Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Gexin.1.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) w####.18t####.com.####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) api.18t####.com:80
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) www.googlea####.com:443
- TCP(TLS/1.0) 254####.fls.doublec####.net:443
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) pri####.go####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) h####.b####.com.####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) s####.g.doublec####.net:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) www.google-####.com:443
- TCP(TLS/1.0) a####.google####.com:443
- TCP(TLS/1.0) p####.go####.com:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) poli####.go####.com:443
- TCP im.j####.cn:3003
- TCP im.j####.cn:3000
- UDP s.j####.cn:80
- UDP s.j####.cn:19000
Запросы DNS:
- 254####.fls.doublec####.net
- a####.google####.com
- a####.u####.com
- adser####.go####.com
- adser####.go####.nl
- api.18t####.com
- api.s####.b####.com
- b####.s####.b####.com
- c####.mm####.com
- c.c####.com
- easytom####.com
- f####.google####.com
- f####.gst####.com
- googl####.g.doublec####.net
- goonc####.com
- h####.b####.com
- h####.c####.com
- hm.b####.com
- im.j####.cn
- m.18t####.com
- mt####.go####.com
- nsc####.b####.com
- p####.go####.com
- poli####.go####.com
- pri####.go####.com
- qn.18t####.com
- r####.wx.qq.com
- s####.g.doublec####.net
- s.j####.cn
- s11.c####.com
- ssl.gst####.com
- www.18t####.com
- www.go####.com
- www.go####.nl
- www.google-####.com
- www.googlea####.com
- www.googlet####.com
- www.gst####.com
Запросы HTTP GET:
- api.18t####.com/?c=####&a=####&app=####&act=####&vs=####&url=/ap####&a=#...
- api.18t####.com/?c=####&a=####&dk=####&ak=####
- api.18t####.com/index.php?c=####&a=####&ids=####&dk=####&ak=####
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/stat.php?id=####&web_id=####
- gm.mm####.com/9.gif?abc=####&rnd=####
- hm.b####.com/h.js?50d28fd####
- hm.b####.com/h.js?ff598de####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?6b0d092####
- hm.b####.com/hm.js?ca01a95####
- s####.jom####.com/static/api/css/share_style1_24.css
- s####.jom####.com/static/api/img/share/icons_1_24.png?v=####
- s####.jom####.com/static/api/js/base/tangram.js?v=####
- s####.jom####.com/static/api/js/component/partners.js?v=####
- s####.jom####.com/static/api/js/share.js?v=89860593.js?cdnversion=####
- s####.jom####.com/static/api/js/share/api_base.js
- s####.jom####.com/static/api/js/share/share_api.js?v=####
- s####.jom####.com/static/api/js/trans/logger.js?v=####
- s####.jom####.com/static/api/js/view/share_view.js?v=####
- s####.jom####.com/static/api/js/view/view_base.js
- s####.jom####.com/v.gif
- s####.tc.qq.com/open/js/jweixin-1.0.0.js
- t####.c####.q####.####.com/uploads/20151110/1447125457605273.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125464412999.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125472315686.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125479533049.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125486570736.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125494688264.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125494916504.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125501642242.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125511307396.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125518445518.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125525488766.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125533284866.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125539630373.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125614821414.jpg
- t####.c####.q####.####.com/uploads/20151110/1447125831218561.jpg
- w####.18t####.com.####.com/Public/Mobile/css/index.css?t=####
- w####.18t####.com.####.com/Public/Mobile/images/logo.png?t=####
- w####.18t####.com.####.com/Public/Mobile/images/menuButton2.png
- w####.18t####.com.####.com/Public/Mobile/images/searchButton2.png
- w####.18t####.com.####.com/Public/Mobile/images/share-icon/QQ.png
- w####.18t####.com.####.com/Public/Mobile/images/share-icon/kj.png
- w####.18t####.com.####.com/Public/Mobile/images/share-icon/wb.png
- w####.18t####.com.####.com/Public/Mobile/images/share-icon/wx.png
- w####.18t####.com.####.com/Public/Mobile/images/web_content_loading.png
- w####.18t####.com.####.com/Public/Mobile/js/chw-photoview-mobile.js
- w####.18t####.com.####.com/Public/Mobile/js/com.js?t=####
- w####.18t####.com.####.com/Public/Mobile/js/mobile-detail.js?v=####
- w####.18t####.com.####.com/Public/Mobile/js/touch.js
- w####.18t####.com.####.com/Public/Mobile/js/touchLoad.js
- w####.18t####.com.####.com/Public/Mobile/js/zepto.min.js
- w####.18t####.com.####.com/Public/Mobile/js/zeptoModules/fx.js
- w####.18t####.com.####.com/Public/Mobile/js/zeptoModules/fx_methods.js
- w####.18t####.com.####.com/Public/Mobile/js/zeptoModules/selector.js
- w####.18t####.com.####.com/Public/Mobile/js/zeptoModules/zepto.lazyload....
- w####.18t####.com.####.com/Public/js/mobile/common/iscroll.min-5.1.3.js
- w####.18t####.com.####.com/Public/js/sea.js
- w####.18t####.com.####.com/xr01.html
- w####.18t####.com.####.com/xr01.html?os=####
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Запросы HTTP POST:
- a####.u####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.lostjiagu
- /data/data/####/AdsMogo_CacheData.txt
- /data/data/####/JPushSA_Config.xml
- /data/data/####/WebViewSettings.xml
- /data/data/####/cn.jpush.serverconfig.xml
- /data/data/####/com.touch18.jzds.app_preferences.xml
- /data/data/####/com.touch18.jzds.app_preferences.xml.bak
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/demo_BannerData.txt
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/index
- /data/data/####/jpush_local_notification.db
- /data/data/####/jpush_local_notification.db-journal
- /data/data/####/jpush_stat_cache.json
- /data/data/####/jpush_stat_cache_history.json
- /data/data/####/libjiagu.so
- /data/data/####/mobclick_agent_online_setting_com.touch18.jzds.app.xml
- /data/data/####/openudid_prefs.xml
- /data/data/####/rep.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/.push_deviceid
- /data/media/####/4hcx1qr7azdfdpihhojcl26dz
Другие:
Загружает динамические библиотеки:
- jpush164
- libjiagu
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
