Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Spy.127.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pub.funs####.com:80
- TCP(HTTP/1.1) po.funs####.com:80
- TCP(HTTP/1.1) i####.funs####.com:80
- TCP(HTTP/1.1) m.i####.com:80
- TCP(HTTP/1.1) up####.v.qin####.com:80
- TCP(HTTP/1.1) s####.funs####.net:80
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) g####.qq.com:443
Запросы DNS:
- g####.qq.com
- i####.funs####.com
- i####.funs####.com
- i####.funs####.com
- img.funs####.com
- m.i####.com
- pm.funs####.com
- po.funs####.com
- psi.funs####.com
- pu.funs####.com
- pub.funs####.com
- pv.funs####.com
- s####.funs####.net
- up####.funs####.com
- www.go####.com
Запросы HTTP GET:
- i####.funs####.com/sdw?oid=####&w=####&h=####
- m.i####.com/cfg/appkey-684f15fa71301257
- po.funs####.com/fpupdate/INI/config_update_funplayer.txt
- po.funs####.com/v5/config/cache?cl=####&ve=####
- po.funs####.com/v5/config/general?cl=####&ve=####
- po.funs####.com/v5/config/init?cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/config/log?cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/media/episode?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/media/play?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/media/profile?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/media/recommend?channel=####&pg=####&fudid=####&cl=##...
- po.funs####.com/v5/media/relate?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/site/mvsites?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/site/recommend?pg=####&type=####&cl=####&ve=####&mac=...
- po.funs####.com/v5/user/mediacomment?id=####&pg=####&cl=####&ve=####&mac...
- po.funs####.com/v5/user/platform?fudid=####&cl=####&ve=####&mac=####&uc=...
- po.funs####.com/v5/user/videocomment?id=####&pg=####&cl=####&ve=####&mac...
- po.funs####.com/v5/video/advance?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/video/play?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/video/profile?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/video/recommend?channel=####&fudid=####&cl=####&ve=##...
- po.funs####.com/v5/video/relate?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v7/config/channel?cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v7/config/homepage?cl=####&ve=####&mac=####&uc=####
- pub.funs####.com/interface/deliver?ap=####&deliver_ver=####&uid=####&mac...
- pub.funs####.com/interface/materials?ap=####&client=####&uid=####&mac=##...
- s####.funs####.net/ecom_mobile/bootstrap?dev=####&ver=####&fudid=####&si...
- s####.funs####.net/ecom_mobile/fbuffer?dev=####&ver=####&fudid=####&sid=...
- s####.funs####.net/ecom_mobile/fplay?dev=aphone_4.3.1_<System Property>&...
- s####.funs####.net/ecom_mobile/play?dev=####&ver=####&fudid=####&sid=###...
- s####.funs####.net/ecom_mobile/servicehb?dev=####&ver=####&fudid=####&si...
- up####.v.qin####.com/img/applogin/platform_sina_light.png
- up####.v.qin####.com/img/applogin/platform_tencent_light.png
- up####.v.qin####.com/sdw?oid=####&w=####&h=####
Запросы HTTP POST:
- m.i####.com/rec/se?_iwt_t=####&sv=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/index
- <Package Folder>/databases/_ire-journal
- <Package Folder>/databases/funshion.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/shared_prefs/MATSharedPreferences.xml
- <Package Folder>/shared_prefs/cn.com.mma.mobile.tracking.other.xml
- <Package Folder>/shared_prefs/fudid.xml
- <Package Folder>/shared_prefs/funshion.xml
- <Package Folder>/shared_prefs/funshion.xml.bak
- <Package Folder>/shared_prefs/jg_so_upgrade_setting.xml
- <Package Folder>/shared_prefs/peerid_config.xml
- <SD-Card>/.fudid
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/funshion/####/0a6674ad2ed76e41d5c811ec13aeedefdb4723cc.cache
- <SD-Card>/funshion/####/14atpxpa7gdekmru2k3ktoir1.0.tmp
- <SD-Card>/funshion/####/1510835267_38266_null.dat
- <SD-Card>/funshion/####/1510835281_52137_null.dat
- <SD-Card>/funshion/####/155mwo9ubb77wpeszixpsr2g0.0.tmp
- <SD-Card>/funshion/####/1argodtbl9xmxufcm2inr8m6m.0.tmp
- <SD-Card>/funshion/####/1c00b298e3f1d10925ffcf88f6873b5670ca9880.cache
- <SD-Card>/funshion/####/1derl1em2egxkf6trjddc8nhq.0.tmp
- <SD-Card>/funshion/####/1trzgb04byouebu8q9of2urc9.0.tmp
- <SD-Card>/funshion/####/1u9mrmxdkfe5gqtn23im5olnw.0.tmp
- <SD-Card>/funshion/####/1umyeuu95wje3jezycw7gy91l.0.tmp
- <SD-Card>/funshion/####/1zwm846uswu7i0qhkoxtvq9si.0.tmp
- <SD-Card>/funshion/####/21bwvgryriicuano5rbgryib.0.tmp
- <SD-Card>/funshion/####/220xq0s9u2quxu1eztm428mmx.0.tmp
- <SD-Card>/funshion/####/267dl6zotuj3zvn25ol3vhqix.0.tmp
- <SD-Card>/funshion/####/2bxeln9nts4uwgenkrzblh6qo.0.tmp
- <SD-Card>/funshion/####/2c2b78ccdd018195a0ee1710c920091e67c15788.cache
- <SD-Card>/funshion/####/2cpgf33qq88wlt6r12u8mzlxa.0.tmp
- <SD-Card>/funshion/####/2hpldxt38wyr88f9h362aki1q.0.tmp
- <SD-Card>/funshion/####/2mkvqw67jnmhiav7v45z3mpsj.0.tmp
- <SD-Card>/funshion/####/2ndzqj10mtbyrr1wtaiwtywq4.0.tmp
- <SD-Card>/funshion/####/2s24wegn17tbdczguwodqlih7.0.tmp
- <SD-Card>/funshion/####/2skq8mpl3kd2bwecxwyr9k45a.0.tmp
- <SD-Card>/funshion/####/2syvityh2vg06bpg5rttsl3r9.0.tmp
- <SD-Card>/funshion/####/30dnfd8wsawai5d0ve84hnh6m.0.tmp
- <SD-Card>/funshion/####/381f1753420bbe1aa5183c55b8eb6f277fde556e.cache
- <SD-Card>/funshion/####/3e6bc416b87c4e02e23d192f0d5acecc3086524b.cache
- <SD-Card>/funshion/####/3fz0e4xms1ijys9jy29qtuzau.0.tmp
- <SD-Card>/funshion/####/3jge2mt2q146rx3c9tbuvr481.0.tmp
- <SD-Card>/funshion/####/3rxrdg0gxrbn0tc620tf7ee6x.0.tmp
- <SD-Card>/funshion/####/3shb7czjb27a2j411qfido0op.0.tmp
- <SD-Card>/funshion/####/446m5ac77lojyzgri28wy3o18.0.tmp
- <SD-Card>/funshion/####/44dj9cu0l4cgpguzhdsh9n6uv.0.tmp
- <SD-Card>/funshion/####/44s97i7fuloxz5grvmxax6yfw.0.tmp
- <SD-Card>/funshion/####/474fc6c740ad538d29490dab630a3fdf8bcc5211.cache
- <SD-Card>/funshion/####/4irsmi5ium0lizbglhrnvqehd.0.tmp
- <SD-Card>/funshion/####/4nkvif8wjsxuwyvhcjz8vb8u6.0.tmp
- <SD-Card>/funshion/####/4nraf7kyia92aub7i4os7pi6s.0.tmp
- <SD-Card>/funshion/####/4xiycszozary6k44b2smd4dpy.0.tmp
- <SD-Card>/funshion/####/55614z9f6odqv57m5used4y5g.0.tmp
- <SD-Card>/funshion/####/55bl3yxwl08bzp1wamr255k0m.0.tmp
- <SD-Card>/funshion/####/5dhxptjv3ygod45xacjt6nbfl.0.tmp
- <SD-Card>/funshion/####/5gnz0kcpvll5zmde1zquz4u6m.0.tmp
- <SD-Card>/funshion/####/61ct2cjolsctx1nbhcpl2woe4.0.tmp
- <SD-Card>/funshion/####/61rfw7h1xzggqi464u9p5t71d.0.tmp
- <SD-Card>/funshion/####/640gk1ltshj1fhssjgxqhpfzw.0.tmp
- <SD-Card>/funshion/####/6481c36b04fe46550d58c45c4da40d33e1cf38ab.cache
- <SD-Card>/funshion/####/6f1byb1icm84ov9kl7jihwxd7.0.tmp
- <SD-Card>/funshion/####/6sd2ylrejm9r0kcqyf152zqrf.0.tmp
- <SD-Card>/funshion/####/6utbe519829vmqxx0flzm1la8.0.tmp
- <SD-Card>/funshion/####/77zruqwjailv6yhm9jbkrn6yh.0.tmp
- <SD-Card>/funshion/####/7b2muli1tnx1r56jjnnmqukxl.0.tmp
- <SD-Card>/funshion/####/7gsq4226ri1smxxa76jhyi31n.0.tmp
- <SD-Card>/funshion/####/7j3faq39gfsyuu8ndisw9i7l.0.tmp
- <SD-Card>/funshion/####/7kh6lr2qpagkr4mqlqxl9ybz3.0.tmp
- <SD-Card>/funshion/####/824e7245390c063feeace347d11e48ef1ab3fc5e.cache
- <SD-Card>/funshion/####/83bd243beab385b59a598a3b0a3d11ad5a9426d9.cache
- <SD-Card>/funshion/####/8f46e6f5d8062fd5cc07e04a0988afb46868be50.cache
- <SD-Card>/funshion/####/995cf0cab321b88081ab024cca3cbe30112a2d20.cache
- <SD-Card>/funshion/####/bfd9594690d439877eeba39a70d30dd03c0e4997.cache
- <SD-Card>/funshion/####/cache.rules.tmp
- <SD-Card>/funshion/####/config.ini.tmp
- <SD-Card>/funshion/####/d547016879dd690a8a4ace555181209217e2eb98.cache
- <SD-Card>/funshion/####/e2a2332a8c5cefc363688a5df8660a8c8148ad15.cache
- <SD-Card>/funshion/####/f0407c1e8d3e3e5ff9c6a93d5b87481eb7b9e683.cache
- <SD-Card>/funshion/####/funshion.ini
- <SD-Card>/funshion/####/funshion_aphone_5.8_afaf2c0bb710_20171116.log
- <SD-Card>/funshion/####/j1lvbkg7247ueytbyeglq2ls.0.tmp
- <SD-Card>/funshion/####/journal.tmp
- <SD-Card>/funshion/####/jqp3sfsv1j6x0w5amoas5dpg.0.tmp
- <SD-Card>/funshion/####/p2p_config.ini
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- fsp2p
- libjiagu
- loginclient
- lsv
- mresearch
Использует следующие алгоритмы для шифрования данных:
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- DES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
