Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.683.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.0) 4####.92.62.1:80
- TCP(HTTP/1.0) pis.al####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) s.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) cdn.game####.org:80
- TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) pus.al####.com:80
- TCP(HTTP/1.1) cdn.app.h####.####.com:80
- TCP(HTTP/1.1) pss.al####.com:80
- TCP(HTTP/1.1) api.paoh####.com:80
- TCP(HTTP/1.1) www.paoh####.com:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(TLS/1.0) pns.al####.com:443
- TCP(TLS/1.0) coveri####.s3.cn-nor####.####.cn:443
- TCP(TLS/1.0) l####.4####.top:443
- UDP 1####.168.72.254:4466
Запросы DNS:
- a####.u####.com
- api.paoh####.com
- au.u####.co
- au.u####.com
- cdn.app.h####.top
- cdn.game####.org
- coveri####.s3.cn-nor####.####.cn
- l####.4####.top
- log.u####.com
- mp3####.paoh####.com
- o84v9####.bkt.clo####.com
- pis.al####.com
- pns.al####.com
- pss.al####.com
- pus.al####.com
- www.paoh####.com
Запросы HTTP GET:
- api.paoh####.com/
- api.paoh####.com/home-recommendations
- api.paoh####.com/recommendations?mode=####
- api.paoh####.com/song-lists/5b1884a767fd106c34ab55d4
- api.paoh####.com/song-lists/5b1c95b2bc84458c19fe2fbb
- api.paoh####.com/song-pool?tempo=####&mode=####
- cdn.app.h####.####.com/swenjian/321
- cdn.app.h####.####.com/swenjian/321m
- cdn.game####.org/strategy/base
- cdn.game####.org/strategy/dev_root2
- cdn.game####.org/strategy/larger4.3
- cdn.game####.org/strategy/loss_4.3
- cdn.game####.org/strategy/sul18
- pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
- sh.wagbr####.alibaba####.com/bar/get/5563377967e58e12ce001117/?ud_get=####
- sh.wagbr####.alibaba####.com/share/keysecret/5563377967e58e12ce001117/?u...
- t####.c####.q####.####.com/19036663.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/22808839.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/22853023.jpg?q=####
- t####.c####.q####.####.com/27612175.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/280040.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/28409843.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/28724372.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/28731361.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/28838750.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/29027487.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/348070.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/368293.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/41667850.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/431167.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/524843.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/5410046.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/5635a543208d8b2084a1b56b.jpg?imageMo####&imag...
- t####.c####.q####.####.com/564ee119bd5bf0ea52516907.jpg?imageMo####&imag...
- t####.c####.q####.####.com/568fd466ca3b24b945d75642.jpg?imageMo####&imag...
- t####.c####.q####.####.com/56f35c73d72a6ce34c1b54bf.jpg?imageMo####&imag...
- t####.c####.q####.####.com/93974.jpg?imageMo####&imageVi####
- t####.c####.q####.####.com/song-list-0BD23990-81A1-411C-91E4-1ED7978C5FA...
- t####.c####.q####.####.com/song-list-14a838e0-3c0d-40c6-8583-5c2390cb98f...
- t####.c####.q####.####.com/song-list-64b7087a-4557-40b1-9b31-28f5a42a840...
- t####.c####.q####.####.com/song-list-song-list-42A7E5C1-7D4B-4B04-B6F2-5...
- t####.c####.q####.####.com/song-list/25657522.jpg?q=####&imageMo####&ima...
- t####.c####.q####.####.com/song-list/27514263.jpg?q=####&imageMo####&ima...
- t####.c####.q####.####.com/song-list/435002f8-4140-45c1-a2cf-4361071ba8d...
- t####.c####.q####.####.com/song-list/5635a547208d8b2084a1b56d.jpg?q=####...
- t####.c####.q####.####.com/song-list/56455fde3e7840847a9c7cd2.jpg?q=####...
- t####.c####.q####.####.com/song-list/564593533e7840847a9c7d1c.jpg?q=####...
- t####.c####.q####.####.com/song-list/56540d39266829822e47333b.jpg?q=####...
- t####.c####.q####.####.com/song-list/565e6037059d74d8300d5457.jpg?q=####...
- t####.c####.q####.####.com/song-list/566a659e9c8d48916dcbb123.jpg?q=####...
- t####.c####.q####.####.com/song-list/56987a48d8ac93b77785bd5d.jpg?q=####
- t####.c####.q####.####.com/song-list/56987a48d8ac93b77785bd5d.jpg?q=####...
- t####.c####.q####.####.com/song-list/56a1fb1ee9105c5062071554.jpg?q=####...
- t####.c####.q####.####.com/song-list/56cb1ffc28ae5f7c40d9e750.jpg?q=####
- t####.c####.q####.####.com/song-list/56ecce066185a66d0bf00173.jpg?q=####...
- t####.c####.q####.####.com/song-list/571f088bab3c7a2e0c03b850.jpg?q=####
- t####.c####.q####.####.com/song-list/571f088bab3c7a2e0c03b850.jpg?q=####...
- t####.c####.q####.####.com/song-list/572c6dbe0533e65a06f641bb.jpg?q=####
- t####.c####.q####.####.com/song-list/57330f6f6b478637634da8c8.hero?q=###...
- t####.c####.q####.####.com/song-list/57359870b39e63d52831689b.jpg?q=####
- t####.c####.q####.####.com/song-list/573d9d48298e44e3708acff2.jpg?q=####
- t####.c####.q####.####.com/song-list/64df1fef-6b9f-4739-8581-88234f9be77...
- t####.c####.q####.####.com/song-list/88bce1ef-e72f-4d96-9721-6e057ed66ad...
- www.paoh####.com/PHL_web.html
Запросы HTTP POST:
- a####.u####.com/app_logs
- pis.al####.com/p/pcdn/i.php?v=####
- pss.al####.com/iku/log/acc
- pss.al####.com/iku/log/acc?ver=####&flag=####&t=####&mytype=####
- s.wagbr####.alibaba####.com/api/check_app_update
- sh.wagbr####.alibaba####.com/share/keysecret/5563377967e58e12ce001117/
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/01c6e125-7c20-40a6-9ad2-2cdc32541ab6
- /data/data/####/05a8906c-14a3-4f0a-ac12-5169e502886d
- /data/data/####/1740c449fc10be62df60ba0f18696c9f
- /data/data/####/27326936-c0bf-49c6-a30e-5fde707f4f66
- /data/data/####/31bd9b40-fa15-4a5f-a63a-cb19e7016bf4
- /data/data/####/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/5b1490ff-c9c5-4c78-b087-909e00a85068
- /data/data/####/87ad0d70-a31a-4baf-955b-9ecb1e719a22
- /data/data/####/Iz.xml
- /data/data/####/Matrix
- /data/data/####/SUBOXLOG_
- /data/data/####/Ykv.jar
- /data/data/####/Ykv.xml
- /data/data/####/app_preference.xml
- /data/data/####/b0141e478b25af7c40a8cca8de6c4708
- /data/data/####/bf526d00-afcc-4323-aeba-f074ffc150c3.jar
- /data/data/####/bzwn.db-journal
- /data/data/####/ddexe
- /data/data/####/debuggerd
- /data/data/####/device.db
- /data/data/####/ebn.xml
- /data/data/####/ebn.xml.bak
- /data/data/####/exchangeIdentity.json
- /data/data/####/fileWork
- /data/data/####/install-recovery.sh
- /data/data/####/jg_so_upgrade_setting.xml
- /data/data/####/journal.tmp
- /data/data/####/libjiagu.so
- /data/data/####/libpcdn_acc.zip
- /data/data/####/libpcdn_acc_new.so
- /data/data/####/pcdnconfigs.xml
- /data/data/####/pidof
- /data/data/####/root3
- /data/data/####/su
- /data/data/####/supolicy
- /data/data/####/toolbox
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_social_method.xml
- /data/data/####/umeng_socialize.xml
- /data/data/####/umeng_socialize_key.xml
- /data/data/####/umeng_socialize_secret.xml
- /data/data/####/wsroot.sh
- /data/media/####/01786edb138851e8137ad62a3ff9e0b2.0
- /data/media/####/07934e8c114827da7b08afebc56dd000.0
- /data/media/####/07934e8c114827da7b08afebc56dd000.0.tmp (deleted)
- /data/media/####/1378e1f4549023d2d43dde92f84d10d1.0
- /data/media/####/1619a0919445e33d40fcdc5c7b772a4f.0
- /data/media/####/165f4453bfc00e9eef362b1b6b7903a7.0
- /data/media/####/235e42476c75015f0e661b71a6f00c0f.0
- /data/media/####/246fe9d1c1f5d16ee3e3037309f7e7da.0
- /data/media/####/246fe9d1c1f5d16ee3e3037309f7e7da.0.tmp (deleted)
- /data/media/####/25a35f3d6276c966b2487763a4f127fa.0
- /data/media/####/29093ca8cc3b3cb36024f93a48f31d52.0
- /data/media/####/2962f657866dc412dda293a4d6ce9c3b.0
- /data/media/####/324029b6bb957d9ffaeaef16353d02fa.0
- /data/media/####/3ddaced5c3609493cb141eb25d67e9df.0
- /data/media/####/478d17fa4dc2c8ec4cae3d9192042005.0
- /data/media/####/4f3848caf91d59aae5995161c01295c5.0
- /data/media/####/592e5d70e3912f91006bca0663b28766.0
- /data/media/####/5e0f4762877e3a5eca947dbd07b19a70.0
- /data/media/####/5f07040e391f497a435df9dfce195824.0
- /data/media/####/6e9ae523b31372927f9a154b24702d14.0
- /data/media/####/6f397d8f4e95498c8c6ac33e574e5fbd.0
- /data/media/####/72dc23bc3e3bddc42fb587147a1cb97e.0
- /data/media/####/7482f6cbb0dd7ec1d39b6a3ea144bdc3.0
- /data/media/####/7cbfeac4f9c2a648bdf3c3f636cb5ccf.0
- /data/media/####/85386118a09451baa7e3c4a75925ba08.0
- /data/media/####/8f746ab603d75b4e5190500bd4c2ed88.0
- /data/media/####/906c6ae22915428db091a496ec351438.0
- /data/media/####/95fac2615455487b0c54bc1b5e3514c0.0
- /data/media/####/95fac2615455487b0c54bc1b5e3514c0.0.tmp (deleted)
- /data/media/####/9b41c502251fae0906a5a0fa989ba849.0
- /data/media/####/9daa2dbc7da938aa2e41e3e0e06cdb49.0
- /data/media/####/9daa2dbc7da938aa2e41e3e0e06cdb49.0.tmp (deleted)
- /data/media/####/a87811aff76adc1796d2650a705b7698.0
- /data/media/####/a8f2a1efbbde6e2dcf947e915f9a4d21.0
- /data/media/####/add086c4100a07c5caecbca287a5e63e.0
- /data/media/####/b519af9e4ff519376afab804d21acf66.0
- /data/media/####/b51b2b4d03ef17383f28b9f7aa34877e.0
- /data/media/####/b7e0ddf12f0dd9a2ec468fb6628ef91e.0
- /data/media/####/ba297e7ad5fd404164d9af154041c717.0
- /data/media/####/be94901a08728950a73a702cac0f75d0.0
- /data/media/####/bf232a0a5669a828879b05abaabd3cd2.0
- /data/media/####/c0153a5b3ef7f180899d274b7322e76c.0
- /data/media/####/c0a91ea8ed61264e1169b6948f358798.0
- /data/media/####/c891fcce30ce9f756bd587995d203959.0
- /data/media/####/cb6e1c83c292e58bc5f3bfc92ac0b358.0
- /data/media/####/d62d4681db8358c1e513a2dac45d57f7.0
- /data/media/####/d7a4ade0debdcc8842bc7e769831ca45.0
- /data/media/####/d8af09276de677cecae060bfa1ade9c3.0
- /data/media/####/dce182ed3c7458948d964958633cacb0.0
- /data/media/####/e0689e8180e1c797a93a6575ab6c2284.0
- /data/media/####/eba7c0f0fb8d4d8bd6b602d2532435bc.0
- /data/media/####/f30e2cc017daf4f78b3bb2d4a05fb6a5.0
- /data/media/####/f30e2cc017daf4f78b3bb2d4a05fb6a5.0.tmp (deleted)
- /data/media/####/f3a23fe7a3cf2430969e9742b30cc01d.0
- /data/media/####/f902641f9416f67b1eee712ff40a7b64.0
- /data/media/####/ff7bba14d2d07e774d13bc3e2ec95f89.0
- /data/media/####/journal.tmp
- /data/media/####/myself.dat
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
Загружает динамические библиотеки:
- bspatch
- libjiagu
- libpcdn_acc
- pcdn_acc
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
