Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.589.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) w####.q####.dn.####.com:80
- TCP(HTTP/1.1) d2.ireader####.com:80
- TCP(HTTP/1.1) cdn.app.q####.####.com:80
- TCP(HTTP/1.1) d1.ireader####.com:80
- TCP(HTTP/1.1) pus.al####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) a####.you####.com:80
- TCP(HTTP/1.1) pss.al####.com:80
- TCP(HTTP/1.1) h####.ali####.com:80
- TCP(TLS/1.0) www.ireader####.com:443
- TCP(TLS/1.0) p####.q####.top:443
- TCP(TLS/1.0) pns.al####.com:443
Запросы DNS:
- a####.u####.com
- a####.you####.com
- cdn.app.q####.top
- d1.ireader####.com
- d2.ireader####.com
- feed####.u####.com
- h####.ali####.com
- oc.u####.com
- p####.q####.top
- pns.al####.com
- pss.al####.com
- pus.al####.com
- t####.qin####.com
- www.ireader####.com
Запросы HTTP GET:
- a####.you####.com/sx/GetConfigInfo.aspx?ver=####&passID=####&ver=####&cl...
- cdn.app.q####.####.com/sfile/spy139
- d1.ireader####.com/GoodBooks/Books/cover/2014-07-02/18c4c330-2ae8-4c00-b...
- d1.ireader####.com/GoodBooks/Books/cover/2014-12-29/904bbb11-26e9-4917-9...
- d1.ireader####.com/GoodBooks/Books/cover/2015-01-26/c96e50eb-498f-4cbc-9...
- d1.ireader####.com/GoodBooks/Books/cover/2015-03-23/91ccb6b3-1d47-41b9-8...
- d1.ireader####.com/GoodBooks/Books/cover/2015-03-23/bd4fee55-f0a2-4558-9...
- d1.ireader####.com/GoodBooks/Books/cover/2015-05-11/37a27099-f9f5-47c3-b...
- d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/06821e99-a65d-43c0-a...
- d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/b42045e5-0281-4024-a...
- d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/b4c82ec2-0fa6-4f43-a...
- d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/ca6d19ed-1ad5-426e-8...
- d1.ireader####.com/GoodBooks/Books/cover/2015-06-18/d61d3033-e53d-4d84-b...
- d1.ireader####.com/GoodBooks/Books/cover/2015-09-16/70274448-f887-4065-a...
- d1.ireader####.com/GoodBooks/Books/cover/2015-11-18/0152df18-68f3-4619-9...
- d1.ireader####.com/GoodBooks/Books/cover/2015-12-07/a517dfa8-ad49-4065-9...
- d1.ireader####.com/GoodBooks/Books/cover/2017-02-15/81e26afd-a47b-4010-9...
- d1.ireader####.com/GoodBooks/Books/cover/2017-02-28/1ea9c899-589b-45c5-8...
- d1.ireader####.com/GoodBooks/Books/cover/2017-05-22/5976d21f-af92-40f6-a...
- d1.ireader####.com/GoodBooks/Books/cover/2017-10-10/106c1f4d-c0f3-4af9-a...
- d1.ireader####.com/GoodBooks/Books/cover/2017-10-14/f7d38983-8309-43e4-a...
- d1.ireader####.com/GoodBooks/Books/cover/2017-11-03/55cc4671-f1c5-472b-b...
- d1.ireader####.com/GoodBooks/Books/cover/2017-11-03/b1c3703c-8c4c-47f6-9...
- d1.ireader####.com/GoodBooks/Books/cover/2017-11-08/78ffaae7-5314-49f7-8...
- d1.ireader####.com/GoodBooks/Books/cover/2017-11-10/27be66e6-1385-4dd4-8...
- d1.ireader####.com/GoodBooks/Books/cover/2017-11-13/c55ef960-f552-4536-9...
- d1.ireader####.com/GoodBooks/Books/cover/2017-12-12/8d03d8fb-3a57-4300-b...
- d2.ireader####.com/GoodBooks/Books/cover/2015-01-26/c96e50eb-498f-4cbc-9...
- d2.ireader####.com/GoodBooks/Books/cover/2015-03-19/1937d9e3-8a29-4d79-b...
- d2.ireader####.com/GoodBooks/Books/cover/2015-03-23/91ccb6b3-1d47-41b9-8...
- d2.ireader####.com/GoodBooks/Books/cover/2015-03-23/bd4fee55-f0a2-4558-9...
- d2.ireader####.com/GoodBooks/Books/cover/2015-04-02/138362b5-d80b-445f-a...
- d2.ireader####.com/GoodBooks/Books/cover/2015-05-11/37a27099-f9f5-47c3-b...
- d2.ireader####.com/GoodBooks/Books/cover/2015-06-18/06821e99-a65d-43c0-a...
