Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.YtAd.1.origin
- Android.Triada.182
- Android.Triada.226.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) u####.umengc####.com:80
- TCP(HTTP/1.1) mo####.b####.com:80
- TCP(HTTP/1.1) www.babyhaz####.com:80
- TCP(HTTP/1.1) a.appj####.com:80
- TCP(HTTP/1.1) 1####.205.203.104:8015
- TCP(HTTP/1.1) msg.umengc####.com:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) sc####.craz####.com:80
- TCP(HTTP/1.1) a####.m.ta####.com:80
- TCP(HTTP/1.1) mobads-####.b####.com:80
- TCP(HTTP/1.1) www.google-####.com:80
- TCP(HTTP/1.1) api.m.ta####.com:80
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) mobads-####.b####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) pag####.googles####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) f####.google####.com:443
- TCP(TLS/1.0) hm.b####.com:443
Запросы DNS:
- a####.m.ta####.com
- a####.u####.com
- a.appj####.com
- adser####.go####.com
- adser####.go####.nl
- api.dreama####.com
- app.91sh####.com
- f####.google####.com
- f####.gst####.com
- googl####.g.doublec####.net
- hm.b####.com
- mo####.b####.com
- mobads-####.b####.com
- msg.umengc####.com
- pag####.googles####.com
- sc####.craz####.com
- ssl.google-####.com
- tpc.googles####.com
- u####.umengc####.com
- u####.umengc####.com
- www.babyhaz####.com
- www.go####.com
- www.google-####.com
Запросы HTTP GET:
- a####.m.ta####.com/rest/abtest?ak=####&av=####&c=####&v=####&s=####&d=##...
- api.m.ta####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####...
- api.m.ta####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
- mo####.b####.com/ads/ads.appcache
- mo####.b####.com/ads/css/min/main.css
- mo####.b####.com/ads/index.htm
- mo####.b####.com/ads/js/ads.trunk.js
- mo####.b####.com/ads/js/c.js
- mo####.b####.com/ads/pa/8/__pasys_remote_banner.php?bdr=####&os=####&v=#...
- mo####.b####.com/ads/pa/8/__xadsdk__remote__8.7054.jar
- mo####.b####.com/cpro/ui/mads.php?code2=####
- mo####.b####.com/cpro/ui/mads.php?code2=####&b1531576087644=####
- pag####.googles####.com/pagead/gen_204?id=####&scrl=####&adk=####&adf=##...
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/js/r20180709/r20180604/show_ads_impl.js
- sc####.craz####.com/pages/scripts/0073/3580.js
- u####.umengc####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=...
- u####.umengc####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=##...
- u####.umengc####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####...
- www.babyhaz####.com/
- www.babyhaz####.com/css/st_xc0935_002Cs.css
- www.babyhaz####.com/favicon.png
- www.babyhaz####.com/fonts/fontawesome-webfont.ttf?v=####
- www.babyhaz####.com/games/images/baby-hazel-ballerina-dance-2.png
- www.babyhaz####.com/games/images/baby-hazel-christmas-surprise.png
- www.babyhaz####.com/games/images/baby-hazel-cinderella-story.png
- www.babyhaz####.com/games/images/baby-hazel-dream-world.png
- www.babyhaz####.com/games/images/baby-hazel-dressup-world.png
- www.babyhaz####.com/games/images/baby-hazel-duck-life.png
- www.babyhaz####.com/games/images/baby-hazel-flower-girl-2.png
- www.babyhaz####.com/games/images/baby-hazel-fluffy-cat.png
- www.babyhaz####.com/games/images/baby-hazel-food-truck.png
- www.babyhaz####.com/games/images/baby-hazel-friends-forever.png
- www.babyhaz####.com/games/images/baby-hazel-frozen-adventure.png
- www.babyhaz####.com/games/images/baby-hazel-hair-day.png
- www.babyhaz####.com/games/images/baby-hazel-magic-show.png
- www.babyhaz####.com/games/images/baby-hazel-newborn-baby-2.png
- www.babyhaz####.com/games/images/baby-hazel-pet-hospital-2.png
- www.babyhaz####.com/games/images/baby-hazel-snow-white-story.png
- www.babyhaz####.com/games/images/baby-hazel-summer-camp.png
- www.babyhaz####.com/games/images/cinderella-princess-salon.png
- www.babyhaz####.com/games/images/daily-fun-games.png
- www.babyhaz####.com/games/images/little-mermaid-bubble-shooter.png
- www.babyhaz####.com/images/ajax_loader.png
- www.babyhaz####.com/images/amazon-store.png
- www.babyhaz####.com/images/android.png
- www.babyhaz####.com/images/app-store.png
- www.babyhaz####.com/images/footer_01.png
- www.babyhaz####.com/images/header_mobile.png
- www.babyhaz####.com/images/logo-hazel.png
- www.babyhaz####.com/images/logo.png
- www.babyhaz####.com/images/sprite-c.png
- www.babyhaz####.com/images/sprite.png
- www.babyhaz####.com/images/youtube.png
- www.babyhaz####.com/js/GN_CUT_MY_00745.js
- www.babyhaz####.com/js/JAUT_9847_COM_@7XPP_QUR.js
- www.babyhaz####.com/js/JEM_1.3_MIN.js
- www.babyhaz####.com/js/JFM_FLX_1323_99_MIN_0544.js
- www.babyhaz####.com/js/JFM_ORM_IN_96788_JSM.js
- www.babyhaz####.com/js/JIS_MNI_TOP_E543434.js
- www.babyhaz####.com/js/JLM_1.4MIN_LAV_678.js
- www.babyhaz####.com/js/JPP_08987_PHT_5677.js
- www.babyhaz####.com/js/JTW_TWEE_8567.js
- www.babyhaz####.com/js/JUM_JS_678_MIN_76.js
- www.babyhaz####.com/js/JVM_6785_MN_QUR.js
- www.babyhaz####.com/js/OCREL_56756_CSJ.js
- www.babyhaz####.com/js/PFR_8568_MI_US_R_656.js
- www.babyhaz####.com/js/RP_110787_TIN_8699_G.js
- www.babyhaz####.com/js/RTM_8678_MI_NA_788.js
- www.babyhaz####.com/js/S182_JMIN_03577_QUR.js
- www.babyhaz####.com/js/SCR_476_DAT_PTS.js
- www.babyhaz####.com/tuner/js/TJS_TU_0976345_JSC_PT_3976.js
- www.google-####.com/analytics.js
- www.google-####.com/r/collect?v=####&_v=####&a=####&t=####&_s=####&dl=##...
Запросы HTTP POST:
- a####.m.ta####.com/rest/gc?ak=####&av=####&c=####&v=####&s=####&d=####&s...
- a####.m.ta####.com/rest/sur?ak=####&av=####&c=####&v=####&s=####&d=####&...
- a####.u####.com/app_logs
- a.appj####.com/ad-service/ad/mark
- mobads-####.b####.com/brwhis.log
- msg.umengc####.com/v2/register
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/74akLNRa0lgA0_mKeME4zg==.new
- /data/data/####/AGOO_CONNECT.xml
- /data/data/####/AGOO_HOST.xml
- /data/data/####/ActiveDatabase-journal
- /data/data/####/AdSpecialDatabase-journal
- /data/data/####/Alvin2.xml
- /data/data/####/AppStore.xml
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/ContextData.xml
- /data/data/####/DaemonServer
- /data/data/####/E6DQ8qN8mZ53h9e8.zip
- /data/data/####/PhoneUtil.xml
- /data/data/####/SaharaMapFile.xml
- /data/data/####/UTMCBase.xml
- /data/data/####/UTMCConf707101459.xml
- /data/data/####/UTMCLog707101459.xml
- /data/data/####/__x_adsdk_agent_header__.xml
- /data/data/####/__xadsdk__remote__final__0a4f4c2a-d5f7-498d-afc...ea.jar
- /data/data/####/__xadsdk__remote__final__builtin__.jar
- /data/data/####/__xadsdk_downloaded__version__.xml
- /data/data/####/ads-383226151.jar
- /data/data/####/agoo.pid
- /data/data/####/air.androidgame.BabyHazelTreeHouse.AIRSharedPref.xml
- /data/data/####/application.xml
- /data/data/####/baby-hazel-tree-house.swf
- /data/data/####/com.baidu.mobads.loader.xml
- /data/data/####/curl-ca-bundle.crt
- /data/data/####/data.dat.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/extension.xml
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/fn5fAYyixc6wHXTKKajNgA==.new
- /data/data/####/gaClientId
- /data/data/####/geffaq_f.zip
- /data/data/####/google_analytics_v4.db-journal
- /data/data/####/http_mobads.baidu.com_0.localstorage-journal
- /data/data/####/index
- /data/data/####/javaTrustStore.tmp
- /data/data/####/jg_app_update_settings_random.xml
- /data/data/####/libjiagu.so
- /data/data/####/library.swf
- /data/data/####/mobclick_agent_online_setting_air.androidgame.B...se.xml
- /data/data/####/myPurchases.sxx
- /data/data/####/rdata_airandroidgamebabyhazeltreehouse.new
- /data/data/####/s_update.xml
- /data/data/####/u1oDeX-NdvtJAQMo
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/xO4lvQ3BOHdaVzp_LlD7qA==
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/cpuinfo
- /system/bin/cat /proc/meminfo
- /system/bin/cat /sys/devices/system/cpu/present
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -a <Package>.intent.action.COCKROACH --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 60 -c agoo.pid -P <Package Folder> -K 9527 -U tb_android_daemon_1.1.0 -L http://100.69.168.33/agoo/report -D {"package":"<Package>","appKey":"umeng:55ff757367e58e95710000f9","utdid":"W0n/C3u32VEDAGdzx1GLRyZV","sdkVersion":"20150423"} -I 100.69.168.33 -O 80 -T -Z
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- sh
Загружает динамические библиотеки:
- libCore
- libjiagu
- libstlport_shared
- tnet-2.0
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
