Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Dowgin.14.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) p####.wp.com:80
- TCP(HTTP/1.1) googl####.g.doublec####.net:80
- TCP(HTTP/1.1) s####.wp.com:80
- TCP(HTTP/1.1) s.grav####.com:80
- TCP(HTTP/1.1) f####.google####.com:80
- TCP(HTTP/1.1) www.funkymo####.com:80
- TCP(HTTP/1.1) a.appj####.com:80
- TCP(HTTP/1.1) hi.fi.ah####.com:80
- TCP(TLS/1.0) googl####.g.doublec####.net:443
Запросы DNS:
- a.appj####.com
- f####.google####.com
- funkymo####.com
- googl####.g.doublec####.net
- hi.fi.ah####.com
- p####.wp.com
- s####.wp.com
- s####.wp.com
- s.grav####.com
- www.funkymo####.com
Запросы HTTP GET:
- f####.google####.com/css?family=####
- googl####.g.doublec####.net/mads/static/sdk/native/sdk-core-v40.js
- hi.fi.ah####.com/l9
- p####.wp.com/g.gif?v=####&j=####&blog=####&post=####&tz=####&srv=####&ho...
- s####.wp.com/e-201818.js
- s####.wp.com/wp-content/js/devicepx-jetpack.js?ver=####
- s.grav####.com/js/gprofiles.js?ver=####
- www.funkymo####.com/
- www.funkymo####.com/wp-content/plugins/contact-form-7/includes/css/style...
- www.funkymo####.com/wp-content/plugins/contact-form-7/includes/js/jquery...
- www.funkymo####.com/wp-content/plugins/contact-form-7/includes/js/script...
- www.funkymo####.com/wp-content/plugins/dynamic-to-top/js/dynamic.to.top....
- www.funkymo####.com/wp-content/plugins/dynamic-to-top/js/libs/jquery.eas...
- www.funkymo####.com/wp-content/plugins/force-image-download/js/deefuse-f...
- www.funkymo####.com/wp-content/plugins/jetpack/css/jetpack.css?ver=####
- www.funkymo####.com/wp-content/plugins/jetpack/modules/wpgroho.js?ver=####
- www.funkymo####.com/wp-content/plugins/shadowbox-js/css/extras.css?ver=#...
- www.funkymo####.com/wp-content/plugins/social-media-widget/social_widget...
- www.funkymo####.com/wp-content/plugins/unitydog/unitydog.css?ver=####
- www.funkymo####.com/wp-content/plugins/unitydog/unitydog.js?ver=####
- www.funkymo####.com/wp-content/plugins/unitydog/unityobject2.js?ver=####
- www.funkymo####.com/wp-content/themes/funkylicious2/images/amazon.png
- www.funkymo####.com/wp-content/themes/funkylicious2/images/android.png
- www.funkymo####.com/wp-content/themes/funkylicious2/images/apple.png
- www.funkymo####.com/wp-content/themes/funkylicious2/images/apple_premium...
- www.funkymo####.com/wp-content/themes/funkylicious2/images/bg00.jpg
- www.funkymo####.com/wp-content/themes/funkylicious2/images/headbackline....
- www.funkymo####.com/wp-content/themes/funkylicious2/images/header2.png
- www.funkymo####.com/wp-content/themes/funkylicious2/images/menuBTN.png
- www.funkymo####.com/wp-content/themes/funkylicious2/images/new.png
- www.funkymo####.com/wp-content/themes/funkylicious2/javascripts/jquery-1...
- www.funkymo####.com/wp-content/themes/funkylicious2/javascripts/jquery.e...
- www.funkymo####.com/wp-content/themes/funkylicious2/javascripts/smoothsc...
- www.funkymo####.com/wp-content/themes/funkylicious2/style.css
- www.funkymo####.com/wp-content/themes/funkylicious2/stylesheets/coda-sli...
