Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) sh.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) and####.cl####.yanqing####.####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5225
Запросы DNS:
- 7j####.c####.z0.####.com
- and####.cl####.yanqing####.com
- c####.g####.ig####.com
- c-h####.g####.com
- i####.yanqing####.com
- l####.tbs.qq.com
- log.u####.com
- plb####.u####.com
- pub-####.qin####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- u####.u####.com
Запросы HTTP GET:
- and####.cl####.yanqing####.####.com//Bookajax/downloadchapter.do?bid=###...
- and####.cl####.yanqing####.####.com//Bookajax/getUserMsgNum.do?&version=...
- and####.cl####.yanqing####.####.com/Bookajax/downloadchapterlist.do?bid=...
- and####.cl####.yanqing####.####.com/Bookajax/getbookcover.do?t=####&bid=...
- and####.cl####.yanqing####.####.com/Public/Client/android/1.4.8/css/styl...
- and####.cl####.yanqing####.####.com/Public/Client/android/1.4.8/images//...
- and####.cl####.yanqing####.####.com/Public/Client/android/1.4.8/images/d...
- and####.cl####.yanqing####.####.com/Public/Client/android/1.4.8/images/i...
- and####.cl####.yanqing####.####.com/Public/Client/android/1.4.8/js/conf/...
- and####.cl####.yanqing####.####.com/Public/Client/android/1.4.8/js/mod/f...
- and####.cl####.yanqing####.####.com/Public/Client/common/js/conf/do_conf...
- and####.cl####.yanqing####.####.com/Public/Client/common/js/lib/do.js?ve...
- and####.cl####.yanqing####.####.com/Public/Client/common/js/lib/fastclic...
- and####.cl####.yanqing####.####.com/Public/Client/common/js/lib/lazyload...
- and####.cl####.yanqing####.####.com/Public/Client/common/js/lib/template...
- and####.cl####.yanqing####.####.com/Public/Client/common/js/lib/zepto.mi...
- and####.cl####.yanqing####.####.com/Public/Client/common/js/mod/common.j...
- and####.cl####.yanqing####.####.com/Public/Client/common/js/mod/function...
- and####.cl####.yanqing####.####.com/avatar/default/pic_05.jpg
- and####.cl####.yanqing####.####.com/avatar/default/pic_10.jpg
- and####.cl####.yanqing####.####.com/bookajax/getbookstatus/version/1.4.8...
- and####.cl####.yanqing####.####.com/bookajax/getviewreadlog/version/1.4....
- and####.cl####.yanqing####.####.com/bookajax/replycomment/version/1.4.8....
- and####.cl####.yanqing####.####.com/bookajax/sendzan/version/1.4.8.do?P2...
- and####.cl####.yanqing####.####.com/bookface/0/10/1055_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/17/1749_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/2/225_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/25/2509_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/26/2610_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/26/2658_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/27/2743_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/31/3190_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/33/3312_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/33/3328_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/34/3458_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/34/3498_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/36/3689_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/37/3708_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/37/3795_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/38/3820_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/38/3839_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/38/3858_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/38/3893_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/40/4057_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/42/4221_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/42/4224_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/42/4244_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/42/4282_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/42/4287_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/43/4359_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/44/4490_middle.jpg
- and####.cl####.yanqing####.####.com/bookface/0/46/4634_middle.jpg
- and####.cl####.yanqing####.####.com/books/2658.do?&version=####&P27=####...
- and####.cl####.yanqing####.####.com/commentdetail/2658/205127.do?version...
- and####.cl####.yanqing####.####.com/img/bangdan/yqk20180619_3469.jpg
- and####.cl####.yanqing####.####.com/img/bangdan/yqk20180704_banner_khd.jpg
- and####.cl####.yanqing####.####.com/notlogin.png
- and####.cl####.yanqing####.####.com/qiandao/getbooks/version/1.4.8.do?P2...
- sh.wagbr####.alibaba####.com/bar/get/5746d6a667e58e1914000b14/?ud_get=####
- sni.c####.q####.####.net/config/hz-hzv3.conf
- sni.c####.q####.####.net/tdata_MkX219
- sni.c####.q####.####.net/tdata_iGj879
- t####.c####.q####.####.com/tdata_EDT356
Запросы HTTP POST:
- and####.cl####.yanqing####.####.com//ajax/getpopup.do?&P29=####&version=...
- and####.cl####.yanqing####.####.com//ajax/getpopupconfig.do?&version=###...
- and####.cl####.yanqing####.####.com//listmodules?pageconfig=####&version...
- and####.cl####.yanqing####.####.com//startread.do?&version=####&P27=####...
- and####.cl####.yanqing####.####.com//topnums?version=####&P27=####&P30=#...
- and####.cl####.yanqing####.####.com/Bookajax/getversion.do?&P27=####&P30...
- and####.cl####.yanqing####.####.com/Pushajax/addUserBehavior?&version=##...
- and####.cl####.yanqing####.####.com/Pushajax/bindDevice?sex_flag=####&ve...
- and####.cl####.yanqing####.####.com/bookajax/checkfav/version/1.4.8.do?P...
- and####.cl####.yanqing####.####.com/clientbanner?version=####&P27=####&P...
