Android.Packed.36061

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.657.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) h####.a####.com:80
TCP(HTTP/1.1) kvt####.m####.a####.com:80
TCP(HTTP/1.1) www.a####.com.####.com:80
TCP(HTTP/1.1) ip.ta####.com:80
TCP(HTTP/1.1) nb4052-####.a####.com:80
TCP(HTTP/1.1) nb3201-####.a####.com:80
TCP(HTTP/1.1) cs228-####.a####.com:80
TCP(HTTP/1.1) cs227-####.a####.com:80
TCP(HTTP/1.1) cdn.game####.org:80
TCP(HTTP/1.1) c47.a####.com:80
TCP(HTTP/1.1) 47.92.1####.96:80
TCP(HTTP/1.1) fs007-####.a####.com:80
TCP(HTTP/1.1) 1####.76.224.67:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) nb3200-####.a####.com:80
TCP(HTTP/1.1) cs229-####.a####.com:80
TCP(HTTP/1.1) d14uy7w####.cloudf####.net:80
TCP(HTTP/1.1) nb4051-####.a####.com:80
TCP(HTTP/1.1) nb4510-####.a####.com:80
TCP(HTTP/1.1) nb3199-####.a####.com:80
TCP(HTTP/1.1) fu1.a####.com:80
TCP(HTTP/1.1) cdn.img.h####.####.com:80
TCP(HTTP/1.1) nb4520-####.a####.com:80
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) f####.l####.top:443

Запросы DNS:

a####.u####.com
c47.a####.com
cdn.game####.org
cdn.img.h####.top
cs227-####.a####.com
cs228-####.a####.com
cs229-####.a####.com
cs230-####.a####.com
d14uy7w####.cloudf####.net
f####.l####.top
fs007-####.a####.com
fu1.a####.com
h####.a####.com
h####.a####.com
h####.a####.com
ip.ta####.com
kvt####.m####.a####.com
log.u####.com
m####.a####.com
m.a####.com
nb3194-####.a####.com
nb3199-####.a####.com
nb3200-####.a####.com
nb3201-####.a####.com
nb4051-####.a####.com
nb4052-####.a####.com
nb4500-####.a####.com
nb4510-####.a####.com
nb4520-####.a####.com
policyc####.a####.com
res.we####.cn
s####.u####.com
so.a####.com
www.a####.com
x####.a####.com
x####.l####.top

Запросы HTTP GET:

