Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.2776
- Android.DownLoader.570.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) a.leleke####.com:80
- TCP(HTTP/1.1) thi####.q####.cn:80
- TCP(HTTP/1.1) r.leleke####.com.####.com:80
- TCP a3.a####.com:7701
- TCP a3.a####.com:7703
- TCP a3.a####.com:7702
Запросы DNS:
- a####.u####.com
- a.leleke####.com
- a3.a####.com
- fb.u####.com
- hm.b####.com
- q.q####.cn
- r.leleke####.com
- thi####.q####.cn
- www.leleke####.com
Запросы HTTP GET:
- a.leleke####.com/comments/c.php?app=####&id=####&mode=####
- a.leleke####.com/comments/em/cj_thumb.gif
- a.leleke####.com/comments/em/cool_thumb.gif
- a.leleke####.com/comments/em/fuyun_thumb.gif
- a.leleke####.com/comments/em/geili_thumb.gif
- a.leleke####.com/comments/em/good_thumb.gif
- a.leleke####.com/comments/em/gza_thumb.gif
- a.leleke####.com/comments/em/h_thumb.gif
- a.leleke####.com/comments/em/horse2_thumb.gif
- a.leleke####.com/comments/em/hufen_thumb.gif
- a.leleke####.com/comments/em/j_thumb.gif
- a.leleke####.com/comments/em/kbsa_thumb.gif
- a.leleke####.com/comments/em/mb_thumb.gif
- a.leleke####.com/comments/em/panda_thumb.gif
- a.leleke####.com/comments/em/pig.gif
- a.leleke####.com/comments/em/qq_thumb.gif
- a.leleke####.com/comments/em/sad_thumb.gif
- a.leleke####.com/comments/em/shenshou_thumb.gif
- a.leleke####.com/comments/em/tootha_thumb.gif
- a.leleke####.com/comments/em/vw_thumb.gif
- a.leleke####.com/comments/em/wg_thumb.gif
- a.leleke####.com/comments/em/yw_thumb.gif
- a.leleke####.com/comments/em/z2_thumb.gif
- a.leleke####.com/comments/image/anony.png
- a.leleke####.com/comments/image/avatar.png
- a.leleke####.com/comments/image/login_qq_m.png
- a.leleke####.com/comments/image/login_weibo_m.png
- a.leleke####.com/comments/image/m.png
- a.leleke####.com/comments/image/m_c.png
- a.leleke####.com/comments/image/qzone.png
- a.leleke####.com/comments/js/m.min.js
- a.leleke####.com/login/image/anony2.png
- a.leleke####.com/min/11FZjQ.js?t=####
- a.leleke####.com/min/11SV4k-guFIe-pO3zO.css?t=####
- a.leleke####.com/min/B09od.js?t=####
- a.leleke####.com/min/CAOT8.js?t=####
- a.leleke####.com/min/RAU91-SIg2D-9GZFD-11SV4k-oDORT-guFIe-pO3zO.css?t=####
- a.leleke####.com/min/bevOj-Tjf9O-oEc5R-J6gFN-16Oyrm-guFIe-pO3zO.css?t=####
- a.leleke####.com/min/iry05.css?t=####
- a.leleke####.com/min/m4H1W-dlEyR-14G2Ek-yc6Ph-fKuEZ.js?t=####
- a.leleke####.com/min/ml9JF-9GZFD-11SV4k-oDORT-guFIe-pO3zO.css?t=####
- a.leleke####.com/min/t1pz7-tIPuo-oEc5R-KHTj1-18nvLO-8GTde-guFIe-lqqVP-pO...
- a.leleke####.com/uc/image/watermark.png?t=####
- a.leleke####.com/zuowen/109976.shtml
- a.leleke####.com/zuowen/146685.shtml
- a.leleke####.com/zuowen/284436.shtml
- a.leleke####.com/zuowen/447505.shtml
- a.leleke####.com/zuowen/7018.shtml
- a.leleke####.com/zuowen/clist8-0-0-1-1.shtml
- a.leleke####.com/zuowen/image/zuowen.png?t=####
- a.leleke####.com/zuowen/index.php?track_id=####
- a.leleke####.com/zuowen/list23-0-0-1-1.shtml
- a.leleke####.com/zuowen/s103-1.shtml
- a.leleke####.com/zuowen/s7018-0.shtml
- a.leleke####.com/zuowen/service/get_my_profile.php
- a.leleke####.com/zuowen/uc/image/21.png?t=####
- a.leleke####.com/zuowen/uc/image/22.png?t=####
- a.leleke####.com/zuowen/uc/image/23.png?t=####
- a.leleke####.com/zuowen/uc/image/41.png?t=####
- a.leleke####.com/zuowen/uc/image/high.png?t=####
- a.leleke####.com/zuowen/uc/image/hot.png?t=####
- a.leleke####.com/zuowen/uc/image/middle.png?t=####
- a.leleke####.com/zuowen/uc/image/primary.png?t=####
- a.leleke####.com/zuowen/uc/image/wave.png?t=####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?8296a32####
- r.leleke####.com.####.com/dat/zuowen/category/m/1.png
- r.leleke####.com.####.com/dat/zuowen/category/m/10.png
- r.leleke####.com.####.com/dat/zuowen/category/m/11.png
- r.leleke####.com.####.com/dat/zuowen/category/m/12.png
- r.leleke####.com.####.com/dat/zuowen/category/m/13.png
- r.leleke####.com.####.com/dat/zuowen/category/m/14.png
- r.leleke####.com.####.com/dat/zuowen/category/m/15.png
- r.leleke####.com.####.com/dat/zuowen/category/m/16.png
- r.leleke####.com.####.com/dat/zuowen/category/m/2.png
- r.leleke####.com.####.com/dat/zuowen/category/m/3.png
- r.leleke####.com.####.com/dat/zuowen/category/m/4.png
- r.leleke####.com.####.com/dat/zuowen/category/m/5.png
- r.leleke####.com.####.com/dat/zuowen/category/m/6.png
- r.leleke####.com.####.com/dat/zuowen/category/m/7.png
- r.leleke####.com.####.com/dat/zuowen/category/m/8.png
- r.leleke####.com.####.com/dat/zuowen/category/m/9.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/chongyangjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/chunjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/chuxi.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/duanwujie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/ertongjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/funvjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/fuqinjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/guoqingjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/jianjunjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/jiaoshijie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/laba.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/laodongjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/muqinjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/qingmingjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/qingnianjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/qixi.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/shengdanjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/wanshengjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/yuandan.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/yuanxiaojie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/zhishujie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/zhongqiujie.png
- thi####.q####.cn/qqapp/101036803/0107B5ABA868D6018091CAB5C92C5B86/100
- thi####.q####.cn/qqapp/101036803/049676CE89726D7C1D73250B2F659990/100
- thi####.q####.cn/qqapp/101036803/07962591D5D2C126752C5B29CB327BE4/100
- thi####.q####.cn/qqapp/101036803/09A85C0201E2590778F88E8192473BF7/100
- thi####.q####.cn/qqapp/101036803/0E24B089CB3608A4A25F776FD368081A/100
- thi####.q####.cn/qqapp/101036803/0FEEBED7D7867802097EBC75CB6A0E48/100
- thi####.q####.cn/qqapp/101036803/1133996D647FC1ADF02ED79F6C8093BE/100
- thi####.q####.cn/qqapp/101036803/18594A343F0F8C00553C325DF9EC5C4D/100
- thi####.q####.cn/qqapp/101036803/18B3AD59127988C7E070047E7C59B19A/100
- thi####.q####.cn/qqapp/101036803/1CE8C768D515D22559B86B3E3FE0D41F/100
- thi####.q####.cn/qqapp/101036803/233B73DBF8DFE82992B56CF1E1E004B1/100
- thi####.q####.cn/qqapp/101036803/252004930CE0686F7216C39AD96EF863/100
- thi####.q####.cn/qqapp/101036803/2A0E0565F9F5BCEFEE1B3CF0CDE40D61/100
- thi####.q####.cn/qqapp/101036803/2C7DEC15F9814047D6453CF36C02FE6F/100
- thi####.q####.cn/qqapp/101036803/31AC9B8984DEDE4C6BE148A461802293/100
- thi####.q####.cn/qqapp/101036803/3D9A63B4B8DF5D9C16FB2D6144A17917/100
- thi####.q####.cn/qqapp/101036803/420F0DCF960F3675C57A13D922A2E12D/100
- thi####.q####.cn/qqapp/101036803/42FC039ABF09DCAE2D84CAAE4806EF91/100
- thi####.q####.cn/qqapp/101036803/490A33D5196CB75A267F67C0C3523D19/100
- thi####.q####.cn/qqapp/101036803/4D3205A4087BCBC71792983B788581A7/100
- thi####.q####.cn/qqapp/101036803/52265887CFCE54E24C63C1619AA26EC3/100
- thi####.q####.cn/qqapp/101036803/52507ED93554E42E7A39D48DD51A27B8/100
- thi####.q####.cn/qqapp/101036803/5D48256C691E83329E29F880FA7A6B4A/100
- thi####.q####.cn/qqapp/101036803/5DD4E0C48EAD6D07044480A7D1956439/100
- thi####.q####.cn/qqapp/101036803/61ACB09947036097FE83BD3F47622143/100
- thi####.q####.cn/qqapp/101036803/6999D12AF8D0BAD20A53B9771ECC3AFF/100
- thi####.q####.cn/qqapp/101036803/6FA646B7A0D738F664B27C8051512404/100
- thi####.q####.cn/qqapp/101036803/6FDD7D8A482A29A91ACBA41271FDF3D9/100
- thi####.q####.cn/qqapp/101036803/72347156D0AE926E13B8F2C39C2726DD/100
- thi####.q####.cn/qqapp/101036803/746D24E414E1D913C5F8D38DA941324A/100
- thi####.q####.cn/qqapp/101036803/78A493C18499081273DB97B4ACB2BBE3/100
- thi####.q####.cn/qqapp/101036803/7CB689FA0C0D4FE4A70F7C9E0EE70F56/100
- thi####.q####.cn/qqapp/101036803/7CE4E891F620E83160D8F97FC7143EB0/100
- thi####.q####.cn/qqapp/101036803/8C327C07D3215E4CF8EF596C157D148E/100
- thi####.q####.cn/qqapp/101036803/8E21433C792519882990CEB46104D15A/100
- thi####.q####.cn/qqapp/101036803/93109E7699710C20A546536FDAAE4AEC/100
- thi####.q####.cn/qqapp/101036803/93CE01500AA836083BC04EE56FC63282/100
- thi####.q####.cn/qqapp/101036803/9A1AEE2A70F4498761A1302F6700E0AF/100
- thi####.q####.cn/qqapp/101036803/A15C40CDE2C76C529A38759E1D7BA265/100
- thi####.q####.cn/qqapp/101036803/A2FDC363B6BEDCFFD47E9012466505CB/100
- thi####.q####.cn/qqapp/101036803/A4D6091B444FD48A1EA38B00393EFF65/100
- thi####.q####.cn/qqapp/101036803/A6EE65AF7339200B38685228EDC1F985/100
- thi####.q####.cn/qqapp/101036803/AF4E178590C3227254AB9799AED0B83D/100
- thi####.q####.cn/qqapp/101036803/B028B79EA26B1E762B94F0A0FCD2042A/100
- thi####.q####.cn/qqapp/101036803/B1D4887F81F0BE027A589DA837849D52/100
- thi####.q####.cn/qqapp/101036803/B88EAF32748450E320C464785553DDDB/100
- thi####.q####.cn/qqapp/101036803/BAEC462115AC182FCC59B07272FF4CB2/100
- thi####.q####.cn/qqapp/101036803/BD8664AAF5CD4757648F00E9547B8114/100
- thi####.q####.cn/qqapp/101036803/C50095B46BAF0D70C0D8747901BB372D/100
- thi####.q####.cn/qqapp/101036803/C642F7807B819FCB6DFA287C000E677D/100
- thi####.q####.cn/qqapp/101036803/E3570C17275BB20E75D59B39DFBF8D1F/100
- thi####.q####.cn/qqapp/101036803/E504987D3C6440636358601CE0871234/100
- thi####.q####.cn/qqapp/101036803/E57859B939AA8E8BF8E6626A6DA631B7/100
- thi####.q####.cn/qqapp/101036803/E7BA0A1C961C103DE605A4C184843731/100
- thi####.q####.cn/qqapp/101036803/E88C8F2454C0C78DA98AAF1E17A4E7EF/100
- thi####.q####.cn/qqapp/101036803/E97D7FE8E44CCCCE69626A323CDBB42C/100
- thi####.q####.cn/qqapp/101036803/EEFE58AD14CF35FCC29CBFF106E3B12F/100
- thi####.q####.cn/qqapp/101036803/EF59A712CA573CF21ADADA1733E08A38/100
- thi####.q####.cn/qqapp/101036803/F4F911A792FBD1B364EA07D6AC7D6BC6/100
- thi####.q####.cn/qqapp/101036803/FB6DB3D5688B3F0D0CD3ACCF8E06462B/100
- thi####.q####.cn/qqapp/101036803/FFFCD8FCA152F63C79069E896456C8A4/100
Запросы HTTP POST:
- a####.u####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/.log.lock
- /data/data/####/.log.ls
- /data/data/####/0.jar
- /data/data/####/aa.xml
- /data/data/####/aa356507059351895.xml
- /data/data/####/bb356507059351895.xml
- /data/data/####/cache.db
- /data/data/####/cache.db-journal
- /data/data/####/cc356507059351895.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/index
- /data/data/####/libjiagu.so
- /data/data/####/mFile_history.xml
- /data/data/####/mobclick_agent_online_setting_com.leleketang.szuowen.xml
- /data/data/####/soi.db-journal
- /data/data/####/umeng_feedback_conversations.xml
- /data/data/####/umeng_feedback_user_info.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- ii
- libjiagu
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
