Android.Packed.35761

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.589.origin

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) 52.52.2####.56:80
TCP(HTTP/1.1) go.hotw####.top:80
TCP(HTTP/1.1) a####.you####.com:80
TCP(HTTP/1.1) w####.q####.dn.####.com:80
TCP(HTTP/1.1) d2.ireader####.com:80
TCP(HTTP/1.1) cdn.app.kac####.####.com:80
TCP(HTTP/1.1) d1.ireader####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) cdn.game####.org:80
TCP(TLS/1.0) www.ireader####.com:443

Запросы DNS:

a####.you####.com
cdn.app.h####.top
cdn.app.kac####.cn
cdn.game####.org
cdn.img.h####.top
d1.ireader####.com
d2.ireader####.com
fb.u####.com
go.hotw####.top
t####.qin####.com
www.ireader####.com

Запросы HTTP GET:

a####.you####.com/sx/GetConfigInfo.aspx?ver=####&passID=####&ver=####&cl...
cdn.app.kac####.####.com/sfile/201711/16/all/cp_V2.8.1.txt
cdn.app.kac####.####.com/upload/201801/30/app/20180130180118286.apk
cdn.app.kac####.####.com/upload/201801/30/img/20180130180110682.png
cdn.game####.org/strategy/UnknownDev
cdn.game####.org/strategy/base
cdn.game####.org/strategy/dev_root
cdn.game####.org/strategy/dev_root2
cdn.game####.org/strategy/larger4.3
cdn.game####.org/strategy/loss_4.3
cdn.game####.org/strategy/sul18
cdn.game####.org/strategy/symlink-adbd
d1.ireader####.com/GoodBooks/Books/cover/2015-12-03/3bf728d6-6e75-45bd-8...
d1.ireader####.com/GoodBooks/Books/cover/2016-05-25/492e359f-3f56-4036-a...
d1.ireader####.com/GoodBooks/Books/cover/2016-08-24/b7673e77-13dd-4f68-b...
d1.ireader####.com/GoodBooks/Books/cover/2016-09-29/140a9ec9-e0ce-45f2-9...
d1.ireader####.com/GoodBooks/Books/cover/2016-11-04/22e3429b-77b2-4b34-b...
d1.ireader####.com/GoodBooks/Books/cover/2016-11-05/72ec7342-7440-4c7b-b...
d1.ireader####.com/GoodBooks/Books/cover/2016-12-23/044d2965-6394-46f1-9...
d1.ireader####.com/GoodBooks/Books/cover/2017-02-09/61f02d67-9c49-4aeb-b...
d1.ireader####.com/GoodBooks/Books/cover/2017-03-02/fdf5f231-6d9f-4abf-9...
d1.ireader####.com/GoodBooks/Books/cover/2017-04-06/4843d946-44f8-4f12-a...
d1.ireader####.com/GoodBooks/Books/cover/2017-05-31/edb5c764-b0c7-4025-9...
d1.ireader####.com/GoodBooks/Books/cover/2017-06-01/4bb5ae32-7a38-46ef-8...
d1.ireader####.com/GoodBooks/Books/cover/2017-06-02/d3328395-600b-40b3-8...
d1.ireader####.com/GoodBooks/Books/cover/2017-06-07/0a3ac3e3-7449-4487-9...