c47.a####.com/user/168/19783168/1005/card/47542246/card.mp4?l=####&to=####
c47.a####.com/user/9/10613009/1005/card/47536252/47536252_800.jpg
c47.a####.com/user/9/10613009/1005/card/47536252/info.xml
c47.a####.com/user/9/10613009/1005/card/47552931/card.mp4?l=####&to=####
cdn.game####.org/strategy/base
cdn.game####.org/strategy/dev_root2
cdn.game####.org/strategy/loss_4.3
cdn.game####.org/strategy/sul18
cdn.img.h####.####.com/upload/201803/1/img/20180301132145970.png
cs227-####.a####.com/user/168/19783168/1005/card/47562727/47562727_800.jpg
cs227-####.a####.com/user/168/19783168/1005/card/47573714/47573714_800.jpg
cs228-####.a####.com/user/9/10613009/1005/card/47552931/card.mp4?l=####&...
cs229-####.a####.com/user/448/64609448/1005/card/47542021/47542021_800.jpg
d14uy7w####.cloudf####.net/download/key
fs007-####.a####.com/user/168/19783168/1005/card/47542246/card.mp4?l=###...
fu1.a####.com/account/168/19783168/account/19783168_normal.jpg
fu1.a####.com/account/448/64609448/account/64609448_normal.jpg
fu1.a####.com/account/87/35755087/account/35755087_normal.jpg
fu1.a####.com/account/9/10613009/account/10613009_normal.jpg
fu1.a####.com/account/92/22433092/account/22433092_normal.jpg
h####.a####.com/user/100/38978100/1041/card/47571966/47571966_400.jpg
h####.a####.com/user/168/19783168/1005/card/47542246/card.mp4?l=####
h####.a####.com/user/168/19783168/1005/card/47562727/47562727_800.jpg
h####.a####.com/user/168/19783168/1005/card/47562727/card.mp4?l=####
h####.a####.com/user/168/19783168/1005/card/47573714/47573714_800.jpg
h####.a####.com/user/448/64609448/1005/card/47542021/47542021_800.jpg
h####.a####.com/user/556/20732556/4322236/card/44071548/44071548_800.jpg
h####.a####.com/user/556/20732556/4322236/card/44071548/card.mp4?l=####
h####.a####.com/user/556/20732556/4322236/card/44071548/info.xml
h####.a####.com/user/87/35755087/1005/card/47520358/47520358_800.jpg
h####.a####.com/user/87/35755087/1005/card/47520358/card.mp4?l=####
h####.a####.com/user/9/10613009/1005/card/47536252/47536252_800.jpg
h####.a####.com/user/9/10613009/1005/card/47536252/card.mp4?l=####
h####.a####.com/user/9/10613009/1005/card/47536252/info.xml
h####.a####.com/user/9/10613009/1005/card/47552931/47552931_800.jpg
h####.a####.com/user/9/10613009/1005/card/47552931/card.mp4?l=####
h####.a####.com/user/9/10613009/1005/card/47552931/info.xml
h####.a####.com/user/9/10613009/1005/card/47563988/47563988_800.jpg
ip.ta####.com/service/getIpInfo2.php?ip=####
kvt####.m####.a####.com/kvinfo.php
nb3199-####.a####.com/user/168/19783168/1005/card/47562727/card.mp4?l=##...
nb3200-####.a####.com/user/9/10613009/1005/card/47552931/card.mp4?l=####...
nb3200-####.a####.com/user/9/10613009/1005/card/47552931/info.xml
nb3201-####.a####.com/user/9/10613009/1005/card/47536252/47536252_800.jpg
nb4051-####.a####.com/user/9/10613009/1005/card/47536252/card.mp4?l=####...
nb4051-####.a####.com/user/9/10613009/1005/card/47563988/47563988_800.jpg
nb4052-####.a####.com/user/87/35755087/1005/card/47520358/47520358_800.jpg
nb4052-####.a####.com/user/9/10613009/1005/card/47552931/47552931_800.jpg
nb4510-####.a####.com/user/9/10613009/1005/card/47536252/info.xml
nb4520-####.a####.com/user/87/35755087/1005/card/47520358/card.mp4?l=###...
www.a####.com.####.com/api/aipaiApp_action-getCommentNew_mobile-1_type-2...
www.a####.com.####.com/api/framework/conf/19?appver=####&os=####&version...
www.a####.com.####.com/api/hot/bannerItem/355?appver=####&os=####&versio...
www.a####.com.####.com/api/hot/titleItem/356?appver=####&os=####&version...
www.a####.com.####.com/api/hot/videos/3045?appId=####&xifenId=####&appve...
www.a####.com.####.com/api/specialTopic/itemList/358?appver=####&os=####...
www.a####.com.####.com/api/specialTopic/view/116
www.a####.com.####.com/app/www/templates/cdn_policy_telecom.txt?appver=#...
www.a####.com.####.com/common/img/upload/auxplayData/1471310830_303.png
www.a####.com.####.com/common/img/upload/auxplayData/1475899538_546.png
www.a####.com.####.com/common/img/upload/auxplayData/1475899548_434.png
www.a####.com.####.com/common/img/upload/auxplayData/1475899556_347.gif
www.a####.com.####.com/common/img/upload/xifen/1480329950_399.png
www.a####.com.####.com/common/img/upload/xifen/1480330432_559.png
www.a####.com.####.com/common/img/upload/xifen/1480331697_834.png
www.a####.com.####.com/common/img/upload/xifen/1480331730_72.png
www.a####.com.####.com/common/img/upload/xifen/1480384995_717.png
www.a####.com.####.com/common/img/upload/xifen/1480385031_108.png
www.a####.com.####.com/common/img/upload/xifen/1480385054_409.png
www.a####.com.####.com/common/img/upload/xifen/1480385074_351.png
www.a####.com.####.com/common/img/upload/xifen/1480385282_467.png
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&app=##...
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&appver...
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&os=###...
www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&test=#...
www.a####.com.####.com/mobile/apps/apps_module-badDomain.html
www.a####.com.####.com/pc/operator

Запросы HTTP POST:

a####.u####.com/app_logs
kvt####.m####.a####.com/i.gif

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/Matrix
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/ddexe
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/debuggerd
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/device.db
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/fileWork
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/insta...ery.sh
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/pidof
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/root3
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/su
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/supolicy
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/toolbox
<Package Folder>/app_1e64a5c4-2289-4f0c-bf7f-aa6021260f37/wsroot.sh
<Package Folder>/app_2a10ffca-1f74-4dbd-98c3-4e3f3990118f/07b61...18.jar
<Package Folder>/app_a0cc07c3-eacc-44d8-bfc1-24ebb8abccbf/4459a...cd.jar
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/Matrix
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/ddexe
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/debuggerd
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/fileWork
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/insta...ery.sh
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/pidof
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/su
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/supolicy
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/toolbox
<Package Folder>/app_de24e229-b893-4fce-b236-56c828d8db96/wsroot.sh
<Package Folder>/app_priv_res/1da7cb78-7e74-4d61-941a-844f487c90dd
<Package Folder>/app_priv_res/f4e22d8d-b3d2-4764-be71-8423c27b8418
<Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
<Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
<Package Folder>/app_subox_download/01fe8fc3-c0ab-4180-b84b-84dad9ea99f2
<Package Folder>/app_subox_download/1af63e0a-0f39-4516-ad84-9d5b72ef0441
<Package Folder>/app_subox_download/1ce58bbf-c2b5-4e9a-b44f-7fb2b08d75f8
<Package Folder>/app_subox_download/2b7d9347-eaba-47d7-b2f6-afaa762cfedd
<Package Folder>/app_subox_download/7f7d26cb-b202-40dd-ad5e-71ac1dc94112
<Package Folder>/app_subox_download/a19b5964-9d42-4022-9a7b-5592bbb8fcfd
<Package Folder>/cache/####/0606f3787b644f32c867242d6877947d454....0.tmp
<Package Folder>/cache/####/4045ea2f9cacd22ab78dfe8e4590d03cbf2....0.tmp
<Package Folder>/cache/####/457cb70031de6290c5fad10c1678db19dd2....0.tmp
<Package Folder>/cache/####/4bd130b98794f631e45fb9277287ea391e5....0.tmp
<Package Folder>/cache/####/5d1e5f8ee3ae9f4d3f2359d7b3e7798dd35....0.tmp
<Package Folder>/cache/####/6cb640604223288af9168e08c57e9f846cf....0.tmp
<Package Folder>/cache/####/7149b0557521ffbfeb4172b1cbb1e4d5ca8....0.tmp
<Package Folder>/cache/####/7261720ee32cb112415d5bfbe37bf52fad9....0.tmp
<Package Folder>/cache/####/774a3f35b0c53e2923a6822babeeeeeabca....0.tmp
<Package Folder>/cache/####/7fabd1ad286e2e488ad2c0f377d6363fa4c....0.tmp
<Package Folder>/cache/####/7fda041f0ab029a5604abadda8c3a5832b7....0.tmp
<Package Folder>/cache/####/8afd34cf115859c435f51aa4b5150866446....0.tmp
<Package Folder>/cache/####/8ca5761fe3dd4e2f1fcbcabbcfcfe505795....0.tmp
<Package Folder>/cache/####/8fb855636d6af48d5d3d9fab9f748311e3a....0.tmp
<Package Folder>/cache/####/8fc06dae258ed67189bde220350f9c849fd....0.tmp
<Package Folder>/cache/####/ab04b4f1f90889acbb013ad9af1679ead33....0.tmp
<Package Folder>/cache/####/add4e6ea4c5621e37ad160783a5a4aa432d....0.tmp
<Package Folder>/cache/####/b1ea7f45af958dad0c2e751fca7cf72ccdb....0.tmp
<Package Folder>/cache/####/ba8fbd85df8a009128c6cc6252b7900fbcd....0.tmp
<Package Folder>/cache/####/ca257792088b768c9c8dab9d79b441d292d....0.tmp
<Package Folder>/cache/####/data_0
<Package Folder>/cache/####/data_1
<Package Folder>/cache/####/data_2
<Package Folder>/cache/####/data_3
<Package Folder>/cache/####/e48119de671f8678b2710f15d80f452d301....0.tmp
<Package Folder>/cache/####/e76292b8652c35fff43d409b168a2a0f989....0.tmp
<Package Folder>/cache/####/index
<Package Folder>/cache/####/journal.tmp
<Package Folder>/cache/0ac454fb239bbc42c0f51cb44a8e794d.0.tmp
<Package Folder>/cache/0ac454fb239bbc42c0f51cb44a8e794d.1.tmp
<Package Folder>/cache/13b31f240e07d0548ba82c0cdb939620.0.tmp
<Package Folder>/cache/13b31f240e07d0548ba82c0cdb939620.1.tmp
<Package Folder>/cache/8ebab337196647abd0bb017a02060a28.0.tmp
<Package Folder>/cache/8ebab337196647abd0bb017a02060a28.1.tmp
<Package Folder>/cache/d1068871518f9f3d69744af872bc645a.0.tmp
<Package Folder>/cache/d1068871518f9f3d69744af872bc645a.1.tmp
<Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.0.tmp
<Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.1.tmp
<Package Folder>/cache/journal.tmp
<Package Folder>/databases/aipai.db
<Package Folder>/databases/aipai.db-journal
<Package Folder>/databases/t_u.db-journal
<Package Folder>/databases/webview.db-journal
<Package Folder>/databases/webviewCookiesChromium.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/config.json
<Package Folder>/files/####/exchangeIdentity.json
<Package Folder>/files/.imprint
<Package Folder>/files/6.jar
<Package Folder>/files/RptKVStrategy.txt
<Package Folder>/files/SUBOXLOG_
<Package Folder>/files/aipai.guid
<Package Folder>/files/mobclick_agent_cached_<Package>300000
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/CookiePersistence.xml
<Package Folder>/shared_prefs/au.eypr.qa.xc.xml
<Package Folder>/shared_prefs/kr.xml
<Package Folder>/shared_prefs/multidex.version.xml
<Package Folder>/shared_prefs/qihoo_jiagu_crash_report.xml
<Package Folder>/shared_prefs/rx_sf_account.xml
<Package Folder>/shared_prefs/rx_sf_app.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_socialize.xml
<SD-Card>/Android/####/eb2d82c431253

Другие:

Запускает следующие shell-скрипты:

chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
sh

Загружает динамические библиотеки:

libjiagu

Использует следующие алгоритмы для шифрования данных:

AES-CBC-NoPadding

Использует следующие алгоритмы для расшифровки данных:

AES-CBC-NoPadding
DES

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Осуществляет доступ к информации об установленных приложениях.

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней