Android.RemoteCode.197

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.RemoteCode.81.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) md.ope####.360.cn:80
TCP(HTTP/1.1) p.s.3####.cn:80
TCP(HTTP/1.1) s####.s.360.cn:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) and####.api.36####.com:80
TCP(HTTP/1.1) gs.d####.360.cn:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) p7.q####.com:80
TCP(HTTP/1.1) api.5####.tv:80
TCP(HTTP/1.1) api.gam####.360.cn:80
TCP(TLS/1.0) m####.360.cn:443
TCP 1####.199.97.232:443

Запросы DNS:

a####.u####.com
a.appj####.com
and####.api.36####.com
api.5####.tv
api.gam####.360.cn
gs.d####.360.cn
m####.360.cn
md.ope####.360.cn
p.s.3####.cn
p7.q####.com
ps.d####.360.cn
rela####.gam####.360.cn
s####.s.360.cn

Запросы HTTP GET:

and####.api.36####.com/group/?method=####&n=UDVDZ####
api.5####.tv/live/cat/getCats?__plat=####&__version=####&client=####&esc...
api.5####.tv/live/index/getconfig?__plat=####&__version=####&client=####...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=0f####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=1F####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=1j####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=E0####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=FO####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=Gp####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=JJ####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=Jl####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=Jx####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=Ku####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=Ld####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=MV####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=MZ####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=PS####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=Qa####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=R/####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=Tp####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=XL####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=cp####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=eJ####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=ew####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=f9####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=fg####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=fn####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=i1####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=lo####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=mL####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=pi####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=sN####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=sy####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=tb####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=tj####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=vd####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=xV####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=xu####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=zc####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=zm####&s...
api.gam####.360.cn/10/popup/activity?appid=####&nonce=####&rkey=zr####&s...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=00####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=1p####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=FP####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=Hk####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=JR####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=JS####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=LN####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=Lh####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=M/####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=NG####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=Ng####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=QU####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=SR####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=cA####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=dA####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=i9####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=r0####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=se####&signid...
api.gam####.360.cn/10/popup/bbs?appid=####&nonce=####&rkey=tG####&signid...
api.gam####.360.cn/10/popup/floatconf?appid=####&nonce=####&m2=####&os=#...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=A/###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=CQ###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=F8###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=GK###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=Gz###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=JW###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=MP###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=Rb###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=XX###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=YM###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=a4###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=b6###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=lf###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=ng###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=p9###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=qu###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=tp###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=u4###...
api.gam####.360.cn/10/popup/gamesetting?appid=####&nonce=####&rkey=u5###...
api.gam####.360.cn/10/system/updatecertificate?appid=####&nonce=####&rke...
api.gam####.360.cn/9/popup/version?rkey=1B####&signid=####
api.gam####.360.cn/9/popup/version?rkey=DV####&signid=####
api.gam####.360.cn/9/popup/version?rkey=FB####&signid=####
api.gam####.360.cn/9/popup/version?rkey=Gt####&signid=####
api.gam####.360.cn/9/popup/version?rkey=HW####&signid=####
api.gam####.360.cn/9/popup/version?rkey=UU####&signid=####
api.gam####.360.cn/9/popup/version?rkey=Yo####&signid=####
api.gam####.360.cn/9/popup/version?rkey=dL####&signid=####
api.gam####.360.cn/9/popup/version?rkey=eb####&signid=####
api.gam####.360.cn/9/popup/version?rkey=g4####&signid=####
api.gam####.360.cn/9/popup/version?rkey=id####&signid=####
api.gam####.360.cn/9/popup/version?rkey=lH####&signid=####
api.gam####.360.cn/9/popup/version?rkey=mt####&signid=####
api.gam####.360.cn/9/popup/version?rkey=nL####&signid=####
api.gam####.360.cn/9/popup/version?rkey=o9####&signid=####
api.gam####.360.cn/9/popup/version?rkey=po####&signid=####
api.gam####.360.cn/9/popup/version?rkey=rH####&signid=####
api.gam####.360.cn/9/popup/version?rkey=rh####&signid=####
api.gam####.360.cn/9/popup/version?rkey=xF####&signid=####
api.gam####.360.cn/system/login?from=####&pagetype=####&mid=####&appid=#...
md.ope####.360.cn/?product=####&version=####
p7.q####.com/t0178c548e210e9c425.png
s####.s.360.cn/ak/02522a2b2726fb0a03bb19f2d8d9524d.html?m2=####

Запросы HTTP POST:

a####.u####.com/app_logs
a.appj####.com/ad-service/ad/mark
gs.d####.360.cn/sendstat
p.s.3####.cn/pstat/plog.php
p.s.3####.cn/update/update.php?p=####

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/Y29tLmxpeHhpeC5PeA==.data.lock
<Package Folder>/files/####/Y29tLmxpeHhpeC5PeA==.report.lock
<Package Folder>/files/####/Y29tLmxpeHhpeC5PeA==.tick.lock
<Package Folder>/files/####/sdk_wukong.zip
<Package Folder>/files/.imprint
<Package Folder>/files/frameso
<Package Folder>/files/mobclick_agent_cached_<Package>13
<Package Folder>/files/qhpush_game_stat_log.json
<Package Folder>/files/qihoo_game_stat_ex.log
<Package Folder>/files/qihoo_game_stat_log.json
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/Pay_config.xml
<Package Folder>/shared_prefs/QH_SDK_M2.xml
<Package Folder>/shared_prefs/QH_SDK_ReportPolicy.xml
<Package Folder>/shared_prefs/QH_SDK_TIMES.xml
<Package Folder>/shared_prefs/QH_SDK_UserData.xml
<Package Folder>/shared_prefs/coolcloud_config.xml
<Package Folder>/shared_prefs/iapppay_config.xml
<Package Folder>/shared_prefs/jg_app_update_settings_random.xml
<Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
<Package Folder>/shared_prefs/qh_login_cfg.xml
<Package Folder>/shared_prefs/qhopen_game_session_info.xml
<Package Folder>/shared_prefs/qhpush_session_info.xml
<Package Folder>/shared_prefs/qihoo_game_online_conf.xml
<Package Folder>/shared_prefs/qihoo_game_session_info.xml
<Package Folder>/shared_prefs/qihoo_hosts_cfg.xml
<Package Folder>/shared_prefs/qihoo_https_cer_pre.xml
<Package Folder>/shared_prefs/qihoo_jiagu_crash_report.xml
<Package Folder>/shared_prefs/qlocal_float_sdk_share_preference.xml
<Package Folder>/shared_prefs/sdk_apk_info.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak (deleted)
<SD-Card>/360/####/Y29tLmxpeHhpeC5PeA==
<SD-Card>/360/####/Y29tLmxpeHhpeC5PeA== (deleted)
<SD-Card>/360/####/Y29tLmxpeHhpeC5PeA==.tmp
<SD-Card>/360/####/dcsdid.dat
<SD-Card>/Android/####/.nomedia
<SD-Card>/Android/####/2srnjblqxn03998ej90uotas2.0.tmp
<SD-Card>/Android/####/journal
<SD-Card>/Android/####/journal.tmp
<SD-Card>/data/####/<Package>
<SD-Card>/data/####/E18497520007BDF592__<Package>
<SD-Card>/data/####/randId

Другие:

Запускает следующие shell-скрипты:

chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 /storage/emulated/0/360gamecentersdk/.cache/image

Загружает динамические библиотеки:

cocos2dcpp
frameso
libjiagu

Использует следующие алгоритмы для шифрования данных:

DES-CBC-PKCS5Padding
RSA-ECB-PKCS1PADDING
RSA-None-PKCS1Padding

Использует следующие алгоритмы для расшифровки данных:

DES-CBC-PKCS5Padding

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней