Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Plague.1.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) i####.ika####.cn.####.com:80
- TCP(HTTP/1.1) img.zwka####.com:80
- TCP(HTTP/1.1) res.ika####.cn:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) cdn.ika####.cn.####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) us####.ika####.cn:80
- TCP(HTTP/1.1) z####.ika####.cn:80
- TCP(TLS/1.0) 1####.217.20.78:443
- TCP c####.g####.ig####.com:5224
- TCP sdk.o####.t####.####.com:5224
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.u####.com
- c####.g####.ig####.com
- c####.ika####.cn
- cdn.ika####.cn
- cl####.ika####.cn
- e.anzhua####.com
- e1.anzhua####.com
- e2.anzhua####.com
- hm.b####.com
- i####.ika####.cn
- img.zwka####.com
- res.ika####.cn
- sdk.c####.ig####.com
- sdk.o####.i####.####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- us####.ika####.cn
- z####.ika####.cn
- z####.ika####.cn
- z####.ika####.cn
- zws####.ika####.cn
Запросы HTTP GET:
- cdn.ika####.cn.####.com/images/zwsc/remindImage/7977b49fdfda4c5ea9b2dc45...
- cdn.ika####.cn.####.com/qidongbanner/libao.png
- hm.b####.com/h.js?daf89de####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- i####.ika####.cn.####.com/211/images/139717.jpg
- i####.ika####.cn.####.com/211/images/222492.jpg
- i####.ika####.cn.####.com/211/images/229356.jpg
- i####.ika####.cn.####.com/211/images/250256.jpg
- i####.ika####.cn.####.com/211/images/334138.jpg
- i####.ika####.cn.####.com/211/images/351098.jpg
- i####.ika####.cn.####.com/211/images/50003481.jpg
- i####.ika####.cn.####.com/211/images/50003627.jpg
- i####.ika####.cn.####.com/211/images/50005107.jpg
- i####.ika####.cn.####.com/211/images/50005994.jpg
- i####.ika####.cn.####.com/211/images/50013396.jpg
- i####.ika####.cn.####.com/211/images/60003253.jpg
- i####.ika####.cn.####.com/211/images/60003283.jpg
- i####.ika####.cn.####.com/211/images/60349719.jpg
- i####.ika####.cn.####.com/211/images/60354116.jpg
- i####.ika####.cn.####.com/211/images/60360657.jpg
- i####.ika####.cn.####.com/211/images/60385490.jpg
- i####.ika####.cn.####.com/211/images/60430862.jpg
- i####.ika####.cn.####.com/211/images/60441657.jpg
- i####.ika####.cn.####.com/211/images/60450278.jpg
- i####.ika####.cn.####.com/211/images/60451802.jpg
- i####.ika####.cn.####.com/211/images/60452041.jpg
- i####.ika####.cn.####.com/211/images/60458469.jpg
- i####.ika####.cn.####.com/211/images/60466920.jpg
- i####.ika####.cn.####.com/211/images/60543222.jpg
- i####.ika####.cn.####.com/211/images/60557571.jpg
- i####.ika####.cn.####.com/211/images/60560065.jpg
- i####.ika####.cn.####.com/211/images/60560865.jpg
- i####.ika####.cn.####.com/211/images/60575560.jpg
- i####.ika####.cn.####.com/211/images/60592861.jpg
- i####.ika####.cn.####.com/211/images/60592865.jpg
- i####.ika####.cn.####.com/211/images/60593536.jpg
- i####.ika####.cn.####.com/211/images/60617270.jpg
- i####.ika####.cn.####.com/211/images/60683956.jpg
- i####.ika####.cn.####.com/211/images/60734161.jpg
- i####.ika####.cn.####.com/211/images/60743357.jpg
- i####.ika####.cn.####.com/211/images/60752573.jpg
- i####.ika####.cn.####.com/211/images/60809432.jpg
- i####.ika####.cn.####.com/211/images/60831822.jpg
- i####.ika####.cn.####.com/211/images/80000236.jpg
- i####.ika####.cn.####.com/211/images/80000432.jpg
- i####.ika####.cn.####.com/211/images/80000439.jpg
- i####.ika####.cn.####.com/211/images/80000471.jpg
- i####.ika####.cn.####.com/211/images/80000499.jpg
- i####.ika####.cn.####.com/211/images/80001076.jpg
- i####.ika####.cn.####.com/211/images/80001473.jpg
- i####.ika####.cn.####.com/211/images/80001558.jpg
- i####.ika####.cn.####.com/211/images/80002152.jpg
- i####.ika####.cn.####.com/211/images/80002408.jpg
- i####.ika####.cn.####.com/211/images/80002411.jpg
- i####.ika####.cn.####.com/211/images/80002414.jpg
- i####.ika####.cn.####.com/211/images/80002416.jpg
- i####.ika####.cn.####.com/211/images/80002417.jpg
- i####.ika####.cn.####.com/211/images/80002421.jpg
- i####.ika####.cn.####.com/211/images/80002576.jpg
- i####.ika####.cn.####.com/211/images/80002629.jpg
- i####.ika####.cn.####.com/211/images/80008807.jpg
- i####.ika####.cn.####.com/211/images/80008851.jpg
- i####.ika####.cn.####.com/css/style-4.1.css
- i####.ika####.cn.####.com/images/blank.png
- i####.ika####.cn.####.com/jpBannerImage/2017/08/1627050776_142827935_刘慈欣...
- i####.ika####.cn.####.com/jpBannerImage/2017/09/1356110361_1981271809_书城...
- i####.ika####.cn.####.com/jpBannerImage/2017/09/1516460086_1505588006_中文...
- i####.ika####.cn.####.com/jpBannerImage/2017/09/1536230763_535128011_中文书...
- i####.ika####.cn.####.com/jpBannerImage/2017/10/1328330840_1613362623_中文...
- img.zwka####.com/images/icons/7392_100.png
- res.ika####.cn/211/SidePackage/side_43.zip
- t####.c####.q####.####.com/tdata_DHL128
- t####.c####.q####.####.com/tdata_UTU297
- us####.ika####.cn/book!index.xhtml?cnid=####&cnsubid=####&umeng=####&ver...
- us####.ika####.cn/book/chapterList?cnid=####&uid=####&imsi=####&imei=###...
- us####.ika####.cn/bookReview!bookReviewPerm.xhtml?bookId=####&cnid=####&...
- us####.ika####.cn/bookv3/advert?adtype=####&cnid=####&uid=####&imsi=####...
- us####.ika####.cn/bookv3/autobuyByClient?cnid=####&uid=####&imsi=####&im...
- us####.ika####.cn/bookv3/buy/yhbuy?bookid=####&cnid=####&uid=####&imsi=#...
- us####.ika####.cn/bookv3/checkSidePackage?zversion=####&cnid=####&uid=##...
- us####.ika####.cn/bookv3/clientad?cnid=####&uid=####&imsi=####&imei=####...
- us####.ika####.cn/bookv3/clientapp?cnid=####&uid=####&imsi=####&imei=###...
- us####.ika####.cn/bookv3/shelfSync?cnid=####&uid=####&imsi=####&imei=###...
- us####.ika####.cn/bookv3/userinfo?cnid=####&uid=####&imsi=####&imei=####...
- us####.ika####.cn/css/style-4.1.css
- us####.ika####.cn/images4.1/status-wrap.png
- us####.ika####.cn/images4.1/title-bg.jpg
- us####.ika####.cn/js/all.js?v=####
- us####.ika####.cn/js/base-new.js
- us####.ika####.cn/js/base.js?v=####
- us####.ika####.cn/js/book.js?v=####
- us####.ika####.cn/js/echo.min.js
- us####.ika####.cn/js/lazy.js
- us####.ika####.cn/js/swiper.min1.js
- us####.ika####.cn/js/touch.js
- us####.ika####.cn/js/zepto.min.js
- us####.ika####.cn/notes!getNoteById.xhtml?bookId=####&cnid=####&uid=####...
- us####.ika####.cn/pushServer/uploadClientId?cid=####&cnid=####&uid=####&...
- us####.ika####.cn/rest/user/register?pckName=####&cnid=####&uid=####&ims...
- us####.ika####.cn/user!getExitRemind.xhtml?cnid=####&uid=####&imsi=####&...
- us####.ika####.cn/zwscapiv2/rest/books/getversioninfo?cnid=####
- z####.ika####.cn/log.js?cnid=####&uid=####&imsi=####&imei=####&cnsubid=#...
Запросы HTTP POST:
- a####.u####.com/app_logs
- sdk.o####.p####.####.com/api.php?format=####&t=####
- us####.ika####.cn/book/checkBookState?cnid=####&uid=####&imsi=####&imei=...
- us####.ika####.cn/interface!clientStartAd.xhtml?cnid=####&uid=####&imsi=...
- us####.ika####.cn/validate!validateData.xhtml?v=####&n=####
- z####.ika####.cn/logs.html?cnid=####&uid=####&imsi=####&imei=####&cnsubi...
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/17kAppPrefs.xml
- /data/data/####/books_zwsc.db-journal
- /data/data/####/ch_readerv3.db-journal
- /data/data/####/classes.jar
- /data/data/####/common.db-journal
- /data/data/####/config.db-journal
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dbijsqx-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/gdaemon_20161017
- /data/data/####/gx_sp.xml
- /data/data/####/http_zwsc.ikanshu.cn_0.localstorage-journal
- /data/data/####/increment.db-journal
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/mobclick_agent_header_com.singlebook.frees.xml
- /data/data/####/mobclick_agent_state_com.singlebook.frees.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/tdata_DHL128.jar
- /data/data/####/tdata_DHL128.tmp
- /data/data/####/tdata_UTU297.jar
- /data/data/####/tdata_UTU297.tmp
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/._cer
- /data/media/####/.nomedia
- /data/media/####/.zb
- /data/media/####/0.ncache.kZ2080
- /data/media/####/1a32hvk53fdq0doogvfiqjszm.tmp
- /data/media/####/1ztl1za4xbwbo7hovp1z8ilwf.tmp
- /data/media/####/2f37b5midpcju2eucgqbl6xz1.tmp
- /data/media/####/2i97cb8xjsyr2eesc0wzoi0dv.tmp
- /data/media/####/3221076
- /data/media/####/329366.jpg
- /data/media/####/336127.jpg
- /data/media/####/3457630
- /data/media/####/3ry9az9o2eshklvquhjg14z8w.tmp
- /data/media/####/3zhe8fq0ttdsczlkhflect5ul.tmp
- /data/media/####/4b3hp1tzyaey93j19qydrqvxw.tmp
- /data/media/####/4d8bmxe85hdkp6q9fnz4qkiml.tmp
- /data/media/####/4lvt4qunxwlizjmfuu64jtsin.tmp
- /data/media/####/4ujsuxh23fxreb8zcv25gderq.tmp
- /data/media/####/50013396.jpg
- /data/media/####/5nmvbm0ub825of9cmsb6cftjn.tmp
- /data/media/####/5zjubcq19q2c68gcwbe7bi19d.tmp
- /data/media/####/60360651.jpg
- /data/media/####/60371096.jpg
- /data/media/####/60451957.jpg
- /data/media/####/69kh9h5brhgfwu251vltrmte5.tmp
- /data/media/####/72fk87pe6lkbmbd5ie38zp1xi.tmp
- /data/media/####/75jbybor0mpri2g6fyquije2k.tmp
- /data/media/####/app.db
- /data/media/####/app_feeds_info_data
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.singlebook.frees.db
- /data/media/####/daiyxwki49fwuz3v8mk5nnwe.tmp
- /data/media/####/dir.ski
- /data/media/####/dir.ski.tmp
- /data/media/####/inventoryFile.txt
- /data/media/####/kbh1lcof9lrcswnbqjd3gvje.tmp
- /data/media/####/paihang.png
- /data/media/####/qiandao.png
- /data/media/####/renmen.png
- /data/media/####/side_43.zip
- /data/media/####/slide_frame_module_item_data
- /data/media/####/songqian.png
- /data/media/####/tdata_DHL128
- /data/media/####/tdata_UTU297
- /data/media/####/th1j6ulqdbior1b0itvte512.tmp
- /data/media/####/ufhl8im5hsp8b5qtvrez4s1.tmp
- /data/media/####/v5kydzia0uvazyswp3zcr2ds.tmp
- /data/media/####/vip.png
- /data/media/####/xianmian.png
- /data/media/####/zipJsonFile.txt
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25013 300 0
- chmod 700 <Package Folder>/files/gdaemon_20161017
- logcat -c
- logcat -d -v raw -s AndroidRuntime:E -p <Package>
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25013 300 0
Загружает динамические библиотеки:
- LineBreak-v2
- NativeFormats-v4
Использует следующие алгоритмы для шифрования данных:
- DES-ECB-PKCS5Padding
- RSA-None-PKCS1Padding
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
