Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Gexin.1.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) s####.j####.cn:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) t.q####.cn:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) api.18t####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) w####.18t####.com.####.com:80
- TCP(TLS/1.0) h####.b####.com.####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP 1####.229.215.30:7002
- UDP s.j####.cn:19000
Запросы DNS:
- a####.u####.com
- api.18t####.com
- c####.mm####.com
- c.c####.com
- h####.b####.com
- h####.c####.com
- hm.b####.com
- m.18t####.com
- qn.18t####.com
- rpc.api.18t####.com
- s####.j####.cn
- s.j####.cn
- s11.c####.com
- t3.q####.cn
- www.18t####.com
- www.go####.com
Запросы HTTP GET:
- api.18t####.com/?c=####&a=####&apitype=####&post_id=####&callback=####&_...
- api.18t####.com/?c=####&a=####&app=####&act=####&vs=####&url=/ap####&a=#...
- api.18t####.com/?c=####&a=####&dk=####&ak=####
- api.18t####.com/index.php?c=####&a=####&ids=####&dk=####&ak=####
- api.18t####.com/index.php?c=####&a=####&summary=####&helper=####&tag=###...
- api.18t####.com/posts/get_post_info?id=####&callback=####&_=####
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/stat.php?id=####&web_id=####
- gm.mm####.com/9.gif?abc=####&rnd=####
- hm.b####.com/h.js?6b0d092####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?6b0d092####
- t####.c####.q####.####.com/avatar/2835038/1444977585.jpg
- t####.c####.q####.####.com/avatar/4056677/1444894643.jpg
- t####.c####.q####.####.com/avatar/4056743/1444894774.jpg
- t####.c####.q####.####.com/avatar/4056748/1444895137.png
- t####.c####.q####.####.com/uploads/20151211/v1_1-8_1449823783391412.jpg?...
- t####.c####.q####.####.com/uploads/20151211/v1_1-8_1449824458440501.jpg
- t####.c####.q####.####.com/uploads/20151211/v1_1-8_1449825155665009.jpg
- t####.c####.q####.####.com/uploads/20151211/v1_1-8_1449825485234287.jpg
- t####.c####.q####.####.com/uploads/20151211/v1_1-8_1449825485234287.jpg?...
- t####.c####.q####.####.com/uploads/20151214/v1_1-8_1450077235511519.jpg?...
- t####.c####.q####.####.com/uploads/20160106/1452067579376987.jpg
- t####.c####.q####.####.com/uploads/20160106/1452067585335177.jpg
- t####.c####.q####.####.com/uploads/20160106/1452067667842495.jpg
- t####.c####.q####.####.com/uploads/20160106/1452067675697305.jpg
- t####.c####.q####.####.com/uploads/20160106/1452067694383533.jpg
- t####.c####.q####.####.com/uploads/20160106/1452067708811973.jpg
- t####.c####.q####.####.com/uploads/20160106/v1_1-8_1452067753856980.jpg?...
- t####.c####.q####.####.com/uploads/20160115/1452848952501989.jpg
- t####.c####.q####.####.com/uploads/20160115/1452848967906917.jpg
- t####.c####.q####.####.com/uploads/20160115/1452848998899363.jpg
- t####.c####.q####.####.com/uploads/20160115/v1_1-8_1452849076309827.jpg?...
- t.q####.cn/mbloghead/5653ffac75eef36ccbb6/100
- w####.18t####.com.####.com/News/hotStrategyIncr?post_id=####
- w####.18t####.com.####.com/coc1061.html?_nocatch=####
- w####.18t####.com.####.com/coc1151.html?_nocatch=####
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Запросы HTTP POST:
- a####.u####.com/app_logs
- api.18t####.com/posts/get_post_info?dk=####&ak=####
- s####.j####.cn/v2/report
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/ApplicationCache.db-journal (deleted)
- <Package Folder>/databases/chw.db-journal
- <Package Folder>/databases/jpush_local_notification.db
- <Package Folder>/databases/jpush_local_notification.db-journal
- <Package Folder>/databases/jpush_statistics.db
- <Package Folder>/databases/jpush_statistics.db-journal
- <Package Folder>/databases/rep.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/.jiagu.ls
- <Package Folder>/files/AdsMogo_CacheData.txt
- <Package Folder>/files/COCcoc.txt
- <Package Folder>/files/PrefsFile
- <Package Folder>/files/coc_BannerData.txt
- <Package Folder>/files/jpush_stat_cache.json
- <Package Folder>/files/jpush_stat_cache_history.json
- <Package Folder>/files/libjiagu.so
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/COC.xml
- <Package Folder>/shared_prefs/JPushSA_Config.xml
- <Package Folder>/shared_prefs/cn.jpush.serverconfig.xml
- <Package Folder>/shared_prefs/jpush_device_info.xml
- <Package Folder>/shared_prefs/openudid_prefs.xml
- <Package Folder>/shared_prefs/statistics_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/18touch_helpers/####/.nomedia
- <SD-Card>/18touch_helpers/####/1fdfx9bk1ljrtlr8bb04lq4z
- <SD-Card>/18touch_helpers/####/2ugk1avvgx2m0yejc9dl4lb23
- <SD-Card>/18touch_helpers/####/2uz6u4tke44s5g3t5y5pzzzbb
- <SD-Card>/18touch_helpers/####/39peq05s6a5003lqifs0of8qr
- <SD-Card>/18touch_helpers/####/7a67calb4nxjtwxql6jvv7u1a
- <SD-Card>/18touch_helpers/####/8pmmyxlcwsa28thzu35izi2v
- <SD-Card>/18touch_helpers/####/kvfu7sb3bru5yqqd6fi6j1xd
- <SD-Card>/18touch_helpers/####/mvljhnuzbafnmm74o60e6pon
- <SD-Card>/data/.push_deviceid
Другие:
Загружает динамические библиотеки:
- jpush181
- libjiagu
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
