Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.3422
- Android.DownLoader.657.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) tata-v####.img-cn-####.aliy####.com:80
- TCP(HTTP/1.1) d####.opensp####.cn:80
- TCP(HTTP/1.1) statse####.tatat####.com:1180
- TCP(HTTP/1.1) go####.yo####.com:80
- TCP(HTTP/1.1) h####.opensp####.cn:80
- TCP(HTTP/1.1) d14uy7w####.cloudf####.net:80
- TCP(HTTP/1.1) etatase####.tatat####.com:80
- TCP(HTTP/1.1) oss.tatat####.com:80
- TCP(HTTP/1.1) 47.92.1####.96:80
- TCP(HTTP/1.1) cdn.game####.org:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(TLS/1.0) 1####.217.19.206:443
- TCP(TLS/1.0) x####.l####.top:443
Запросы DNS:
- a####.u####.com
- ads.tatat####.com
- cdn.game####.org
- d####.opensp####.cn
- d14uy7w####.cloudf####.net
- duo####.tatat####.com
- etatase####.tatat####.com
- go####.yo####.com
- h####.opensp####.cn
- oss.tatat####.com
- statse####.tatat####.com
- tata-v####.img-cn-####.aliy####.com
- x####.l####.top
Запросы HTTP GET:
- cdn.game####.org/strategy/base
- cdn.game####.org/strategy/dev_root2
- cdn.game####.org/strategy/larger4.3
- cdn.game####.org/strategy/loss_4.3
- cdn.game####.org/strategy/sul18
- d14uy7w####.cloudf####.net/download/key
- go####.yo####.com/gorgon/request.s?s=####&ydet=####
- h####.opensp####.cn/launchconfig?t=####&p=ZGZhc####
- oss.tatat####.com/audio/mr/5shangrtyjhgdfhgd.jpg
- oss.tatat####.com/audio/mr/5xiahjdfjhgfjhgf.jpg
- oss.tatat####.com/audio/xiaoxuejiaocai/2443-9b42b1b9e4f0d3a6e591eb693476...
- oss.tatat####.com/audio/xiaoxuejiaocai/2444-efd3454a32b82a0952c09de16790...
- oss.tatat####.com/audio/xiaoxuejiaocai/2499-589a93d061590ce8057058f0b8ec...
- oss.tatat####.com/audio/xiaoxuejiaocai/2500-5ec06ffdf2fecd4cf42e86bfcfda...
- oss.tatat####.com/xiaoxue/diandu/7179.jpg
- oss.tatat####.com/xiaoxue/diandu/7180.jpg
- oss.tatat####.com/xiaoxue/diandu/7181.jpg
- oss.tatat####.com/xiaoxue/diandu/7182.jpg
- oss.tatat####.com/xiaoxue/diandu/7183.jpg
- oss.tatat####.com/xiaoxue/diandu/7184.jpg
- oss.tatat####.com/xiaoxue/diandu/7185.jpg
- oss.tatat####.com/xiaoxue/diandu/7186.jpg
- oss.tatat####.com/xiaoxue/diandubook/127.jpg
- oss.tatat####.com/xiaoxue/diandubook/129.jpg
- oss.tatat####.com/xiaoxue/diandubook/130.jpg
- oss.tatat####.com/xiaoxue/diandubook/131.jpg
- oss.tatat####.com/xiaoxue/diandubook/132.jpg
- oss.tatat####.com/xiaoxue/diandubook/133.jpg
- oss.tatat####.com/xiaoxue/diandubook/134.jpg
- oss.tatat####.com/xiaoxue/diandubook/142.jpg
- oss.tatat####.com/xiaoxue/diandubook/143.jpg
- oss.tatat####.com/xiaoxue/diandubook/3d30253299812a7d519eb65ffd757600.jpg
- oss.tatat####.com/xiaoxue/diandubook/45ec93f783b08ea740048a3796d5e3b3.jpg
- oss.tatat####.com/xiaoxue/diandump3/56384.mp3
- oss.tatat####.com/xiaoxue/diandump3/56397.mp3
- oss.tatat####.com/xiaoxue/diandump3/56398.mp3
- oss.tatat####.com/xiaoxue/diandump3/56402.mp3
- oss.tatat####.com/xiaoxue/diandump3/56412.mp3
- tata-v####.img-cn-####.aliy####.com/xiaoxue/diandu/7177.jpg@100w
- tata-v####.img-cn-####.aliy####.com/xiaoxue/diandu/7178.jpg@100w
- tata-v####.img-cn-####.aliy####.com/xiaoxue/diandu/7179.jpg@100w
- tata-v####.img-cn-####.aliy####.com/xiaoxue/diandu/7180.jpg@100w
- tata-v####.img-cn-####.aliy####.com/xiaoxue/diandu/7181.jpg@100w
- tata-v####.img-cn-####.aliy####.com/xiaoxue/diandu/7182.jpg@100w
- tata-v####.img-cn-####.aliy####.com/xiaoxue/diandu/7183.jpg@100w
- tata-v####.img-cn-####.aliy####.com/xiaoxue/diandu/7184.jpg@100w
Запросы HTTP POST:
- a####.u####.com/app_logs
- d####.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
- etatase####.tatat####.com/ads/rt.s?id=####
- etatase####.tatat####.com/tataeraapi/api.s?&h=####
- etatase####.tatat####.com/tataeraapi/api.s?h=####
- etatase####.tatat####.com/tataeraapi/api.s?h=####&ver=####&pr=####
- statse####.tatat####.com:1180/stat/api.s?h=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_0587ceda-53e8-4806-915f-ddd86c895628/Matrix
- <Package Folder>/app_0587ceda-53e8-4806-915f-ddd86c895628/ddexe
- <Package Folder>/app_0587ceda-53e8-4806-915f-ddd86c895628/debuggerd
- <Package Folder>/app_0587ceda-53e8-4806-915f-ddd86c895628/fileWork
- <Package Folder>/app_0587ceda-53e8-4806-915f-ddd86c895628/insta...ery.sh
- <Package Folder>/app_0587ceda-53e8-4806-915f-ddd86c895628/pidof