- www.funkymo####.com/wp-content/themes/funkylicious2/stylesheets/reset.css
- www.funkymo####.com/wp-content/uploads/2012/04/about.png
- www.funkymo####.com/wp-content/uploads/2012/04/contact.png
- www.funkymo####.com/wp-content/uploads/2012/04/extras.png
- www.funkymo####.com/wp-content/uploads/2012/04/facebook.png
- www.funkymo####.com/wp-content/uploads/2012/04/games.png
- www.funkymo####.com/wp-content/uploads/2012/04/google_plus.png
- www.funkymo####.com/wp-content/uploads/2012/04/twitter.png
- www.funkymo####.com/wp-content/uploads/2012/04/youtube.png
- www.funkymo####.com/wp-content/uploads/2013/04/BR_96.png
- www.funkymo####.com/wp-content/uploads/2013/04/FD_96.png
- www.funkymo####.com/wp-content/uploads/2013/04/HB_961.png
- www.funkymo####.com/wp-content/uploads/2013/04/ICR_96.png
- www.funkymo####.com/wp-content/uploads/2013/04/IC_96.png
- www.funkymo####.com/wp-content/uploads/2013/04/MB_96.png
- www.funkymo####.com/wp-content/uploads/2013/07/LZ_96.png
- www.funkymo####.com/wp-content/uploads/2013/07/ZnJ_72And.png
- www.funkymo####.com/wp-content/uploads/2013/12/MS_Icon96.png
- www.funkymo####.com/wp-content/uploads/2014/01/SP_Icon96.png
- www.funkymo####.com/wp-content/uploads/2014/04/BRBanner1024x500.png
- www.funkymo####.com/wp-content/uploads/2014/04/FireDefense_Ban_Android1....
- www.funkymo####.com/wp-content/uploads/2014/04/HB-banner1024x500.png
- www.funkymo####.com/wp-content/uploads/2014/04/ICRbanner1024x500.png
- www.funkymo####.com/wp-content/uploads/2014/04/ICbanner1024x5002.jpg
- www.funkymo####.com/wp-content/uploads/2014/04/LoveZooka.jpg
- www.funkymo####.com/wp-content/uploads/2014/04/MBbanner1024x500.png
- www.funkymo####.com/wp-content/uploads/2014/04/MFBanner1024x500.jpg
- www.funkymo####.com/wp-content/uploads/2014/04/MSbanner1024X500.png
- www.funkymo####.com/wp-content/uploads/2014/04/SPbanner1024X500.png
- www.funkymo####.com/wp-content/uploads/2014/04/ZeJbanner1024x500.png
- www.funkymo####.com/wp-content/uploads/2014/04/megaFastIcon96.png
- www.funkymo####.com/wp-content/uploads/2014/07/SF_icon96.png
- www.funkymo####.com/wp-content/uploads/2014/07/SFbanner1024x500.png
- www.funkymo####.com/wp-content/uploads/2014/12/4vYILqAR5Sh52I6niAcO9uRPJ...
- www.funkymo####.com/wp-content/uploads/2014/12/puzzlegalaxy96.png
- www.funkymo####.com/wp-content/uploads/2015/10/DQqqX5m_n4gSXWny6yGPX8LBy...
- www.funkymo####.com/wp-content/uploads/2015/10/ZeC68pyS5bJe3d6FI2AkXkiYG...
- www.funkymo####.com/wp-content/uploads/shadowbox-js/20145de73874d15648fb...
- www.funkymo####.com/wp-content/uploads/shadowbox-js/src/shadowbox.css?ve...
- www.funkymo####.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=####
- www.funkymo####.com/wp-includes/js/jquery/jquery.js?ver=####
- www.funkymo####.com/wp-includes/js/wp-embed.min.js?ver=####
- www.funkymo####.com/wp-includes/js/wp-emoji-release.min.js?ver=####
Запросы HTTP POST:
- a.appj####.com/ad-service/ad/mark
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.jg.ic
- /data/data/####/8061978c.jar
- /data/data/####/Rate_TimerLast.cnt
- /data/data/####/ads476338991.jar
- /data/data/####/cf439.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/http_googleads.g.doubleclick.net_0.localstorage-journal
- /data/data/####/index
- /data/data/####/jg_app_update_settings_random.xml
- /data/data/####/libjiagu.so
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/Anims.DGz
- /data/media/####/GameSetting.DGz
- /data/media/####/Maps.DGz
- /data/media/####/Objects.DGz
- /data/media/####/Scn.DGz
- /data/media/####/Sfx.DGz
- /data/media/####/Shaders.DGz
- /data/media/####/Sounds.DGz
- /data/media/####/Spell.DGz
- /data/media/####/Text.DGz
- /data/media/####/Trajects.DGz
- /data/media/####/gameOverSound.Ogg
- /data/media/####/gameSound.Ogg
- /data/media/####/menuSound.Ogg
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- DG
- DGLIB
- libjiagu
Использует следующие алгоритмы для шифрования данных:
- DES
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- DES
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