d1.ireader####.com/GoodBooks/Books/cover/2017-06-20/8847a238-2680-4719-8...
d1.ireader####.com/GoodBooks/Books/cover/2017-09-11/74419d21-5e8e-463d-9...
d1.ireader####.com/GoodBooks/Books/cover/2017-09-25/1776267c-1bcf-4481-b...
d1.ireader####.com/GoodBooks/Books/cover/2017-10-12/bec8e00b-01e9-47fc-a...
d1.ireader####.com/GoodBooks/Books/cover/2017-11-02/b70d3069-777d-48fc-9...
d1.ireader####.com/GoodBooks/Books/cover/2017-11-07/177859c0-96eb-4c0b-b...
d1.ireader####.com/GoodBooks/Books/cover/2017-12-08/6379d5c6-ab88-462f-a...
d1.ireader####.com/GoodBooks/Books/cover/2017-12-18/60127fea-5930-4942-b...
d1.ireader####.com/GoodBooks/Books/cover/2017-12-20/3981dcbb-c686-4b20-b...
d1.ireader####.com/GoodBooks/Books/cover/2018-01-28/00b8d6c5-df7e-42d5-b...
d2.ireader####.com/GoodBooks/Books/cover/2015-03-24/d865e06a-7f83-41ac-b...
d2.ireader####.com/GoodBooks/Books/cover/2016-01-11/9aa37721-828f-4bc4-b...
d2.ireader####.com/GoodBooks/Books/cover/2016-06-15/9f3415fd-3b42-44ff-b...
d2.ireader####.com/GoodBooks/Books/cover/2016-07-01/9e79be7d-68a9-4685-b...
d2.ireader####.com/GoodBooks/Books/cover/2016-07-25/e0d6d171-f6c7-4daa-8...
d2.ireader####.com/GoodBooks/Books/cover/2016-09-12/57999efa-d29d-474b-b...
d2.ireader####.com/GoodBooks/Books/cover/2016-11-14/24fc0383-d880-423d-b...
d2.ireader####.com/GoodBooks/Books/cover/2017-02-28/17b8ac9a-ea8a-42a4-9...
d2.ireader####.com/GoodBooks/Books/cover/2017-03-17/cf9a9430-33cb-4fb5-8...
d2.ireader####.com/GoodBooks/Books/cover/2017-06-03/cc9a2e4a-e675-482a-b...
d2.ireader####.com/GoodBooks/Books/cover/2017-07-17/894bb53b-27d6-4d79-8...
d2.ireader####.com/GoodBooks/Books/cover/2017-09-25/be3f8a86-d3af-481d-8...
d2.ireader####.com/GoodBooks/Books/cover/2017-11-01/03e675c2-99ab-4eec-9...
d2.ireader####.com/GoodBooks/Books/cover/2017-11-07/188bc8a1-9776-4829-8...
d2.ireader####.com/GoodBooks/Books/cover/2017-11-07/78881493-737f-40b0-8...
d2.ireader####.com/GoodBooks/Books/cover/2017-11-22/bca2c2b1-848c-4684-9...
d2.ireader####.com/GoodBooks/Books/cover/2017-11-25/409c2b50-6859-463d-9...
w####.q####.dn.####.com/sxsplash20160727_579817d469bca.jpg
w####.q####.dn.####.com/sxsplash20160727_579817da499fb.jpg
w####.q####.dn.####.com/sxsplash20160727_579817de0f457.jpg
w####.q####.dn.####.com/sxsplash20160727_579817e1da72a.jpg
w####.q####.dn.####.com/sxsplash20160727_57981808344f4.jpg

Запросы HTTP POST:

go.hotw####.top/hadat/ga/qpa
go.hotw####.top/hadat/rintb/fkps
go.hotw####.top/hadat/sbbqa/vrdu
go.hotw####.top/jzbdt/asxr/cgbo/ilh
go.hotw####.top/jzbdt/f/r
go.hotw####.top/jzbdt/lffi/sjcu/eqhn
go.hotw####.top/jzbdt/ugc/lgiw
go.hotw####.top/sdf/gotp

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_422e0d8c-5035-4cb8-b766-d8949c885ba8/Matrix
<Package Folder>/app_422e0d8c-5035-4cb8-b766-d8949c885ba8/ddexe
<Package Folder>/app_422e0d8c-5035-4cb8-b766-d8949c885ba8/debuggerd
<Package Folder>/app_422e0d8c-5035-4cb8-b766-d8949c885ba8/fileWork
<Package Folder>/app_422e0d8c-5035-4cb8-b766-d8949c885ba8/insta...ery.sh
<Package Folder>/app_422e0d8c-5035-4cb8-b766-d8949c885ba8/pidof
<Package Folder>/app_422e0d8c-5035-4cb8-b766-d8949c885ba8/su
<Package Folder>/app_422e0d8c-5035-4cb8-b766-d8949c885ba8/supolicy
<Package Folder>/app_422e0d8c-5035-4cb8-b766-d8949c885ba8/toolbox
<Package Folder>/app_422e0d8c-5035-4cb8-b766-d8949c885ba8/wsroot.sh
<Package Folder>/app_4cc2bf3a-33d7-4bb0-954d-da1ee222ab90/Matrix
<Package Folder>/app_4cc2bf3a-33d7-4bb0-954d-da1ee222ab90/ddexe
<Package Folder>/app_4cc2bf3a-33d7-4bb0-954d-da1ee222ab90/debuggerd
<Package Folder>/app_4cc2bf3a-33d7-4bb0-954d-da1ee222ab90/fileWork
<Package Folder>/app_4cc2bf3a-33d7-4bb0-954d-da1ee222ab90/insta...ery.sh
<Package Folder>/app_4cc2bf3a-33d7-4bb0-954d-da1ee222ab90/pidof
<Package Folder>/app_4cc2bf3a-33d7-4bb0-954d-da1ee222ab90/su
<Package Folder>/app_4cc2bf3a-33d7-4bb0-954d-da1ee222ab90/supolicy
<Package Folder>/app_4cc2bf3a-33d7-4bb0-954d-da1ee222ab90/toolbox
<Package Folder>/app_4cc2bf3a-33d7-4bb0-954d-da1ee222ab90/wsroot.sh
<Package Folder>/app_510de58d-c318-4fc4-81a1-9aba7e432380/Matrix
<Package Folder>/app_510de58d-c318-4fc4-81a1-9aba7e432380/ddexe
<Package Folder>/app_510de58d-c318-4fc4-81a1-9aba7e432380/debuggerd
<Package Folder>/app_510de58d-c318-4fc4-81a1-9aba7e432380/fileWork
<Package Folder>/app_510de58d-c318-4fc4-81a1-9aba7e432380/insta...ery.sh
<Package Folder>/app_510de58d-c318-4fc4-81a1-9aba7e432380/pidof
<Package Folder>/app_510de58d-c318-4fc4-81a1-9aba7e432380/su
<Package Folder>/app_510de58d-c318-4fc4-81a1-9aba7e432380/supolicy
<Package Folder>/app_510de58d-c318-4fc4-81a1-9aba7e432380/toolbox
<Package Folder>/app_510de58d-c318-4fc4-81a1-9aba7e432380/wsroot.sh
<Package Folder>/app_61a12374-fa21-43d6-84c6-781245d5826d/Matrix
<Package Folder>/app_61a12374-fa21-43d6-84c6-781245d5826d/ddexe
<Package Folder>/app_61a12374-fa21-43d6-84c6-781245d5826d/debuggerd
<Package Folder>/app_61a12374-fa21-43d6-84c6-781245d5826d/device.db
<Package Folder>/app_61a12374-fa21-43d6-84c6-781245d5826d/fileWork
<Package Folder>/app_61a12374-fa21-43d6-84c6-781245d5826d/insta...ery.sh
<Package Folder>/app_61a12374-fa21-43d6-84c6-781245d5826d/pidof
<Package Folder>/app_61a12374-fa21-43d6-84c6-781245d5826d/root3
<Package Folder>/app_61a12374-fa21-43d6-84c6-781245d5826d/su
<Package Folder>/app_61a12374-fa21-43d6-84c6-781245d5826d/supolicy
<Package Folder>/app_61a12374-fa21-43d6-84c6-781245d5826d/toolbox
<Package Folder>/app_61a12374-fa21-43d6-84c6-781245d5826d/wsroot.sh
<Package Folder>/app_8f163837-f495-4ba2-a635-215485d38e91/checker.jar
<Package Folder>/app_d6ece221-405a-4f09-8766-55fc52e6d26b/Matrix
<Package Folder>/app_d6ece221-405a-4f09-8766-55fc52e6d26b/ddexe
<Package Folder>/app_d6ece221-405a-4f09-8766-55fc52e6d26b/debuggerd
<Package Folder>/app_d6ece221-405a-4f09-8766-55fc52e6d26b/fileWork
<Package Folder>/app_d6ece221-405a-4f09-8766-55fc52e6d26b/insta...ery.sh
<Package Folder>/app_d6ece221-405a-4f09-8766-55fc52e6d26b/pidof
<Package Folder>/app_d6ece221-405a-4f09-8766-55fc52e6d26b/su
<Package Folder>/app_d6ece221-405a-4f09-8766-55fc52e6d26b/supolicy
<Package Folder>/app_d6ece221-405a-4f09-8766-55fc52e6d26b/toolbox
<Package Folder>/app_d6ece221-405a-4f09-8766-55fc52e6d26b/wsroot.sh
<Package Folder>/app_e89096f5-c5d4-4e23-bf72-8b32ae08ecf4/Matrix
<Package Folder>/app_e89096f5-c5d4-4e23-bf72-8b32ae08ecf4/ddexe
<Package Folder>/app_e89096f5-c5d4-4e23-bf72-8b32ae08ecf4/debuggerd
<Package Folder>/app_e89096f5-c5d4-4e23-bf72-8b32ae08ecf4/fileWork
<Package Folder>/app_e89096f5-c5d4-4e23-bf72-8b32ae08ecf4/insta...ery.sh
<Package Folder>/app_e89096f5-c5d4-4e23-bf72-8b32ae08ecf4/pidof
<Package Folder>/app_e89096f5-c5d4-4e23-bf72-8b32ae08ecf4/su
<Package Folder>/app_e89096f5-c5d4-4e23-bf72-8b32ae08ecf4/supolicy
<Package Folder>/app_e89096f5-c5d4-4e23-bf72-8b32ae08ecf4/toolbox
<Package Folder>/app_e89096f5-c5d4-4e23-bf72-8b32ae08ecf4/wsroot.sh
<Package Folder>/app_jgls/.log.lock
<Package Folder>/app_jgls/.log.ls
<Package Folder>/app_plugin_download/8a242073-34d4-4912-a961-b583395d5e76
<Package Folder>/app_plugin_download/d3c80711-c12f-4c4d-ab13-114b12a1437c
<Package Folder>/app_sslcache/www.ireadercity.com.443
<Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
<Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
<Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
<Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
<Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
<Package Folder>/app_subox/c61913b615fb6224701377a119081f36
<Package Folder>/app_subox_download/19108381-2ef4-4e2f-908e-e50c19d1a4a7
<Package Folder>/app_subox_download/23dc1eec-b69d-439c-ae2c-12f75895216c
<Package Folder>/app_subox_download/3252918f-e088-475c-8cd4-f8ae6300b1ba
<Package Folder>/app_subox_download/4fa96ce7-f3b3-4d63-a77e-44f4384f3a43
<Package Folder>/app_subox_download/551f4a8b-2ba6-4621-bd09-1590f411df1e
<Package Folder>/app_subox_download/72ff5f00-5b1b-49de-9d55-03b374ded696
<Package Folder>/app_subox_download/98685a84-9725-4ec8-827e-25ca3d0be4c8
<Package Folder>/app_subox_download/e09cd0ee-554f-40a3-b963-3de13a360dd7
<Package Folder>/databases/aireader_v2-journal
<Package Folder>/databases/ireader.db-journal
<Package Folder>/databases/t_u.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/SUBOXLOG_
<Package Folder>/files/hl.jar
<Package Folder>/files/ud.jar
<Package Folder>/shared_prefs/Alvin2.xml
<Package Folder>/shared_prefs/ContextData.xml
<Package Folder>/shared_prefs/com_ireader_city_you_qi.xml
<Package Folder>/shared_prefs/dsi.xml
<Package Folder>/shared_prefs/kr.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/sfe.xml
<Package Folder>/shared_prefs/subox.xml
<Package Folder>/shared_prefs/umeng_feedback_conversations.xml
<Package Folder>/shared_prefs/umeng_feedback_user_info.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_message_state.xml
<Package Folder>/shared_prefs/wv.xml
<SD-Card>/.DataStorage/ContextData.xml
<SD-Card>/.SystemConfig/.did
<SD-Card>/.UTSystemConfig/####/Alvin2.xml
<SD-Card>/.system/.did
<SD-Card>/AIReader/####/.did
<SD-Card>/AIReader/####/11e5dfd7a61c4393a09f57d36b3dc9ecjpgx.tmp
<SD-Card>/AIReader/####/1cf642ef8f8a41f28fc1003dd0c23eb8jpgx.tmp
<SD-Card>/AIReader/####/2011adb8184245ccb5c9eab4846e1a38jpgx.tmp
<SD-Card>/AIReader/####/23610664c5194884b1a247d430effef8jpgx.tmp
<SD-Card>/AIReader/####/23f1058032834eb29069f1d7aabbff1bjpgx.tmp
<SD-Card>/AIReader/####/29f794b143924ab29693deae51ad40eajpgx.tmp
