Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.BackDoor.360
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.juj####.cn:80
- TCP(HTTP/1.1) ga####.lotu####.com:80
- TCP(HTTP/1.1) vod.d####.net:80
- TCP(HTTP/1.1) at.al####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
Запросы DNS:
- at.al####.com
- d.ispser####.cc
- ga####.lotu####.com
- p0y6y####.bkt.clo####.com
- vod.d####.net
- vod.juj####.cn
- www.d####.net
- www.juj####.cn
Запросы HTTP GET:
- at.al####.com/t/font_nwpovbrbodvaemi.ttf
- t####.c####.q####.####.com/rentme/banner/rentme_banner_1473582090425.jpg
- t####.c####.q####.####.com/rentme/banner/rentme_banner_1473582096366.jpg
- t####.c####.q####.####.com/rentme/banner/rentme_banner_1477016838877.jpg
- t####.c####.q####.####.com/rentme/icon/rentme_iconGirlNew_14.jpg
- t####.c####.q####.####.com/rentme/icon/rentme_iconGirlNew_16.jpg
- t####.c####.q####.####.com/rentme/icon/rentme_iconGirlNew_18.jpg
- t####.c####.q####.####.com/rentme/icon/rentme_iconGirlNew_21.jpg
- t####.c####.q####.####.com/rentme/icon/rentme_iconGirlNew_30.jpg
- t####.c####.q####.####.com/rentme/icon/rentme_iconGirlNew_36.jpg
- t####.c####.q####.####.com/rentme/icon/rentme_iconGirlNew_43.jpg
- t####.c####.q####.####.com/rentme/icon/rentme_iconGirlNew_45.jpg
- t####.c####.q####.####.com/rentme/icon/rentme_iconGirlNew_49.jpg
- t####.c####.q####.####.com/rentme/icon/rentme_iconGirlNew_75.jpg
- t####.c####.q####.####.com/rentme/image/rentme_data_1.jpg
- t####.c####.q####.####.com/rentme/image/rentme_data_10.jpg
- t####.c####.q####.####.com/rentme/image/rentme_data_12.jpg
- t####.c####.q####.####.com/rentme/image/rentme_data_2.jpg
- t####.c####.q####.####.com/rentme/image/rentme_data_3.jpg
- t####.c####.q####.####.com/rentme/image/rentme_data_4.jpg
- t####.c####.q####.####.com/rentme/image/rentme_data_5.jpg
- t####.c####.q####.####.com/rentme/image/rentme_data_6.jpg
- t####.c####.q####.####.com/rentme/image/rentme_data_7.jpg
- t####.c####.q####.####.com/rentme/image/rentme_data_9.jpg
- t####.c####.q####.####.com/rentme/image/rentme_data_9_1.jpg?imageVi####
- t####.c####.q####.####.com/rentme/image/rentme_data_9_2.jpg?imageVi####
- vod.d####.net/piwik/piwik.js
- vod.d####.net/rentme/index.php/rmcGetH5/back_new?account_id=####
- vod.d####.net/rentme/index.php/rmcGetH5/getAccountInfo?account_id=####&i...
- vod.d####.net/rentme/index.php/rmcGetH5/getOtherInfoList?page=####&listS...
- vod.d####.net/rentme/index.php/rmcGetH5/getUIScrollPicture
- vod.d####.net/rentme/index.php/rmcGetH5/get_dynamic?account_id=####&is_r...
- vod.d####.net/rentme/index.php/rmcGetH5/verifyUser?isPhone=####&userTag=...
- vod.d####.net/rentmeH5/
- vod.d####.net/rentmeH5/assets/bundle.js?2e99460####
- vod.d####.net/rentmeH5/assets/style.css?2e99460####
- www.juj####.cn/active!activeLog.action?provider=####&clickId=####&manu=#...
- www.juj####.cn/resource!getPriceInfo?hour=####&flag=####&pushId=####&dex...
- www.juj####.cn/resource!resource?resTypes=####&carrierCode=####&pushId=#...
- www.juj####.cn/v/aile_all_app/?mcid=####&appid=####&channelid=####&versi...
- www.juj####.cn/v/aile_all_app/css/app.css
- www.juj####.cn/v/aile_all_app/css/comment.css
- www.juj####.cn/v/aile_all_app/css/swiper3.4.2.min.css
- www.juj####.cn/v/aile_all_app/img/logo2.png
- www.juj####.cn/v/aile_all_app/img/nav_frd.png
- www.juj####.cn/v/aile_all_app/img/nav_live.png
- www.juj####.cn/v/aile_all_app/img/nav_shop.png
- www.juj####.cn/v/aile_all_app/img/nav_vidhome.png
- www.juj####.cn/v/aile_all_app/img/nav_vidlist.png
- www.juj####.cn/v/aile_all_app/img/nores.png
- www.juj####.cn/v/aile_all_app/img/scicon.png
- www.juj####.cn/v/aile_all_app/img/user.png
- www.juj####.cn/v/aile_all_app/js/app.js?v=####
- www.juj####.cn/v/aile_all_app/js/fastclick.js
- www.juj####.cn/v/aile_all_app/js/swiper3.4.2.min.js
- www.juj####.cn/v/aile_all_app/js/zepto.js
Запросы HTTP POST:
- ga####.lotu####.com/?st=####&sv=####&tm=####&sid=azI####&apn=####&ct=###...
- vod.d####.net/rentme/index.php/rmcGetH5/get_fan
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_cache/ApplicationCache.db-journal
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/0.png
- <Package Folder>/files/####/5.png
- <Package Folder>/files/####/allbgs.png
- <Package Folder>/files/####/app.css
- <Package Folder>/files/####/app.js
- <Package Folder>/files/####/appgift.png
- <Package Folder>/files/####/button_free.png
- <Package Folder>/files/####/button_right.png
- <Package Folder>/files/####/button_vip.png
- <Package Folder>/files/####/clear.png
- <Package Folder>/files/####/cleartn.png
- <Package Folder>/files/####/err.png
- <Package Folder>/files/####/fastclick.js
- <Package Folder>/files/####/grey.gif
- <Package Folder>/files/####/helpicon.png
- <Package Folder>/files/####/index.html
- <Package Folder>/files/####/list.png
- <Package Folder>/files/####/logo2.png
- <Package Folder>/files/####/nav0.png
- <Package Folder>/files/####/nav0_on.png
- <Package Folder>/files/####/nav1.png
- <Package Folder>/files/####/nav1_on.png
- <Package Folder>/files/####/nav3.png
- <Package Folder>/files/####/nav3_on.png
- <Package Folder>/files/####/nav4.png
- <Package Folder>/files/####/nav4_on.png
- <Package Folder>/files/####/none.png
- <Package Folder>/files/####/nores.png
- <Package Folder>/files/####/playhis.png
- <Package Folder>/files/####/readme
- <Package Folder>/files/####/scicon.png
- <Package Folder>/files/####/searchbtn.png
- <Package Folder>/files/####/swiper3.4.2.min.css
- <Package Folder>/files/####/swiper3.4.2.min.js
- <Package Folder>/files/####/sz.png
- <Package Folder>/files/####/video.png
- <Package Folder>/files/####/zepto.js
- <Package Folder>/files/INSTALLATION
- <Package Folder>/files/android_resources.jar
- <Package Folder>/files/lotuseed.apps
- <Package Folder>/files/lotuseed.lock
- <Package Folder>/files/lotuseed.s
- <Package Folder>/files/lotuseed.task
- <Package Folder>/files/rawnewimp
- <Package Folder>/files/rawnewimp (deleted)
- <Package Folder>/shared_prefs/android_service_global.xml
- <Package Folder>/shared_prefs/jg_so_upgrade_setting.xml
- <Package Folder>/shared_prefs/lotuseed_global.xml
- <Package Folder>/shared_prefs/lotuseed_main.xml
- <Package Folder>/shared_prefs/tknetwork.xml
- <Package Folder>/shared_prefs/zhys.xml
- <SD-Card>/.system/lotuseed.devid
- <SD-Card>/.tpservice/INSTALLATION
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- ps
Загружает динамические библиотеки:
- ccuv
- libjiagu
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
Осуществляет доступ к информации об отправленых/принятых смс.
