Android.Packed.37748

Техническая информация

Вредоносные функции:

Загружает на исполнение код следующих детектируемых угроз:

Android.DownLoader.2083
Android.DownLoader.546.origin

Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).

Сетевая активность:

Подключается к:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) h####.ced####.com:80
TCP(HTTP/1.1) st####.tu####.com:80
TCP(HTTP/1.1) ap-nort####.aws.b####.####.com:80
TCP(HTTP/1.1) i2-ykjb####.i####.cedexis####.net:80
TCP(HTTP/1.1) incapsu####.ced####.com:80
TCP(HTTP/1.1) p####.b####.cedexis####.com:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) s####.pape####.com:80
TCP(HTTP/1.1) az31####.vo.ms####.net:80
TCP(HTTP/1.1) cedex####.k####.com:80
TCP(HTTP/1.1) cedexis####.l####.net:80
TCP(HTTP/1.1) cedexis####.d####.cdn.####.net:80
TCP(HTTP/1.1) i2-uhii####.i####.cedexis####.net:80
TCP(HTTP/1.1) rpt.ced####.com:80
TCP(HTTP/1.1) ced####.pc.cdn.####.com:80
TCP(HTTP/1.1) helloki####.tu####.com:80
TCP(HTTP/1.1) as####.tu####.com:80
TCP(TLS/1.0) sb.scoreca####.com.####.net:443
TCP(TLS/1.0) s####.tx####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) ssl.google-####.com:443
TCP(TLS/1.0) as####.tu####.com:443
TCP(TLS/1.0) 78.m####.tu####.com:443
TCP(TLS/1.0) geo.y####.com:443
TCP(TLS/1.0) udc.y####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) www.go####.nl:443
TCP(TLS/1.0) adser####.go####.com:443
TCP(TLS/1.0) d####.add####.com.####.net:443
TCP(TLS/1.0) px.s####.tu####.com:443
TCP(TLS/1.0) api.critter####.com:443

Запросы DNS:

78.m####.tu####.com
a.appj####.com
adser####.go####.com
ap-nort####.aws.b####.####.com
ap-nort####.aws.b####.####.com
ap-sout####.aws.b####.####.com
api.critter####.com
as####.tu####.com
az31####.vo.ms####.net
cedex####.k####.com
geo.y####.com
h####.ced####.com
helloki####.tu####.com
i2-licu####.i####.cedexis####.net
i2-uhii####.i####.cedexis####.net
i2-ykjb####.i####.cedexis####.net
incapsu####.ced####.com
limel####.ced####.com
p####.b####.cedexis####.com
px.s####.tu####.com
rpt.ced####.com
s####.pape####.com
s####.tx####.com
s7.add####.com
sb.scoreca####.com
sf####.ced####.com
ssl.google-####.com
ssl.gst####.com
st####.tu####.com
tata-bi####.ced####.com
udc.y####.com
www.go####.com
www.go####.nl
www.google-####.com
www.gst####.com

Запросы HTTP GET:

ap-nort####.aws.b####.####.com/img/33250/r20.gif?rnd=####
ap-nort####.aws.b####.####.com/img/33254/r20.gif?rnd=####
as####.tu####.com/assets/html/iframe/login_check.html?_v=####
as####.tu####.com/assets/scripts/pre_tumblelog.js?_v=####
as####.tu####.com/assets/scripts/tumblelog_post_message_queue.js?_v=####
as####.tu####.com/assets/scripts/vendor/cedexis/1-13960-radar10.min.js?_...
as####.tu####.com/client/prod/standalone/tumblelog/index.build.js?_v=####
as####.tu####.com/fonts/gibson/stylesheet.css?v=####
as####.tu####.com/images/iphone/tumblelog/bg.png
as####.tu####.com/images/iphone/tumblelog_retina/content_bg.png
as####.tu####.com/images/iphone/tumblelog_retina/content_bottom.png
as####.tu####.com/images/iphone/tumblelog_retina/content_top.png
as####.tu####.com/images/iphone/tumblelog_retina/note_like.png
as####.tu####.com/images/iphone/tumblelog_retina/note_reblog.png
az31####.vo.ms####.net/img/249b/iuni3.html?rnd=####
az31####.vo.ms####.net/img/249b/r20.gif?rnd=####
ced####.pc.cdn.####.com/img/35/iuni3.html?rnd=####
ced####.pc.cdn.####.com/img/35/r20.gif?rnd=####
cedex####.k####.com/img/18060/r20.gif?rnd=####
cedexis####.d####.cdn.####.net/img/102/r20.gif?rnd=####
cedexis####.l####.net/img/20/iuni3.html?rnd=####
cedexis####.l####.net/img/20/r20.gif?rnd=####
h####.ced####.com/img/18/iuni3.html?rnd=####
h####.ced####.com/img/r20.gif?rnd=####
helloki####.tu####.com/
helloki####.tu####.com/assets/src/scripts/tumblr/dashboard/px.js?ch=####
helloki####.tu####.com/assets/src/scripts/tumblr/dashboard/showads.js
helloki####.tu####.com/images/tumblr_android_icn.png
helloki####.tu####.com/post/90040704617/top-android
helloki####.tu####.com/post/91121090792
helloki####.tu####.com/post/91121090792/how-to-clip-a-photo
i2-uhii####.i####.cedexis####.net/i2/1/13960/j1/20/74/1526454004/provide...
i2-ykjb####.i####.cedexis####.net/i2/1/13960/j1/20/74/1526453993/provide...
incapsu####.ced####.com/h1/32627/d20.html?rnd=####
p####.b####.cedexis####.com/img/290/r20.gif?rnd=####
rpt.ced####.com/f1/_CgJqMRAUGEoiBQgBEIhtKLue9uQLMLWVXTi0tPTXBUCss6cZShQI...
rpt.ced####.com/f1/_CgJqMRAUGEoiBQgBEIhtKPf-n6wFMLaVXTjDtPTXBUCthavdBkoU...
rpt.ced####.com/n1/0/1526453992022/1526453992293/1526453992293/0/0/15264...
rpt.ced####.com/n1/0/1526454001048/1526454001487/1526454001487/0/0/15264...
st####.tu####.com/thpaaos/HBrlbfdoy/loading.gif

Запросы HTTP POST:

a.appj####.com/ad-service/ad/mark
helloki####.tu####.com/services/cslog
s####.pape####.com/hellokitty/api/get_max_category_id?client_type=####&i...

Изменения в файловой системе:

Создает следующие файлы:

/data/data/####/.jg.ic
/data/data/####/.log.lock
/data/data/####/.log.ls
/data/data/####/37710334590_407f2834-5abf-4ac6-8815-1d247b6f008d.log
/data/data/####/37731882704_c8cec121-d265-4aa5-8255-f3ccffb2f53f.log
/data/data/####/38751386320_9362428e-c668-4f5c-809d-fb9a1dca44b3.log
/data/data/####/63815548583_ffa8a260-db6f-4973-b962-ef56051efe10.log
/data/data/####/HKPreference.xml
/data/data/####/NewEditPhotoActivity.xml
/data/data/####/WebViewSettings.xml
/data/data/####/com.crittercism.optmz.config.xml
/data/data/####/com.crittercism.usersettings.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/gaClientId
/data/data/####/google_analytics_v2.db-journal
/data/data/####/hellokitty-journal
/data/data/####/index
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/jp.co.ezevsanriowave.android.papelook.hellokitt...e.odex
/data/data/####/jp.co.ezevsanriowave.android.papelook.hellokitt...es.xml
/data/data/####/jp.co.ezevsanriowave.android.papelook.hellokitt...ge.zip
/data/data/####/libjiagu.so
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/media/####/.nomedia
/data/media/####/BPdots.otf
/data/media/####/Geotica_2012.otf
/data/media/####/GlassAntiqua-Regular.ttf
/data/media/####/GrandHotel-Regular.otf
/data/media/####/HEARRG__.TTF
/data/media/####/KodomoRounded.otf
/data/media/####/LT Chickenhawk.ttf
/data/media/####/PAPERWORK-Striped.otf
/data/media/####/Planetarium.otf
/data/media/####/ZalamanderCaps-Bold.otf
/data/media/####/heavy_data.ttf

Другие:

Запускает следующие shell-скрипты:

chmod 755 <Package Folder>/.jiagu/libjiagu.so

Загружает динамические библиотеки:

libjiagu

Использует следующие алгоритмы для расшифровки данных:

Использует специальную библиотеку для скрытия исполняемого байткода.

Осуществляет доступ к информации о сети.

Осуществляет доступ к информации о телефоне (номер, imei и тд.).

Отрисовывает собственные окна поверх других приложений.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней