Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.3307
- Android.DownLoader.611.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) api.kt####.com:80
- TCP(HTTP/1.1) 2####.195.1.254:8090
- TCP(HTTP/1.1) an####.l####.com:8080
- TCP(HTTP/1.1) int.d####.s####.####.cn:80
- TCP(HTTP/1.1) dn.tc####.com:80
- TCP(HTTP/1.1) pi####.qq.com:80
- TCP(HTTP/1.1) dat####.kt####.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) up####.ssp.api.####.cn:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) an####.g####.k####.com:9080
- TCP(HTTP/1.1) k####.k####.com.####.com:80
- TCP(HTTP/1.1) qp.yunanfu####.com.####.com:80
- TCP(HTTP/1.1) gn.bule####.cn:6801
- TCP(HTTP/1.1) 2####.195.1.254:8080
- TCP(HTTP/1.1) w####.pcon####.com.cn:80
- TCP(HTTP/1.1) sdk.c####.com:80
- TCP(TLS/1.0) an####.l####.com:443
- TCP(TLS/1.0) app-ro####.leanc####.cn:443
- TCP(TLS/1.0) cdn.on####.mobi:443
- TCP(TLS/1.0) ads.on####.mobi:443
- TCP(TLS/1.0) dev.s####.l####.net:443
Запросы DNS:
- ad.ssp.api.####.cn
- ads.on####.mobi
- an####.g####.k####.com
- an####.l####.com
- api.kt####.com
- app-ro####.leanc####.cn
- cdn.on####.mobi
- dat####.kt####.com
- dn.tc####.com
- gn.bule####.cn
- imgc####.qq.com
- int.d####.s####.####.cn
- k####.k####.com
- mlm7####.s####.l####.net
- pi####.qq.com
- qp.yunanfu####.com
- qzones####.g####.cn
- s####.e.qq.com
- sdk.c####.com
- up####.ssp.api.####.cn
- w####.pcon####.com.cn
Запросы HTTP GET:
- an####.g####.k####.com:9080/ip/
- api.kt####.com/2/game/general/baseinfo?os=####&platform=####&channel_id=...
- dn.tc####.com/dnfile/shengjibao/kernel20180201A48.jar
- k####.k####.com.####.com/res/js/libgloud-pa_x86.so
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.html
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/interstitial.html
- p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
- qp.yunanfu####.com.####.com/kubo/dex/luomi10.212.dex
- qp.yunanfu####.com.####.com/kubo/hongbao/hb6/chaishenye_1.png
- qp.yunanfu####.com.####.com/kubo/hongbao/hb6/chaishenye_2.png
- qp.yunanfu####.com.####.com/kubo/hongbao/hb7/hongbao1.png
- qp.yunanfu####.com.####.com/kubo/hongbao/hb7/hongbao2.png
- qp.yunanfu####.com.####.com/kubo/hongbao/hb8/hongbao1.png
- qp.yunanfu####.com.####.com/kubo/hongbao/hb8/hongbao3.png
- qp.yunanfu####.com.####.com/kubo/hongbao/hb8/hongbao4.png
- up####.ssp.api.####.cn/api/soupdate
- up####.ssp.api.####.cn/api/userinfo?i=####&e=####&j=eyJ1a####
Запросы HTTP POST:
- 2####.195.1.254:8080/adveranaly/hbdt/getHbInfo
- 2####.195.1.254:8090/adveranaly/drdevicekeep/keepAnalyse
- an####.l####.com:8080/adveranaly/hbdt/getHbInfo
- api.kt####.com/2/game/startup/upload
- api.kt####.com/2/game/statistics/upload
- dat####.kt####.com/1/account/init
- dat####.kt####.com/1/account/submit
- dat####.kt####.com/1/device/init
- gn.bule####.cn:6801/bvmain.aspx
- int.d####.s####.####.cn/iplookup/iplookup.php?format=####
- pi####.qq.com/mstat/report/?index=####
- s####.e.qq.com/activate
- s####.e.qq.com/launch
- sdk.c####.com/versiontapi.php?v=####&type=####
- up####.ssp.api.####.cn/api/cloudupdate
- up####.ssp.api.####.cn/api/def
- w####.pcon####.com.cn/ip.jsp
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_ay_storage/####/update.jar
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar.sig
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp.sig
- <Package Folder>/app_e_qq_com_plugin/update_lc
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.sig
- <Package Folder>/app_e_qq_com_setting/gdt_suid
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.cfg
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.sig
- <Package Folder>/app_kernel/videokernel.apk
- <Package Folder>/app_res_out/VideoRes.apk
- <Package Folder>/app_tbs/####/core_info
- <Package Folder>/app_tbs/####/debug.conf
- <Package Folder>/app_tbs/####/tbscoreinstall.txt
- <Package Folder>/app_tbs/####/tbslock.txt
- <Package Folder>/app_temp/idb6c80afe-f3f5-43fc-b81b-ed04dd0c45e5.tmp
- <Package Folder>/cache/####/142bd1780a81ea7992a312a30ae7b61d
- <Package Folder>/cache/####/71f41322c1704cec70f9d6fbbc66949f
- <Package Folder>/cache/####/91b747861a4e02f5473320968066b683
- <Package Folder>/cache/####/ApplicationCache.db-journal
- <Package Folder>/cache/####/OnewaySdkStorage-ow-pri.json
- <Package Folder>/cache/####/OnewaySdkStorage-ow-pub.json
- <Package Folder>/cache/####/avoscloud-analysis
- <Package Folder>/cache/####/b471057b6e782e98679ca40e49390b37
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/cache/luomi249.dex
- <Package Folder>/cache/luomi_dex_ok_ok.dex
- <Package Folder>/databases/DownloadTaskStore.db-journal
- <Package Folder>/databases/appdownload.db
- <Package Folder>/databases/appdownload.db-journal
- <Package Folder>/databases/lmvideo_db-journal
- <Package Folder>/databases/pri_wxop_tencent_analysis.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/wxop_tencent_analysis.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/7cccae741c88336476f1bec2d1ad9c3b
- <Package Folder>/files/luomi_dex_ok_ok.dex (deleted)
- <Package Folder>/shared_prefs/.mta-wxop.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/AVOSCloud-SDK.xml
- <Package Folder>/shared_prefs/AV_CLOUD_API_VERSION_KEY_ZONE.xml
- <Package Folder>/shared_prefs/BuglySdkInfos.xml
- <Package Folder>/shared_prefs/com.afk.client.ads.xml
- <Package Folder>/shared_prefs/com.avos.avoscloud.RequestStatist...ta.xml
- <Package Folder>/shared_prefs/com.avos.avoscloud.analysis.xml
- <Package Folder>/shared_prefs/com.avos.avoscloud.approuter.mLM7...sz.xml
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/dianrui_cache.xml
- <Package Folder>/shared_prefs/ktplay.xml
- <Package Folder>/shared_prefs/luomi_cache.xml
- <Package Folder>/shared_prefs/qihoo_jiagu_crash_report.xml
- <Package Folder>/shared_prefs/share_data.xml
- <SD-Card>/.hblmad/chaishenye_1.png
- <SD-Card>/.hblmad/chaishenye_2.png
- <SD-Card>/.hblmad/hongbao1.png
- <SD-Card>/.hblmad/hongbao2.png
- <SD-Card>/.hblmad/hongbao3.png
- <SD-Card>/.hblmad/hongbao4.png
- <SD-Card>/.hxsdka/73390494278040c986abdb3b7d991da2
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Tencent/####/.mid.txt
- <SD-Card>/ktplay/d
- <SD-Card>/play/####/kernel.dat
- <SD-Card>/sdtmp/id147f860da-1235-44cf-817c-9c8d2f652f43.tmp
- <SD-Card>/sdtmp/id177d7d102-9474-453e-90c6-fdfe1672da99.tmp
- <SD-Card>/sdtmp/id1ac142719-1896-442b-9859-2e55ecf6fe33.tmp
- <SD-Card>/sdtmp/id1cd166cdb-d83a-4009-b7eb-03ddfac9b98a.tmp
- <SD-Card>/sdtmp/id1e55a951e-308e-4100-9343-85fe3c3d8dcd.tmp
- <SD-Card>/sdtmp/id1fbe10073-f31e-44ce-8983-c333b1cd7980.tmp
- <SD-Card>/sdtmp/id206c0bc3e-3c5f-42ef-8b2f-30786f825e1d.tmp
- <SD-Card>/sdtmp/id24173fbbc-bac1-4645-b59d-72ef25c17c21.tmp
- <SD-Card>/sdtmp/id27b2fe4e9-d6dc-43f9-ba71-c23880120878.tmp
- <SD-Card>/sdtmp/id2a26764b0-f78a-4a44-adec-12ba0d507b3a.tmp
- <SD-Card>/sdtmp/id2b03c507d-4a80-4153-9e5e-243185adb8c2.tmp
- <SD-Card>/sdtmp/id2f507bce1-0176-453c-b9c3-7e96b4933ffa.tmp
- <SD-Card>/tbs/####/tbslog.txt
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- cat /sys/class/net/wlan0/address
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- dumpsys meminfo 2063
- dumpsys meminfo 2206
- dumpsys meminfo 2312
- getprop ro.build.display.id
- getprop ro.build.version.opporom
- getprop ro.miui.ui.version.name
- getprop ro.product.cpu.abi
Загружает динамические библиотеки:
- KTAccountmanager
- KTChat
- KTFriendship
- KTLeaderboard
- KTPlay
- KTTagging
- cocos2dcpp
- libjiagu
- mobclickcpp
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS7Padding
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
