Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Spy.127.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pub.funs####.com:80
- TCP(HTTP/1.1) po.funs####.com:80
- TCP(HTTP/1.1) i####.funs####.com:80
- TCP(HTTP/1.1) m.i####.com:80
- TCP(HTTP/1.1) up####.v.qin####.com:80
- TCP(HTTP/1.1) s####.funs####.net:80
Запросы DNS:
- i####.funs####.com
- i####.funs####.com
- i####.funs####.com
- img.funs####.com
- m.i####.com
- pm.funs####.com
- po.funs####.com
- psi.funs####.com
- pu.funs####.com
- pub.funs####.com
- pv.funs####.com
- s####.funs####.net
- up####.funs####.com
Запросы HTTP GET:
- i####.funs####.com/sdw?oid=####&w=####&h=####
- m.i####.com/cfg/appkey-684f15fa71301257
- po.funs####.com/fpupdate/INI/config_update_funplayer.txt
- po.funs####.com/v5/config/cache?cl=####&ve=####
- po.funs####.com/v5/config/general?cl=####&ve=####
- po.funs####.com/v5/config/init?cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/config/log?cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/media/episode?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/media/play?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/media/profile?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/media/recommend?channel=####&pg=####&fudid=####&cl=##...
- po.funs####.com/v5/media/relate?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/site/mvsites?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/site/recommend?pg=####&type=####&cl=####&ve=####&mac=...
- po.funs####.com/v5/user/mediacomment?id=####&pg=####&cl=####&ve=####&mac...
- po.funs####.com/v5/user/platform?fudid=####&cl=####&ve=####&mac=####&uc=...
- po.funs####.com/v5/user/videocomment?id=####&pg=####&cl=####&ve=####&mac...
- po.funs####.com/v5/video/advance?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/video/play?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/video/profile?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v5/video/relate?id=####&cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v7/config/channel?cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v7/config/homepage?cl=####&ve=####&mac=####&uc=####
- po.funs####.com/v7/config/personal?fudid=####&pg=####&sz=####&cl=####&ve...
- pub.funs####.com/interface/deliver?ap=####&deliver_ver=####&uid=####&mac...
- pub.funs####.com/interface/materials?ap=####&client=####&uid=####&mac=##...
- s####.funs####.net/ecom_mobile/bootstrap?dev=####&ver=####&fudid=####&si...
- s####.funs####.net/ecom_mobile/fbuffer?dev=####&ver=####&fudid=####&sid=...
- s####.funs####.net/ecom_mobile/fplay?dev=aphone_4.3.1_<System Property>&...
- s####.funs####.net/ecom_mobile/play?dev=####&ver=####&fudid=####&sid=###...
- s####.funs####.net/ecom_mobile/servicehb?dev=####&ver=####&fudid=####&si...
- up####.v.qin####.com/img/applogin/platform_sina_light.png
- up####.v.qin####.com/img/applogin/platform_tencent_light.png
- up####.v.qin####.com/sdw?oid=####&w=####&h=####
Запросы HTTP POST:
- m.i####.com/rec/se?_iwt_t=####&sv=####
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/databases/_ire-journal
- <Package Folder>/databases/funshion.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/shared_prefs/MATSharedPreferences.xml
- <Package Folder>/shared_prefs/cn.com.mma.mobile.tracking.other.xml
- <Package Folder>/shared_prefs/fudid.xml
- <Package Folder>/shared_prefs/funshion.xml
- <Package Folder>/shared_prefs/funshion.xml.bak
- <Package Folder>/shared_prefs/jg_so_upgrade_setting.xml
- <Package Folder>/shared_prefs/peerid_config.xml
- <SD-Card>/.fudid
- <SD-Card>/funshion/####/0489f2f93adab1901e951813af0aa6c434c6bce4.cache
- <SD-Card>/funshion/####/1hlllexfjkqxlqxwoeev5byes.0.tmp
- <SD-Card>/funshion/####/1iiewxjsse8anq67scgjflzpa.0.tmp
- <SD-Card>/funshion/####/1umyeuu95wje3jezycw7gy91l.0.tmp
- <SD-Card>/funshion/####/220xq0s9u2quxu1eztm428mmx.0.tmp
- <SD-Card>/funshion/####/2hpldxt38wyr88f9h362aki1q.0.tmp
- <SD-Card>/funshion/####/2ndzqj10mtbyrr1wtaiwtywq4.0.tmp
- <SD-Card>/funshion/####/2s24wegn17tbdczguwodqlih7.0.tmp
- <SD-Card>/funshion/####/2s66ogs160qx6ji1y0xnpqdr2.0.tmp
- <SD-Card>/funshion/####/2zabasc22qjssv0s84uhvk1va.0.tmp
- <SD-Card>/funshion/####/3a83eed21b23c0d52ddb6a4fd1dc8d38a0ed036b.cache
- <SD-Card>/funshion/####/3aeuls6nci1jui3ylvdut7vu1.0.tmp
- <SD-Card>/funshion/####/3ilc7gx0inyjq8fg781qa0r2a.0.tmp
- <SD-Card>/funshion/####/3rxrdg0gxrbn0tc620tf7ee6x.0.tmp
- <SD-Card>/funshion/####/413tfu67eo1uwmbj8tk2o4ooy.0.tmp
- <SD-Card>/funshion/####/44dj9cu0l4cgpguzhdsh9n6uv.0.tmp
- <SD-Card>/funshion/####/4irsmi5ium0lizbglhrnvqehd.0.tmp
- <SD-Card>/funshion/####/4sc6efk9urt56pe5u6k8az0m4.0.tmp
- <SD-Card>/funshion/####/4xx1zjsh4zusi5yy1fbzids0d.0.tmp
- <SD-Card>/funshion/####/4yg6wgk5noob05utjrvkbn1i4.0.tmp
- <SD-Card>/funshion/####/52sg0zx4tabp7gabfqva21kop.0.tmp
- <SD-Card>/funshion/####/54a1dcb54b8ebc5af8d5472ea96117faa07eb6ee.cache
- <SD-Card>/funshion/####/55gdwwipn3rzrvdai8d2to9km.0.tmp
- <SD-Card>/funshion/####/5d9239e285198ec91c56c9971ae620c55f206ba0.cache
- <SD-Card>/funshion/####/5dhxptjv3ygod45xacjt6nbfl.0.tmp
- <SD-Card>/funshion/####/5xtqix3gcd332jhkl7pzhe8hx.0.tmp
- <SD-Card>/funshion/####/60lg1244lqdqhjtp8d5og1ga4.0.tmp
- <SD-Card>/funshion/####/61ct2cjolsctx1nbhcpl2woe4.0.tmp
- <SD-Card>/funshion/####/640gk1ltshj1fhssjgxqhpfzw.0.tmp
- <SD-Card>/funshion/####/65v65cze8nqo9h7su56xx4qfy.0.tmp
- <SD-Card>/funshion/####/68e01jod4wyiewz216ma4ftci.0.tmp
- <SD-Card>/funshion/####/6awwn4x42kdighw8ke40t1226.0.tmp
- <SD-Card>/funshion/####/6dhinhdr2qj5u38xcv8sz3zsd.0.tmp
- <SD-Card>/funshion/####/6f1byb1icm84ov9kl7jihwxd7.0.tmp
- <SD-Card>/funshion/####/6m99xj4kxl88jfxna6f28og7b.0.tmp
- <SD-Card>/funshion/####/6qg96610yks469l76j4z7fx3p.0.tmp
- <SD-Card>/funshion/####/6sd2ylrejm9r0kcqyf152zqrf.0.tmp
- <SD-Card>/funshion/####/6v8cbztq1sn9y8w7raf4ryij.0.tmp
- <SD-Card>/funshion/####/6x90chkakx05yqd2x9ugh0tom.0.tmp
- <SD-Card>/funshion/####/6z4eio8z4wj6mvgr0mf3q2imh.0.tmp
- <SD-Card>/funshion/####/74fo217yr9vwrpt0y42j9six1.0.tmp
- <SD-Card>/funshion/####/7gsq4226ri1smxxa76jhyi31n.0.tmp
- <SD-Card>/funshion/####/9719313f7b606f8a2d65d02c4cd5f0f2891a37ee.cache
- <SD-Card>/funshion/####/b509ef76c5fa5042c2668761024dd9f8ef07856f.cache
- <SD-Card>/funshion/####/c15013c78541b05498390dfe830a8e8a8f9abe6c.cache
- <SD-Card>/funshion/####/cache.rules.tmp
- <SD-Card>/funshion/####/config.ini.tmp
- <SD-Card>/funshion/####/da64962630433db0886c9480820d26a78e767966.cache
- <SD-Card>/funshion/####/db3f0bbe61d2922471349494763a6beef7320562.cache
- <SD-Card>/funshion/####/e95db16181edc6d615e613c8defbffbfac0066ff.cache
- <SD-Card>/funshion/####/f89141914d582b481ae97499570913647a92f1b6.cache
- <SD-Card>/funshion/####/funshion.ini
- <SD-Card>/funshion/####/funshion_aphone_3.5_afaf8a5f6389_20171116.log
- <SD-Card>/funshion/####/journal.tmp
- <SD-Card>/funshion/####/jqp3sfsv1j6x0w5amoas5dpg.0.tmp
- <SD-Card>/funshion/####/p2p_config.ini
- <SD-Card>/funshion/####/r36m8ewvjhyebinevk64cpx9.0.tmp
- <SD-Card>/funshion/####/sd2tuf7zkuoc1mxqpepu4lle.0.tmp
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- fsp2p
- libjiagu
- loginclient
- lsv
- mresearch
Использует следующие алгоритмы для шифрования данных:
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- DES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
