Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Dowgin.3.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) x.da.hun####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) geo.gridsum####.com:80
- TCP(HTTP/1.1) 3####.h####.i####.tv:80
- TCP(HTTP/1.1) hm.bd.5####.net:80
- TCP(HTTP/1.1) bj.bc####.com:80
- TCP(HTTP/1.1) apilo####.a####.com:80
- TCP(HTTP/1.1) com####.hun####.com:80
- TCP(HTTP/1.1) 4####.h####.com.####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) mo####.log.hun####.com:80
- TCP(HTTP/1.1) s.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) mo####.api.hun####.com:80
- TCP(HTTP/1.1) rc.mpp.hun####.com:80
- TCP(HTTP/1.1) av####.h####.com.####.com:80
Запросы DNS:
- 0####.h####.com
- 1####.h####.com
- 2####.h####.com
- 3####.h####.com
- 4####.h####.com
- a####.u####.com
- api####.a####.com
- au.u####.com
- av####.h####.com
- com####.hun####.com
- e####.h####.com
- geo.gridsum####.com
- hm.bd.5####.net
- mo####.api.hun####.com
- mo####.log.hun####.com
- oc.u####.com
- rc.mpp.hun####.com
- use####.api.max.####.com
- v####.bj.bc####.com
- x.da.hun####.com
Запросы HTTP GET:
- 3####.h####.i####.tv/preview/cms_icon/2018/03/20180307195454292.jpg
- 3####.h####.i####.tv/preview/cms_icon/2018/03/20180307202428842.jpg
- 3####.h####.i####.tv/preview/cms_icon/2018/03/20180309201117984.jpg
- 3####.h####.i####.tv/preview/cms_icon/2018/03/20180309201141262.jpg
- 3####.h####.i####.tv/preview/cms_icon/2018/03/20180309201204849.jpg
- 3####.h####.i####.tv/preview/cms_icon/2018/03/20180318103412760.gif
- 3####.h####.i####.tv/preview/cms_icon/2018/03/20180318181133975.jpg
- 3####.h####.i####.tv/preview/cms_icon/2018/03/20180318203536721.jpg
- 3####.h####.i####.tv/preview/cms_icon/2018/03/20180318204653326.jpg
- 3####.h####.i####.tv/preview/cms_icon/2018/03/20180319104320066.jpg
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/321502/4291011/201802...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/321502/4307729/201803...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/321502/4316304/201803...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/321502/4316737/201803...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/321502/4316874/201803...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/321502/4316901/201803...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/321502/4317004/201803...
- 3####.h####.i####.tv/preview/sp_images/2018/zongyi/321502/4317496/201803...
- 4####.h####.com.####.com/preview/cms_icon/2018/03/20180309201226271.jpg
- 4####.h####.com.####.com/preview/cms_icon/2018/03/20180316220810967.jpg
- 4####.h####.com.####.com/preview/cms_icon/2018/03/20180317125554764.jpg
- 4####.h####.com.####.com/preview/cms_icon/2018/03/20180318224742121.jpg
- av####.h####.com.####.com/0/8c5a31e7/b6tpo1n6jlt7t174jptg?x-oss-process=...
- bj.bc####.com/yc104.txt
- com####.hun####.com/mobile_comment/top?userId=####&osVersion=####&subjec...
- geo.gridsum####.com/v2/g.aspx
- mo####.api.hun####.com/channel/getDetail?userId=####&osVersion=####&devi...
- mo####.api.hun####.com/channel/getList?userId=####&osVersion=####&device...
- mo####.api.hun####.com/comment/read?userId=####&osVersion=####&device=##...
- mo####.api.hun####.com/mobile/getCategorys?userId=####&osVersion=####&de...
- mo####.api.hun####.com/mobile/getRsaKey
- mo####.api.hun####.com/mobile/iconLink?userId=####&osVersion=####&device...
- mo####.api.hun####.com/mobile/loadimage?userId=####&osVersion=####&devic...
- mo####.api.hun####.com/v2/video/getMultiplyList?userId=####&osVersion=##...
- mo####.api.hun####.com/v2/video/getShortList?userId=####&osVersion=####&...
- mo####.api.hun####.com/v2/video/getVideoInfo?userId=####&osVersion=####&...
- mo####.api.hun####.com/v3/video/getSource?userId=####&osVersion=####&dev...
- mo####.api.hun####.com/video/getSupport?userId=####&osVersion=####&devic...
- rc.mpp.hun####.com/mobile/v1/cms/alike?userId=####&osVersion=####&device...
- rc.mpp.hun####.com/mobile/v1/cms?userId=####&collectionid=####&osVersion...
Запросы HTTP POST:
- a####.u####.com/app_logs
- apilo####.a####.com/v3/log/init
- hm.bd.5####.net/5naknak/28f7/p9c
- hm.bd.5####.net/5naknak/28f7/q9c
- hm.bd.5####.net/5naknak/28f7/s9c
- hm.bd.5####.net/5naknak/28f7/t9c
- hm.bd.5####.net/5naknak/28f7/w9c
- hm.bd.5####.net/5naknak/cfe4/t9c
- mo####.log.hun####.com/data.cgi
- oc.u####.com/check_config_update
- s.wagbr####.alibaba####.com/api/check_app_update
- x.da.hun####.com/json/app/boot
- x.da.hun####.com/video/player
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/app_push_lib/plugin-deploy.jar
- <Package Folder>/app_push_lib/plugin-deploy.key
- <Package Folder>/databases/ImgoPad-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/.imprint
- <Package Folder>/files/.jiagu.ls
- <Package Folder>/files/MV3Plugin.ini
- <Package Folder>/files/com.rifg.lkdd.lzxv.jar
- <Package Folder>/files/libjiagu.so
- <Package Folder>/files/mobclick_agent_cached_<Package>616
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/shared_prefs/ERROR.xml
- <Package Folder>/shared_prefs/GridsumCommon.xml
- <Package Folder>/shared_prefs/MGTVCommon.xml
- <Package Folder>/shared_prefs/MGTVCommon.xml.bak
- <Package Folder>/shared_prefs/_mgkankan_r.xml
- <Package Folder>/shared_prefs/last_know_location.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1afutskdxrefigudsho0rpmad.tmp
- <SD-Card>/Android/####/1el5y4nhlgjgwjwshqxpx57jh.tmp
- <SD-Card>/Android/####/1o5s6gxr40kdbhsnnpgukc5bk.tmp
- <SD-Card>/Android/####/33uoj3ecrezc0qzu8x844lhiv.tmp
- <SD-Card>/Android/####/379hhc7cns0f7uk5jcu58u9v7.tmp
- <SD-Card>/Android/####/3lesoeevtcfh02ndfiyfwlije.tmp
- <SD-Card>/Android/####/4fl2xewlipoq9k6wakzx5nbr0.tmp
- <SD-Card>/Android/####/5pqv8obw2bdjnxauafrltegfw.tmp
- <SD-Card>/Android/####/5wg1km8sbu1jhcpwpwmnm2vgy.tmp
- <SD-Card>/Android/####/63dc1o06o53fnglrwuq975wuo.tmp
- <SD-Card>/Android/####/6czq83hg0e09tn6xec9k7lz4l.tmp
- <SD-Card>/Android/####/6sign1zhzs9rss4asfmbeoccq.tmp
- <SD-Card>/Android/####/6zzwxg9r19goid8wflgpplvje.tmp
- <SD-Card>/Android/####/74tuuucb6aqtzs2ym850xqj9v.tmp
- <SD-Card>/Android/####/77hpjkh3wnw4r8mhhn3zl2mub.tmp
- <SD-Card>/Android/####/7i9ifnmlreeq7e8i7b0gnk1eq.tmp
- <SD-Card>/Android/####/7imuu8zcrspi1rtvzx6j21x00.tmp
- <SD-Card>/Android/####/7isebiob4i0f3o3ayhwepx86z.tmp
- <SD-Card>/Android/####/7krls0hkaxo3umfr4x1tgm6z9.tmp
- <SD-Card>/Android/####/journal
- <SD-Card>/Android/####/journal.tmp
- <SD-Card>/Android/####/n1yqfarjwam36vqesqnve6by.tmp
- <SD-Card>/Android/####/nprlamg17e8660cvkzqypri2.tmp
- <SD-Card>/Android/####/re6lp3k16kbcnlr76txy461u.tmp
- <SD-Card>/Android/####/tpl57mzsa2e8mr0qs8r84t4s.tmp
- <SD-Card>/imgo_phone_err.txt
Другие:
Загружает динамические библиотеки:
- bspatch
- libjiagu
- libmv3_platform
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS5Padding
- DES
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- DES
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
