Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Xiny.224.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) f####.me:80
- TCP(HTTP/1.1) c.appj####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) www.fishmo####.cn:80
- TCP(HTTP/1.1) f####.u####.com:80
- TCP(HTTP/1.1) imag####.com:80
- TCP(TLS/1.0) syndica####.twi####.com:443
- TCP(TLS/1.0) f####.me:443
- TCP(TLS/1.0) cs2-wa####.8####.e####.net:443
- TCP(TLS/1.0) twi####.com:443
- TCP(TLS/1.0) mo####.twi####.com:443
- TCP(TLS/1.0) t####.co:443
- TCP(TLS/1.0) ma.t####.com:443
Запросы DNS:
- a####.u####.com
- c####.mm####.com
- c.appj####.com
- c.c####.com
- f####.me
- f####.u####.com
- i####.c####.com
- im####.score####.com
- imag####.com
- ma.t####.com
- mo####.twi####.com
- oc.u####.co
- oc.u####.com
- pbs.t####.com
- s11.c####.com
- syndica####.twi####.com
- t####.co
- twi####.com
- www.fishmo####.cn
- z13.c####.com
Запросы HTTP GET:
- c.c####.com/core.php?web_id=####&show=####&t=####
- c.c####.com/img/pic.gif
- c.c####.com/z_stat.php?id=####&show=####
- f####.me/771nzlRr4
- f####.u####.com/css?family=####
- gm.mm####.com/9.gif?abc=####&rnd=####
- imag####.com/images/icon/201404261442.png
- imag####.com/images/icon/201412130302.png
- imag####.com/images/icon/201412131503.png
- imag####.com/images/icon/201412141221.png
- imag####.com/images/icon/201501120929.png
- imag####.com/images/icon/201502122046.png
- imag####.com/images/icon/201503171557.png
- imag####.com/images/icon/201503261658.png
- imag####.com/images/icon/201505071507.png
- imag####.com/images/icon/201505301029.png
- imag####.com/images/icon/201506301037.png
- imag####.com/images/icon/201507202130.png
- imag####.com/images/icon/201508041009.png
- imag####.com/images/icon/201509072148.png
- imag####.com/images/icon/201510312012.png
- imag####.com/images/icon/201511241708.png
- imag####.com/images/icon/201512131039.png
- imag####.com/images/icon/201601031106.png
- imag####.com/images/icon/201601141538.png
- imag####.com/images/icon/201601161139.png
- imag####.com/images/icon/201601201550.png
- imag####.com/images/icon/201601241658.png
- imag####.com/images/icon/201601261021.png
- imag####.com/images/icon/201602212159.png
- imag####.com/images/icon/201603032159.png
- imag####.com/images/icon/201603081026.png
- imag####.com/images/icon/201603171400.png
- imag####.com/images/icon/201603221520.png
- imag####.com/images/icon/20160401213.png
- imag####.com/images/icon/201604141857.png
- imag####.com/images/icon/201604181910.png
- imag####.com/images/icon/201606071135.png
- imag####.com/images/icon/201606212201.png
- imag####.com/images/icon/201607061700.png
- imag####.com/images/icon/201609172144.png
- imag####.com/images/icon/201610121736.png
- imag####.com/images/icon/201610200947.png
- imag####.com/images/icon/201610291912.png
- imag####.com/images/icon/201612211237.png
- imag####.com/images/icon/201702152126.png
- imag####.com/images/icon/201702171636.png
- imag####.com/images/icon/201702191828.png
- imag####.com/images/icon/201702211112.png
- imag####.com/images/icon/201702221956.png
- imag####.com/images/icon/201702242011.png
- imag####.com/images/icon/201702252108.png
- imag####.com/images/icon/201703011452.png
- imag####.com/images/icon/201703030947.png
- imag####.com/images/icon/201703082053.png
- imag####.com/images/icon/201703111846.png
- imag####.com/images/icon/201703141540.png
- imag####.com/images/icon/201703151530.png
- imag####.com/images/icon/201703152013.png
- imag####.com/images/icon/201703181523.png
- imag####.com/images/icon/201703201548.png
- imag####.com/images/icon/201703221026.png
- imag####.com/images/icon/201703222144.png
- imag####.com/images/icon/201703241040.png
- imag####.com/images/icon/201704071356.png
- imag####.com/images/icon/201704090936.png
- imag####.com/images/icon/201704112208.png
- imag####.com/images/icon/201704161954.png
- imag####.com/images/icon/201704201245.png
- imag####.com/images/icon/201704230923.png
- imag####.com/images/icon/201705221025.png
- imag####.com/images/icon/201706191325.png
- imag####.com/images/icon/201706271949.png
- imag####.com/images/icon/201706282129.png
- imag####.com/images/icon/201707210938.png
- imag####.com/images/icon/201801080929.png
- imag####.com/images/icon/201802271122.png
- www.fishmo####.cn/
- www.fishmo####.cn/css/animate.css
- www.fishmo####.cn/css/font-awesome.min.css
- www.fishmo####.cn/css/lightbox.css
- www.fishmo####.cn/css/style.css
- www.fishmo####.cn/favicon.ico
- www.fishmo####.cn/fonts/fontawesome-webfont.ttf?v=####
- www.fishmo####.cn/images/appleIcon.png
- www.fishmo####.cn/images/close.png
- www.fishmo####.cn/images/divider-shadow1.png
- www.fishmo####.cn/images/googleicon.png
- www.fishmo####.cn/images/loading.gif
- www.fishmo####.cn/images/next.png
- www.fishmo####.cn/images/prev.png
- www.fishmo####.cn/images/slide01.jpg
- www.fishmo####.cn/js/SmoothScroll.js
- www.fishmo####.cn/js/bootstrap.min.js
- www.fishmo####.cn/js/custom.js
- www.fishmo####.cn/js/jfish.js
- www.fishmo####.cn/js/jquery-1.7.2.js
- www.fishmo####.cn/js/jquery.blockUI.js
- www.fishmo####.cn/js/jquery.min.js
- www.fishmo####.cn/js/jquery.tips.js
- www.fishmo####.cn/js/lightbox-2.6.min.js
- www.fishmo####.cn/js/scrolltopcontrol.js
- www.fishmo####.cn/js/sweet-alert/sweet-alert.css
- www.fishmo####.cn/js/sweet-alert/sweet-alert.js
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Запросы HTTP POST:
- a####.u####.com/app_logs
- c.appj####.com/ad/splash/stats.html
- oc.u####.com/check_config_update
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.appkey
- /data/data/####/.jg.ic
- /data/data/####/ad_show_time.xml
- /data/data/####/asset
- /data/data/####/asset_de
- /data/data/####/jg_app_update_settings_random.xml
- /data/data/####/libjiagu.so
- /data/data/####/libjiagu_ls.so
- /data/data/####/libjiagu_x86.so
- /data/data/####/localStorage.xml
- /data/data/####/mobclick_agent_header_com.longgame.baoshistar.xml
- /data/data/####/mobclick_agent_state_com.longgame.baoshistar.xml
- /data/data/####/scoreloop.properties
- /data/data/####/webview.db-journal
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- SpiderTeam
- libjiagu
Использует следующие алгоритмы для шифрования данных:
- RSA
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Отрисовывает собственные окна поверх других приложений.