- d2.ireader####.com/GoodBooks/Books/cover/2015-06-18/62743aba-67fc-41b0-8...
- d2.ireader####.com/GoodBooks/Books/cover/2015-06-18/8c9ece61-ba4f-405e-8...
- d2.ireader####.com/GoodBooks/Books/cover/2015-06-18/b4c82ec2-0fa6-4f43-a...
- d2.ireader####.com/GoodBooks/Books/cover/2015-09-23/b419c4d0-2588-467f-9...
- d2.ireader####.com/GoodBooks/Books/cover/2015-10-14/a1f2c72f-1388-4058-a...
- d2.ireader####.com/GoodBooks/Books/cover/2015-11-05/172d59af-c0b4-4657-a...
- d2.ireader####.com/GoodBooks/Books/cover/2015-12-18/0afcda15-7050-437a-9...
- d2.ireader####.com/GoodBooks/Books/cover/2015-12-18/7ec29d40-06ef-4681-9...
- d2.ireader####.com/GoodBooks/Books/cover/2017-01-18/70145e17-f3ec-4e4f-a...
- d2.ireader####.com/GoodBooks/Books/cover/2017-06-12/d4ce3995-472a-4d0f-a...
- d2.ireader####.com/GoodBooks/Books/cover/2017-08-18/51642350-d17b-4982-9...
- d2.ireader####.com/GoodBooks/Books/cover/2017-09-22/ceb584bf-6243-4c4a-9...
- d2.ireader####.com/GoodBooks/Books/cover/2017-12-12/8d03d8fb-3a57-4300-b...
- d2.ireader####.com/GoodBooks/Books/cover/2017-12-18/277ebeaf-381f-4d85-9...
- pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
- w####.q####.dn.####.com/sxsplash20160727_579817d469bca.jpg
- w####.q####.dn.####.com/sxsplash20160727_579817da499fb.jpg
- w####.q####.dn.####.com/sxsplash20160727_579817de0f457.jpg
- w####.q####.dn.####.com/sxsplash20160727_579817e1da72a.jpg
- w####.q####.dn.####.com/sxsplash20160727_57981808344f4.jpg
Запросы HTTP POST:
- a####.u####.com/app_logs
- h####.ali####.com/mobile_wap_adv/get_aid/?auth[token]=####&type=####&id=...
- oc.u####.com/check_config_update
- pss.al####.com/iku/log/acc
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_libs/libpcdn_acc.zip
- <Package Folder>/app_libs/libpcdn_acc_new.so
- <Package Folder>/app_sslcache/www.ireadercity.com.443
- <Package Folder>/databases/aireader_v2-journal
- <Package Folder>/databases/ireader.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/x_hup.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/wv_web_info.dat
- <Package Folder>/files/.imprint
- <Package Folder>/files/c.jar
- <Package Folder>/files/mobclick_agent_cached_<Package>2018030214
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/OfJbkLdFbPOMbGyP.xml
- <Package Folder>/shared_prefs/ar.xml
- <Package Folder>/shared_prefs/com_ireader_city_you_qi.xml
- <Package Folder>/shared_prefs/isfirst.xml
- <Package Folder>/shared_prefs/jg_so_upgrade_setting.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/ni.xml
- <Package Folder>/shared_prefs/pcdnconfigs.xml
- <Package Folder>/shared_prefs/tlfcez.xml
- <Package Folder>/shared_prefs/umeng_feedback_conversations.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/umeng_socialize_qq.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/AIReader/####/02f59604fb4841ab84e3014893aac035jpgx.tmp
- <SD-Card>/AIReader/####/09b13660f31d472590cf559825874817jpgx.tmp
- <SD-Card>/AIReader/####/1b5db2b0f7434c3d98bacf7c2072f88djpgx.tmp
- <SD-Card>/AIReader/####/2b8aa43edb324de080d65706d63aaa44jpgx.tmp
- <SD-Card>/AIReader/####/39b37d24209d492d86f160187767ed8bjpgx.tmp
- <SD-Card>/AIReader/####/3b7bb85860ac4346b0b23f3288d40795jpgx_bak
- <SD-Card>/AIReader/####/3d1f32865a544955bb12f70094ac9d85jpgx.tmp
- <SD-Card>/AIReader/####/40d70a2475434795bbd3b0d62355397ejpgx.tmp
- <SD-Card>/AIReader/####/4c2aaf4a825e488aa7113f66f20607a0jpgx.tmp
- <SD-Card>/AIReader/####/4cb4d390cbd64edd80ee8c9936c85e7fjpgx.tmp
- <SD-Card>/AIReader/####/52447279f4e64f82a9ace87cd8edb682jpgx.tmp
- <SD-Card>/AIReader/####/53ab334310044ae6ae5e9bc6726858dejpgx.tmp
- <SD-Card>/AIReader/####/5c08ab724af043189951d1b3c3704e96jpgx.tmp
- <SD-Card>/AIReader/####/646d9d6ae5ae44849b7ec990dc67b40ajpgx.tmp
- <SD-Card>/AIReader/####/6518257fdafe4d7f976926e91449a24ejpgx.tmp
- <SD-Card>/AIReader/####/6fe1b7bba7784e99affacffdf51397a8jpgx.tmp
- <SD-Card>/AIReader/####/744e634b119e4de08f4a9cc2250f110bjpgx.tmp
- <SD-Card>/AIReader/####/760094a0e0b948d5b2dad5691d17b34fjpgx.tmp
- <SD-Card>/AIReader/####/767ee0ade7914065a974d34d228670dejpgx.tmp
- <SD-Card>/AIReader/####/7e0d092cc83a4fb785cf4e592a7ca038jpgx_bak
- <SD-Card>/AIReader/####/7e0d092cc83a4fb785cf4e592a7ca038jpgx_bak (deleted)
- <SD-Card>/AIReader/####/7fe1a95fd725482dad4d49f135c0b561jpgx.tmp
- <SD-Card>/AIReader/####/818f972cb5644916b8e3a3a900716fd1jpgx.tmp
- <SD-Card>/AIReader/####/81afa8789543424cbb564cdc157767b4jpgx.tmp
- <SD-Card>/AIReader/####/838e83b6cc81464bbcc94192696b20cfjpgx.tmp
- <SD-Card>/AIReader/####/889b5f7177c6404099b9ee787d25d0b1jpgx.tmp
- <SD-Card>/AIReader/####/8feb490540684b2ea5768a56a4d04579jpgx.tmp
- <SD-Card>/AIReader/####/9346d41a5fbf415fad8082850fdfbb7fjpgx.tmp
- <SD-Card>/AIReader/####/9fa04d71df9c4f25a59f46305db05820jpgx_bak
- <SD-Card>/AIReader/####/DEVICE.txt
- <SD-Card>/AIReader/####/adv_self_config.dat
- <SD-Card>/AIReader/####/b74da5b9150e4b3085e91581b36a49ebjpgx.tmp
- <SD-Card>/AIReader/####/b7d3d9bfdab849c09d55d1cbf887473djpgx_bak
- <SD-Card>/AIReader/####/bad7fb351460463cbc58cecbe6b3f744jpgx.tmp
- <SD-Card>/AIReader/####/c396884f31bd4bb0b32ef7ea0ce808cdjpgx.tmp
- <SD-Card>/AIReader/####/c52c4e22fdc94c008ee1ad14d3e3d00cjpgx.tmp
- <SD-Card>/AIReader/####/c69a1370a44149b5b0d0bce9be4ce1b4jpgx.tmp
- <SD-Card>/AIReader/####/ca84bbe39a4745babc4ed227265450fejpgx.tmp
- <SD-Card>/AIReader/####/cc5c483f668f40499dafcbc617997529jpgx.tmp
- <SD-Card>/AIReader/####/config.data
- <SD-Card>/AIReader/####/d4df77c8161942899bd11597f4e5b29fjpgx.tmp
- <SD-Card>/AIReader/####/da08e89424f043c0bbf094905a35ccc4jpgx.tmp
- <SD-Card>/AIReader/####/ff0e1508d70d4f66805081cb05a40590jpgx.tmp
- <SD-Card>/AIReader/####/home_infos_22.dat
- <SD-Card>/AIReader/####/import.dat
- <SD-Card>/AIReader/####/releated_list_02f59604fb4841ab84e3014893aac035.dat
- <SD-Card>/AIReader/####/releated_list_744e634b119e4de08f4a9cc2250f110b.dat
- <SD-Card>/AIReader/####/releated_list_9346d41a5fbf415fad8082850fdfbb7f.dat
- <SD-Card>/AIReader/####/releated_list_b7d3d9bfdab849c09d55d1cbf887473d.dat
- <SD-Card>/AIReader/####/sxsplash20160727_579817d469bca.jpgx
- <SD-Card>/AIReader/####/sxsplash20160727_579817da499fb.jpgx
- <SD-Card>/AIReader/####/sxsplash20160727_579817de0f457.jpgx
- <SD-Card>/AIReader/####/sxsplash20160727_579817e1da72a.jpgx
- <SD-Card>/AIReader/####/sxsplash20160727_57981808344f4.jpgx
Другие:
Загружает динамические библиотеки:
- libjiagu
- libpcdn_acc
- pcdn_acc
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о запущенных приложениях.
Осуществляет доступ к информации о зарегистрированных на устройстве аккаунтах (Google, Facebook и тд.).
Отрисовывает собственные окна поверх других приложений.
