773.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t016127dd02e9eadaca.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t01626198b8cac38788.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t01770e6c3c200c29b8.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t017e4bad73c8d6b3c0.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t018ae6074230c73f6e_1.gif?size=####
- s.ssl.q####.com/dmfd/182_136_/t01b41ba58162aa7e20.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t01b47d18a8b7b59ba0.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t01b9ce101f6d003db1.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t01ca9a4acf49776175.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t01d67e680e3b54d4ab.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t01dbabe2919edfdf3a.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t01e2944c9a9035908d.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t01f03eba34b2e8645f.jpg?size=####
- s.ssl.q####.com/dmfd/182_136_/t01f11cceb735ae33ba.jpg?size=####
- s0.q####.com/monitor/;monitor/0ddb3eeb.js
- sh####.360t####.com/180117/1e45e62fee2f1a285bbfd11d131185ae/com.lightsky...
- yes.yuchan####.com.cn/k2?protocol=####&version=####&cid=####
Запросы HTTP POST:
- api.f####.w####.####.cn/income/dd?m2=####
- api.f####.w####.####.cn/intf.php?qid=####&devtype=####&nettype=####&manu...
- api.f####.w####.####.cn/intf.php?random=####&qid=####&devtype=####&netty...
- api.f####.w####.####.cn/newsfeed/clickDd
- apilo####.a####.com/v3/log/init
- c####.w####.360.cn/intf.php?check_update_key=####&qid=####&devtype=####&...
- c####.w####.360.cn/intf.php?md5=####&qid=####&devtype=####&nettype=####&...
- c####.w####.360.cn/intf.php?qid=####&devtype=####&nettype=####&manufactu...
- e.tf.3####.cn/b/pv
- md.ope####.360.cn/list/get?product=####&version=####
- yes.yuchan####.com.cn/k1?requestId=####&g=####&ua=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/app_cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/####/-1633430244-738756840
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/index
- <Package Folder>/databases/360freewifi.db-journal
- <Package Folder>/databases/business_info.db-journal
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/notice.db-journal
- <Package Folder>/databases/sharedpref.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/keep_alive1
- <Package Folder>/files/deamon_wifi_1_0
- <Package Folder>/files/qihoo360_accounts_inuse.ini
- <Package Folder>/shared_prefs/360freewifi_push.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/GlobalFlag.xml
- <Package Folder>/shared_prefs/QH_SDK_M2.xml
- <Package Folder>/shared_prefs/QH_SDK_UserData.xml
- <Package Folder>/shared_prefs/QH_SDK_sessionID.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/a.xml
- <Package Folder>/shared_prefs/apk_info.xml
- <Package Folder>/shared_prefs/hongbao_pref.xml
- <Package Folder>/shared_prefs/last_know_location.xml
- <Package Folder>/shared_prefs/sd_info.xml
- <Package Folder>/shared_prefs/st.xml
- <SD-Card>/360WiFi/####/1510835282552
- <SD-Card>/360freewifi/####/360mse_nb00091.apk.apk (deleted)
- <SD-Card>/360freewifi/####/360mse_nb00091.apk.apk.tmp
- <SD-Card>/360freewifi/####/log.nb
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Download/####/4.8_gou.jar.tmp
- <SD-Card>/com.wifi.wn/####/com.lightsky.video.apk
- <SD-Card>/dt/restime.dat
- <SD-Card>/goldfallen.mp3
- <SD-Card>/leidian/####/bW9iaS5qZWQ2Mi52NjEzNGMwYQ==
Другие:
Запускает следующие shell-скрипты:
- /system/bin/ps
- <Package Folder>/files/deamon_wifi_1_0 freewifi am startservice --user 0 -n com.qihoo.freewifi/.service.WifiService deamon_wifi_1_0
- am startservice --user 0 -n com.qihoo.freewifi/.service.WifiService
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n com.qihoo.freewifi/.service.WifiService
- chmod 493 <Package Folder>/files/so_libs
- chmod 700 <Package Folder>/files/deamon_wifi_1_0
- chmod 700 <Package Folder>/files/so_libs/keep_alive1
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- mount
- sh <Package Folder>/files/deamon_wifi_1_0 freewifi am startservice --user 0 -n com.qihoo.freewifi/.service.WifiService deamon_wifi_1_0
Загружает динамические библиотеки:
- giaeqh
- libjiagu
- libsecurity
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS5Padding
- DESede-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- DESede-ECB-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