<SD-Card>/AIReader/####/2b2bc73ad2ce41e89a51d158f3d734f9jpgx.tmp
<SD-Card>/AIReader/####/3053fb4b3c9f47a08b747c5dc98909d7jpgx.tmp
<SD-Card>/AIReader/####/360e487d185241868335a66a4fc8fbb2jpgx.tmp
<SD-Card>/AIReader/####/36f8068c1f9f4337addc9b4c8103b4a6jpgx.tmp
<SD-Card>/AIReader/####/441d684236714b9bbab87440ad91443fjpgx.tmp
<SD-Card>/AIReader/####/460c0bd2de9a4a44a1c8674a8a337370jpgx.tmp
<SD-Card>/AIReader/####/4a288aac6ce647e7a95b0b63d353dfe6jpgx.tmp
<SD-Card>/AIReader/####/4b49a9268e27449aa7c94cf59574ce55jpgx.tmp
<SD-Card>/AIReader/####/5676792fcfb14f8e9f151108e087a72fjpgx.tmp
<SD-Card>/AIReader/####/5ac848b68ef447a6bfdea8351224a546jpgx.tmp
<SD-Card>/AIReader/####/5ccfdd18bc47443689b39601b2704132jpgx.tmp
<SD-Card>/AIReader/####/64947fdfa74546e4a983b33c99ecd975jpgx.tmp
<SD-Card>/AIReader/####/67fdd05cf0a74931aad36b0f05ed083ajpgx.tmp
<SD-Card>/AIReader/####/77f4e08f6e5d4b7ea4a918551708c388jpgx.tmp
<SD-Card>/AIReader/####/982d4d5c6e134d81be8a7421f3ce16fejpgx.tmp
<SD-Card>/AIReader/####/9b84db4903c947718fa0db9347b75f4ejpgx.tmp
<SD-Card>/AIReader/####/9cdd93574105464f9771837e392caa4cjpgx.tmp
<SD-Card>/AIReader/####/9e66db763b4d4d1384b301e8ba5f798ejpgx.tmp
<SD-Card>/AIReader/####/a4a58dc3adeb48ceb951ae9a0628a5c0jpgx.tmp
<SD-Card>/AIReader/####/a8045d6e6cac434597ceef8e05cdcb7ajpgx.tmp
<SD-Card>/AIReader/####/adv_self_config.dat
<SD-Card>/AIReader/####/aedf271398ce4318a8ab7376dc452ef3jpgx.tmp
<SD-Card>/AIReader/####/b5c1f5bee8184faba64686ecfef77749jpgx.tmp
<SD-Card>/AIReader/####/ba2f792105d84ad09161cacf770922e9jpgx.tmp
<SD-Card>/AIReader/####/c2d10a369e134a1bb28f92b60e46f10fjpgx.tmp
<SD-Card>/AIReader/####/c6d00581e9604ef19de75a9f386129eajpgx.tmp
<SD-Card>/AIReader/####/ccf81516747748d6a99aa631a36b440ejpgx.tmp
<SD-Card>/AIReader/####/cd713a910f3d49d6b44c24a763379536jpgx.tmp
<SD-Card>/AIReader/####/config.data
<SD-Card>/AIReader/####/d0a07b0baa6d498e8395d7d0cbfdb536jpgx.tmp
<SD-Card>/AIReader/####/d2d995edddff44449cdd746671d511d6jpgx.tmp
<SD-Card>/AIReader/####/eceb44516cda4ddf9636a60adf7ba1c2jpgx.tmp
<SD-Card>/AIReader/####/f5065ea3610c4857ac52a133a5d64cfajpgx.tmp
<SD-Card>/AIReader/####/f9c52545b8c0420bb25d667c4e3bd124jpgx.tmp
<SD-Card>/AIReader/####/fadc145eb90e41478cbd05fa58bb79c6jpgx.tmp
<SD-Card>/AIReader/####/fd065c1ba03d417da1290928657327cfjpgx.tmp
<SD-Card>/AIReader/####/ff653b1b4017457ba157198761f8345ejpgx.tmp
<SD-Card>/AIReader/####/home_infos_1.dat
<SD-Card>/AIReader/####/home_infos_2.dat
<SD-Card>/AIReader/####/import.dat
<SD-Card>/AIReader/####/sxsplash20160727_579817d469bca.jpgx_bak
<SD-Card>/AIReader/####/sxsplash20160727_579817da499fb.jpgx_bak
<SD-Card>/AIReader/####/sxsplash20160727_579817de0f457.jpgx_bak
<SD-Card>/AIReader/####/sxsplash20160727_579817e1da72a.jpgx_bak
<SD-Card>/AIReader/####/sxsplash20160727_57981808344f4.jpgx_bak
<SD-Card>/Android/####/1865fc9edf7b16979d5e52efb3b36593.apk
<SD-Card>/Android/####/V2.8.1.txt
<SD-Card>/Android/####/b.tmp
<SD-Card>/Android/####/fdc0334672a10
<SD-Card>/Android/.did
<SD-Card>/data/.did

Другие:

Запускает следующие shell-скрипты:

chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/1865fc9edf7b16979d5e52efb3b36593.apk
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
sh

Загружает динамические библиотеки:

_mzta11
libjiagu
smssdk

Использует следующие алгоритмы для шифрования данных:

AES-CBC-PKCS5Padding

Использует следующие алгоритмы для расшифровки данных:

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Осуществляет доступ к информации о запущенных приложениях.

Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней