Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Kyview.2.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.190.123.237:80
- TCP(HTTP/1.1) rcv.icli####.com:81
- TCP(HTTP/1.1) v.j####.cn:80
- TCP(HTTP/1.1) c####.h####.com:80
- TCP(HTTP/1.1) 1####.28.114.73:80
- TCP(HTTP/1.1) v.pic.fas####.####.com:80
- TCP(HTTP/1.1) cdn.aicli####.com:80
- TCP(HTTP/1.1) sdk.s####.cn:80
- TCP(HTTP/1.1) rtb.fas####.net:80
- TCP(HTTP/1.1) log.yex.yo####.com:80
- TCP(HTTP/1.1) t####.youd####.cn:80
- TCP(HTTP/1.1) rcv.icli####.com:80
- TCP(HTTP/1.1) y####.51on####.com:80
- TCP(TLS/1.0) d####.dengy####.com:443
Запросы DNS:
- api.aicli####.com
- c####.h####.com
- cdn.aicli####.com
- cfg.aicli####.com
- d####.dengy####.com
- l.fas####.net
- log.yex.yo####.com
- r.fas####.net
- rcv.icli####.com
- s.s####.cn
- sdk.s####.cn
- t####.youd####.cn
- v.j####.cn
- v.pic.fas####.net
- y####.51on####.com
Запросы HTTP GET:
- c####.h####.com/upload/scripts/tpl.js
- cdn.aicli####.com/uploads/b046eb7c39851921eaec3866a4d8f63e_1001888_225_1...
- cdn.aicli####.com/uploads/b525aba81f7e82eddc89fd5af520b49b_1001888_225_1...
- log.yex.yo####.com/ct?slot=####&yexi=####&yexcb=####
- log.yex.yo####.com/it?yexi=####&yexv=####&yexcb=####
- rcv.icli####.com/req?aid=####&callback=####&
- rcv.icli####.com/show?CAAQCA.####
- rcv.icli####.com/show?CAAQIw.####
- rcv.icli####.com/show?CAAQPg.####
- rcv.icli####.com/trace?t=####&duration=####&iclicashsid=####&w=####&h=##...
- rcv.icli####.com/trace?t=####&iclicashsid=####&w=####&h=####&sw=####&sh=...
- rcv.icli####.com/trace?t=####&s=####&iclicashsid=####&w=####&h=####&sw=#...
- rcv.icli####.com:81/click?CAAQNg.####
- rtb.fas####.net/imp?e=####&ext2=####&pid=####&sid=####
- rtb.fas####.net/j?e=wyu6M4eYiWZgzqrG3OdDMF_-9-fEzbMBbjJSZWudrM4HD5jODecj...
- rtb.fas####.net/l?action=####&p1=####&p2=####&slotid=####&pvid=####&adid...
- v.j####.cn/toutiao/index?key=####&type=####
- v.pic.fas####.####.com/magic/57/57a7315b46e93770fce171368e4077ec.jpg?p=#...
- y####.51on####.com/?iclicashsid=####
- y####.51on####.com/css/main.css
- y####.51on####.com/images/camera.png
- y####.51on####.com/images/canon.png
- y####.51on####.com/images/charger.png
- y####.51on####.com/images/icon-alipay.png
- y####.51on####.com/images/icon-wx.png
- y####.51on####.com/images/icon.png
- y####.51on####.com/images/iphone.png
- y####.51on####.com/images/oppo.png
- y####.51on####.com/images/qrcode.jpg
- y####.51on####.com/images/vivo.png
- y####.51on####.com/images/vr.png
- y####.51on####.com/images/watch.png
- y####.51on####.com/js/ad.js?aid=####
- y####.51on####.com/js/app.js
- y####.51on####.com/js/doT.js
- y####.51on####.com/js/index.js
- y####.51on####.com/js/jquery-1.8.3.min.js
- y####.51on####.com/js/lib.js
- y####.51on####.com/js/trace.js
Запросы HTTP POST:
- rcv.icli####.com/v2/json
- sdk.s####.cn/v10/android/banner
- sdk.s####.cn/v10/android/config?publisherID=####
- sdk.s####.cn/v10/android/hsbanner
- t####.youd####.cn/sdk.gif
Запросы HTTP OPTIONS:
- rcv.icli####.com/v2/json
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_database/####/http_yuan.51oneone.com_0.loc...ournal
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/WebViewSettings.xml
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- libjiagu
Использует следующие алгоритмы для шифрования данных:
- DES
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
