Adware.Kyview.29

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Adware.Kyview.2.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) up####.sdk.jig####.cn:80
TCP(HTTP/1.1) cf.gdata####.net:80
TCP(TLS/1.0) 1####.217.17.142:443
TCP(TLS/1.0) co####.ad####.cn:443
TCP(TLS/1.0) s####.j####.cn:443
TCP(TLS/1.0) d####.iap####.com:443
UDP s.j####.cn:19000
TCP 1####.121.49.92:7005

Запросы DNS:

cf.gdata####.net
co####.ad####.cn
d####.iap####.com
rd.gdata####.net
s####.j####.cn
s.j####.cn
up####.sdk.jig####.cn

Запросы HTTP POST:

cf.gdata####.net/config/update
cf.gdata####.net/dc/sync_adr
up####.sdk.jig####.cn/v1/push/sdk/postlist

Изменения в файловой системе:

Создает следующие файлы:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_bin/daemon
<Package Folder>/databases/dataeye_database_A47833B2618B7365387...FC1.db
<Package Folder>/databases/dataeye_database_A47833B2618B7365387...ournal
<Package Folder>/databases/google_app_measurement_local.db
<Package Folder>/databases/google_app_measurement_local.db-journal
<Package Folder>/databases/jpush_local_notification.db
<Package Folder>/databases/jpush_local_notification.db-journal
<Package Folder>/databases/jpush_local_notification.db-wal
<Package Folder>/databases/jpush_statistics.db
<Package Folder>/databases/jpush_statistics.db-journal
<Package Folder>/databases/jpush_statistics.db-shm (deleted)
<Package Folder>/databases/jpush_statistics.db-wal
<Package Folder>/databases/myDB
<Package Folder>/databases/myDB-journal
<Package Folder>/databases/securityguard_database_A47833B2618B7...FC1.db
<Package Folder>/databases/securityguard_database_A47833B2618B7...ournal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/appPackageNames
<Package Folder>/files/jpush_stat_cache.json
<Package Folder>/files/jpush_stat_cache_history.json
<Package Folder>/no_backup/com.google.android.gms.appid-no-backup
<Package Folder>/shared_prefs/<Package>_preferences.xml
<Package Folder>/shared_prefs/JPushSA_Config.xml
<Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml
<Package Folder>/shared_prefs/cn.jpush.preferences.v2.rid.xml
<Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml
<Package Folder>/shared_prefs/com.google.android.gms.appid.xml
<Package Folder>/shared_prefs/com.google.android.gms.measurement.prefs.xml
<Package Folder>/shared_prefs/dc.A47833B2618B7365387CB2C350D3EF...es.xml
<Package Folder>/shared_prefs/dc.global.prfrerence.xml
<Package Folder>/shared_prefs/iapppay_config.xml
<Package Folder>/shared_prefs/jpush_device_info.xml
<Package Folder>/shared_prefs/sg.A47833B2618B7365387CB2C350D3EF...es.xml
<Package Folder>/shared_prefs/statistics_preference.xml
<SD-Card>/.SystemService/####/2D7F07BB6125DEB407E92A22DC4AC550
<SD-Card>/.SystemService/####/uid
<SD-Card>/.SystemService/appids.dat
<SD-Card>/data/.push_deviceid
<SD-Card>/iapppay/####/1510833298109.log
<SD-Card>/iapppay/####/1510833298109.log (deleted)

Другие:

Запускает следующие shell-скрипты:

/system/bin/sh
cat /sys/class/net/wlan0/address
chmod 755 <Package Folder>/.jiagu/libjiagu.so
chmod 777 <Package Folder>/app_bin/daemon
ls -l /sbin/su
ls -l /system/bin/su
ls -l /system/sbin/su
ls -l /system/xbin/su
ls -l /vendor/bin/su
mars_d -p <Package> -s com.security.guard.monitor.daemon.AssistantService -p1r 41 -p1w 42 -p2r 43 -p2w 44

Загружает динамические библиотеки: