Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.3422
- Android.DownLoader.657.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) h####.a####.com:80
- TCP(HTTP/1.1) kvt####.m####.a####.com:80
- TCP(HTTP/1.1) www.a####.com.####.com:80
- TCP(HTTP/1.1) ip.ta####.com:80
- TCP(HTTP/1.1) nb4052-####.a####.com:80
- TCP(HTTP/1.1) nb3201-####.a####.com:80
- TCP(HTTP/1.1) cs227-####.a####.com:80
- TCP(HTTP/1.1) c47.a####.com:80
- TCP(HTTP/1.1) 47.92.1####.96:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) nb3200-####.a####.com:80
- TCP(HTTP/1.1) nb4050-####.a####.com:80
- TCP(HTTP/1.1) cs229-####.a####.com:80
- TCP(HTTP/1.1) d14uy7w####.cloudf####.net:80
- TCP(HTTP/1.1) nb4051-####.a####.com:80
- TCP(HTTP/1.1) nb4520-####.a####.com:80
- TCP(HTTP/1.1) fu1.a####.com:80
- TCP(HTTP/1.1) cdn.game####.org:80
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) z####.l####.top:443
Запросы DNS:
- a####.u####.com
- c47.a####.com
- cdn.game####.org
- cs227-####.a####.com
- cs229-####.a####.com
- d14uy7w####.cloudf####.net
- fu1.a####.com
- h####.a####.com
- h####.a####.com
- ip.ta####.com
- kvt####.m####.a####.com
- log.u####.com
- m####.a####.com
- m.a####.com
- nb3200-####.a####.com
- nb3201-####.a####.com
- nb4050-####.a####.com
- nb4051-####.a####.com
- nb4052-####.a####.com
- nb4520-####.a####.com
- nb4520-####.a####.com
- policyc####.a####.com
- res.we####.cn
- s####.u####.com
- so.a####.com
- www.a####.com
- x####.a####.com
- z####.l####.top
Запросы HTTP GET:
- c47.a####.com/user/168/19783168/1005/card/47562727/47562727_800.jpg
- c47.a####.com/user/9/10613009/1005/card/47563988/47563988_800.jpg
- cdn.game####.org/strategy/base
- cdn.game####.org/strategy/loss_4.3
- cdn.game####.org/strategy/sul18
- cs227-####.a####.com/user/448/64609448/1005/card/47571780/47571780_800.jpg
- cs229-####.a####.com/user/168/19783168/1005/card/47582821/47582821_800.jpg
- d14uy7w####.cloudf####.net/download/key
- fu1.a####.com/account/168/19783168/account/19783168_normal.jpg
- fu1.a####.com/account/364/7495364/account/7495364_normal.jpg
- fu1.a####.com/account/448/64609448/account/64609448_normal.jpg
- fu1.a####.com/account/577/28797577/account/28797577_normal.jpg
- fu1.a####.com/account/836/6395836/account/6395836_normal.jpg
- fu1.a####.com/account/87/35755087/account/35755087_normal.jpg
- fu1.a####.com/account/9/10613009/account/10613009_normal.jpg
- fu1.a####.com/account/92/22433092/account/22433092_normal.jpg
- fu1.a####.com/account/934/57088934/account/57088934_normal.jpg
- h####.a####.com/user/168/19783168/1005/card/47562727/47562727_800.jpg
- h####.a####.com/user/168/19783168/1005/card/47582821/47582821_800.jpg
- h####.a####.com/user/448/64609448/1005/card/47571780/47571780_800.jpg
- h####.a####.com/user/577/28797577/1006/card/47612557/47612557_800.jpg
- h####.a####.com/user/9/10613009/1005/card/47511471/47511471_800.jpg
- h####.a####.com/user/9/10613009/1005/card/47552931/47552931_800.jpg
- h####.a####.com/user/9/10613009/1005/card/47563988/47563988_800.jpg
- h####.a####.com/user/9/10613009/1005/card/47563988/card.mp4?l=####
- ip.ta####.com/service/getIpInfo2.php?ip=####
- kvt####.m####.a####.com/kvinfo.php
- nb3200-####.a####.com/user/9/10613009/1005/card/47563988/47563988_800.jpg
- nb3201-####.a####.com/user/9/10613009/1005/card/47511471/47511471_800.jpg
- nb3201-####.a####.com/user/9/10613009/1005/card/47563988/card.mp4?l=####...
- nb4050-####.a####.com/user/168/19783168/1005/card/47562727/47562727_800....
- nb4051-####.a####.com/user/9/10613009/1005/card/47552931/47552931_800.jpg
- nb4052-####.a####.com/user/9/10613009/1005/card/47552931/47552931_800.jpg
- nb4520-####.a####.com/user/577/28797577/1006/card/47612557/47612557_800....
- nb4520-####.a####.com/user/9/10613009/1005/card/47563988/47563988_800.jpg
- www.a####.com.####.com/api/aipaiApp_action-getCommentNew_mobile-1_type-2...
- www.a####.com.####.com/api/framework/conf/19?appver=####&os=####&version...
- www.a####.com.####.com/api/hot/bannerItem/355?appver=####&os=####&versio...
- www.a####.com.####.com/api/hot/titleItem/356?appver=####&os=####&version...
- www.a####.com.####.com/api/hot/videos/3045?appId=####&xifenId=####&appve...
- www.a####.com.####.com/api/search/searchWord/19?appver=####&os=####&vers...
- www.a####.com.####.com/api/specialTopic/itemList/358?appver=####&os=####...
- www.a####.com.####.com/api/star/list/3045?appId=####&xifenId=####&appver...
- www.a####.com.####.com/app/www/templates/cdn_policy_telecom.txt?appver=#...
- www.a####.com.####.com/common/img/upload/xifen/1480331697_834.png
- www.a####.com.####.com/common/img/upload/xifen/1480331730_72.png
- www.a####.com.####.com/common/img/upload/xifen/1480384995_717.png
- www.a####.com.####.com/common/img/upload/xifen/1480385031_108.png
- www.a####.com.####.com/common/img/upload/xifen/1480385282_467.png
- www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&app=##...
- www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&appver...
- www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&os=###...
- www.a####.com.####.com/mobile/apps/apps.php?module=####&func=####&test=#...
- www.a####.com.####.com/mobile/apps/apps_module-badDomain.html
- www.a####.com.####.com/pc/operator
Запросы HTTP POST:
- a####.u####.com/app_logs
- kvt####.m####.a####.com/i.gif
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_9e76b482-9561-404a-9bd6-f098eae22c82/Matrix
- <Package Folder>/app_9e76b482-9561-404a-9bd6-f098eae22c82/ddexe
- <Package Folder>/app_9e76b482-9561-404a-9bd6-f098eae22c82/debuggerd
- <Package Folder>/app_9e76b482-9561-404a-9bd6-f098eae22c82/fileWork
- <Package Folder>/app_9e76b482-9561-404a-9bd6-f098eae22c82/insta...ery.sh
- <Package Folder>/app_9e76b482-9561-404a-9bd6-f098eae22c82/pidof
- <Package Folder>/app_9e76b482-9561-404a-9bd6-f098eae22c82/su
- <Package Folder>/app_9e76b482-9561-404a-9bd6-f098eae22c82/supolicy
- <Package Folder>/app_9e76b482-9561-404a-9bd6-f098eae22c82/toolbox
- <Package Folder>/app_9e76b482-9561-404a-9bd6-f098eae22c82/wsroot.sh
- <Package Folder>/app_f7a7be1b-d94f-44ac-8901-c92fa00e08b2/1852e...14.jar
- <Package Folder>/app_priv_res/80683bf6-cc2b-4084-bf81-d178676e88da
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_subox_download/66aa09f4-a54e-4263-86b0-e455273fe83b
- <Package Folder>/app_subox_download/67e024e9-4828-4654-b5fd-52a40e6c68a7
- <Package Folder>/app_subox_download/da9decea-265e-4504-b943-6956caebcb38
- <Package Folder>/cache/####/0606f3787b644f32c867242d6877947d454....0.tmp
- <Package Folder>/cache/####/0c059e6b424f3138908ffa217fda6bc74c3....0.tmp
- <Package Folder>/cache/####/1e172f939014c6e55ed563ffd21d930f4c5....0.tmp
- <Package Folder>/cache/####/3530738829593be50681735664be629d5c7....0.tmp
- <Package Folder>/cache/####/38d232128bf997ec2ff128b9cc61ac5bca9....0.tmp
- <Package Folder>/cache/####/6abd5560813033afa12c2e5fb7c8a4778e9....0.tmp
- <Package Folder>/cache/####/7149b0557521ffbfeb4172b1cbb1e4d5ca8....0.tmp
- <Package Folder>/cache/####/7261720ee32cb112415d5bfbe37bf52fad9....0.tmp
- <Package Folder>/cache/####/8afd34cf115859c435f51aa4b5150866446....0.tmp
- <Package Folder>/cache/####/8d0add469edd64a51aee5b27a4a4124391c....0.tmp
- <Package Folder>/cache/####/8fb855636d6af48d5d3d9fab9f748311e3a....0.tmp
- <Package Folder>/cache/####/96219ab8b935b0fd41c265452e6796ab890....0.tmp
- <Package Folder>/cache/####/ab44a9143915e146bb987f097dbc844b689....0.tmp
- <Package Folder>/cache/####/ada8b5f34922dc9db7da5e2014404081e2a....0.tmp
- <Package Folder>/cache/####/add4e6ea4c5621e37ad160783a5a4aa432d....0.tmp
- <Package Folder>/cache/####/b15f846becd7dbe6d09c0135a7ea02cbfd0....0.tmp
- <Package Folder>/cache/####/ba8fbd85df8a009128c6cc6252b7900fbcd....0.tmp
- <Package Folder>/cache/####/ca257792088b768c9c8dab9d79b441d292d....0.tmp
- <Package Folder>/cache/####/e48119de671f8678b2710f15d80f452d301....0.tmp
- <Package Folder>/cache/####/e76292b8652c35fff43d409b168a2a0f989....0.tmp
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.0.tmp
- <Package Folder>/cache/e0888850d29ef11a195e5b377efd4265.1.tmp
- <Package Folder>/cache/journal.tmp
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/config.json
- <Package Folder>/files/####/exchangeIdentity.json
- <Package Folder>/files/.imprint
- <Package Folder>/files/6.jar
- <Package Folder>/files/RptKVStrategy.txt
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/files/aipai.guid
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/CookiePersistence.xml
- <Package Folder>/shared_prefs/com.tjtrtzhtz.tjxrt.yf.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/rx_sf_account.xml
- <Package Folder>/shared_prefs/rx_sf_app.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_socialize.xml
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
Загружает динамические библиотеки:
- libjiagu
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
- DES
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