- <Package Folder>/app_0587ceda-53e8-4806-915f-ddd86c895628/su
- <Package Folder>/app_0587ceda-53e8-4806-915f-ddd86c895628/supolicy
- <Package Folder>/app_0587ceda-53e8-4806-915f-ddd86c895628/toolbox
- <Package Folder>/app_0587ceda-53e8-4806-915f-ddd86c895628/wsroot.sh
- <Package Folder>/app_768ab64a-e180-4fae-be21-4aa1e9953e48/0e842...06.jar
- <Package Folder>/app_a3a55d03-edc4-46b3-96c5-292450f49135/Matrix
- <Package Folder>/app_a3a55d03-edc4-46b3-96c5-292450f49135/ddexe
- <Package Folder>/app_a3a55d03-edc4-46b3-96c5-292450f49135/debuggerd
- <Package Folder>/app_a3a55d03-edc4-46b3-96c5-292450f49135/device.db
- <Package Folder>/app_a3a55d03-edc4-46b3-96c5-292450f49135/fileWork
- <Package Folder>/app_a3a55d03-edc4-46b3-96c5-292450f49135/insta...ery.sh
- <Package Folder>/app_a3a55d03-edc4-46b3-96c5-292450f49135/pidof
- <Package Folder>/app_a3a55d03-edc4-46b3-96c5-292450f49135/root3
- <Package Folder>/app_a3a55d03-edc4-46b3-96c5-292450f49135/su
- <Package Folder>/app_a3a55d03-edc4-46b3-96c5-292450f49135/supolicy
- <Package Folder>/app_a3a55d03-edc4-46b3-96c5-292450f49135/toolbox
- <Package Folder>/app_a3a55d03-edc4-46b3-96c5-292450f49135/wsroot.sh
- <Package Folder>/app_priv_res/c5cd327c-db4d-41df-b460-a57ddee13868
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_subox_download/0d1aa5af-4d05-4a81-ad9e-7bd3a7ef7e73
- <Package Folder>/app_subox_download/1b35f2c3-faba-481d-a9fb-b67267438449
- <Package Folder>/app_subox_download/51e62b74-6305-4aa8-b59b-5e5d5091873d
- <Package Folder>/app_subox_download/e7f19972-ba0a-4ee2-8266-65bc018e1d22
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/databases/statistics-journal
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/.imprint
- <Package Folder>/files/6.jar
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/com.iflytek.id.xml
- <Package Folder>/shared_prefs/ifly_launch_lib.xml
- <Package Folder>/shared_prefs/iflytek_state_<Package>.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/mffu.ssgej.mmfv.my.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/sdfasa.xml
- <Package Folder>/shared_prefs/shareadsdk.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/Android/####/-1106863551.tmp
- <SD-Card>/Android/####/-1433673316.tmp
- <SD-Card>/Android/####/-1600893833.tmp
- <SD-Card>/Android/####/-1797407338.tmp
- <SD-Card>/Android/####/-1993920843.tmp
- <SD-Card>/Android/####/-2022250657.tmp
- <SD-Card>/Android/####/-282331120.tmp
- <SD-Card>/Android/####/-283254641.tmp
- <SD-Card>/Android/####/-284178162.tmp
- <SD-Card>/Android/####/-285101683.tmp
- <SD-Card>/Android/####/-286025204.tmp
- <SD-Card>/Android/####/-286948725.tmp
- <SD-Card>/Android/####/-287872246.tmp
- <SD-Card>/Android/####/-308189708.tmp
- <SD-Card>/Android/####/-384501707.tmp
- <SD-Card>/Android/####/-478168089.tmp
- <SD-Card>/Android/####/-479091610.tmp
- <SD-Card>/Android/####/-505873719.tmp
- <SD-Card>/Android/####/-506797240.tmp
- <SD-Card>/Android/####/-507720761.tmp
- <SD-Card>/Android/####/-508644282.tmp
- <SD-Card>/Android/####/-509567803.tmp
- <SD-Card>/Android/####/-529885265.tmp
- <SD-Card>/Android/####/-531732307.tmp
- <SD-Card>/Android/####/-727176612.tmp
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/107384607.tmp
- <SD-Card>/Android/####/1486662619.tmp
- <SD-Card>/Android/####/1489923086.tmp
- <SD-Card>/Android/####/1490926372.tmp
- <SD-Card>/Android/####/1507149681.tmp
- <SD-Card>/Android/####/1683176124.tmp
- <SD-Card>/Android/####/1879689629.tmp
- <SD-Card>/Android/####/2076203134.tmp
- <SD-Card>/iflyworkdir_test
- <SD-Card>/msc/.2F6E2C5B63F0F83B
- <SD-Card>/tataera/####/diandu_137.txt
- <SD-Card>/tataera/####/diandu_137_simple.txt
- <SD-Card>/tatatimes/####/1CD0E3552B6F13DFD34B378D3BDB7B30
- <SD-Card>/tatatimes/####/66DBB35D0E8030E6F5FD67A4091BE746
- <SD-Card>/tatatimes/####/92D25B1904A378EE6E20EAA4C07C7A0F
- <SD-Card>/tatatimes/####/99F10EDD886F4B6982DC135E771BB61C
- <SD-Card>/tatatimes/####/FF3B1A0A55482BDA232AF19049520484
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
Загружает динамические библиотеки:
- libjiagu
- msc
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- DES
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- DES
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