- and####.cl####.yanqing####.####.com/counttanchuang?&version=####&P27=###...
- and####.cl####.yanqing####.####.com/counttip.do?&version=####&P27=####&P...
- and####.cl####.yanqing####.####.com/gdtAdActivate?&version=####&P27=####...
- c-h####.g####.com/api.php?format=####&t=####
- l####.tbs.qq.com/ajax?c=####&k=####
- l####.tbs.qq.com/ajax?c=####&v=####&k=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/0cc704190c41c05e497b5cea5d19552db2e9e478b11adce....0.tmp
- /data/data/####/11a6ba6744a11f8724a77fa30ea0acf8c792ed1afc669b9....0.tmp
- /data/data/####/124ee35664a45619d846deb2e8bc217c95bb8cf92ef3a3c....0.tmp
- /data/data/####/1919b7b8a8263418f0a30066604e68c4422c988a0ae011b....0.tmp
- /data/data/####/27a1ffbb7dd9d600f517dc02330f20257ae477f57a0daac....0.tmp
- /data/data/####/29f6a466fa08bacce23d675c8a859758bace329d199f696....0.tmp
- /data/data/####/2f7b5c6be9d6fafd0e7ea333544f7ec7e89dd107dccedf3....0.tmp
- /data/data/####/2fbbb1bb78c5cca7182e4e2c6183945de5ccb595d62f7cb....0.tmp
- /data/data/####/31a24ad7c3bb74bb88a24bc11fec6a544bacdbb35fdbe44....0.tmp
- /data/data/####/39015d6287ca1ec8572083414edc569b5aec789216f16aa....0.tmp
- /data/data/####/3f45321594588fd70e0e134eaf1a60e3768c014520cbaa1....0.tmp
- /data/data/####/413f9bc97be42ac336eb24befce39e05a0bc265a15f102a....0.tmp
- /data/data/####/59f80f642486cdce309de2f315718e9be5762ef980b89c6....0.tmp
- /data/data/####/604dffdfda8128c6dfb613506c531f50ecdb12ed26abafb....0.tmp
- /data/data/####/6060cdaf32d791040afe81aa1a1d9ab7bf5f332b8d64234....0.tmp
- /data/data/####/60c13a157fd7e2e239969d2be8cb367874c0b20518c4ace....0.tmp
- /data/data/####/62147a8afeb2eee782458e761ed2a8cbb31b21fe0f49b71....0.tmp
- /data/data/####/64681799895f78741bdb289d760ab3d5604130cfb7a409b....0.tmp
- /data/data/####/786409f14f0ca7944931ad3eb4550fa13c2dbde712a2a88....0.tmp
- /data/data/####/79e6e0d485f596989e8d3d521080f9e6dce76859f25d35d....0.tmp
- /data/data/####/84bc828866e7d8765f9bb7cf65e47556b7778a0490e8f45....0.tmp
- /data/data/####/872875ab34f90eeb49517110f138c2ec3a8660a14cfb473....0.tmp
- /data/data/####/8c4a5e8ccb179bc033ae81827fdda517c7a7c9f4f621b26....0.tmp
- /data/data/####/9d55aba6388b
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/MiscDATA.xml
- /data/data/####/ReadSetting.xml
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/WebViewSettings.xml
- /data/data/####/a==7.5.3&&2.2.0_1532046630810_envelope.log
- /data/data/####/b8d6452afc9f7563f2aae00b2d14839e7d61142050da504....0.tmp
- /data/data/####/bea396620f49bb1e20bc1953487b545a7bd37e9eef54e28....0.tmp
- /data/data/####/core_info
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/debug.conf
- /data/data/####/ef53ba2ad8e005401796fe5276f1f41e44d3aa507ab508c....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/fe4b2d263df82d8635e5845c6c394bd615015c1874e45c7....0.tmp
- /data/data/####/fistInstall.xml
- /data/data/####/gdaemon_20161017
- /data/data/####/gdt_first_install_file.xml
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/hong.db
- /data/data/####/hong.db-journal
- /data/data/####/i==1.2.0&&2.2.0_1532046602538_envelope.log
- /data/data/####/index
- /data/data/####/info.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libjiagu1631306394.so
- /data/data/####/multidex.version.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/tdata_MkX219
- /data/data/####/tdata_MkX219.jar
- /data/data/####/tdata_iGj879
- /data/data/####/tdata_iGj879.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_common_location.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.a.dat
- /data/media/####/.adfwe.dat
- /data/media/####/.cca.dat
- /data/media/####/.nomedia
- /data/media/####/.umm.dat
- /data/media/####/1090005.sht
- /data/media/####/1090006.sht
- /data/media/####/1134735.sht
- /data/media/####/1134736.sht
- /data/media/####/1136228.sht
- /data/media/####/1138679.sht
- /data/media/####/1139126.sht
- /data/media/####/1139170.sht
- /data/media/####/1139282.sht
- /data/media/####/1139379.sht
- /data/media/####/1170693.sht
- /data/media/####/1170695.sht
- /data/media/####/1170697.sht
- /data/media/####/1170699.sht
- /data/media/####/1170701.sht
- /data/media/####/1170702.sht
- /data/media/####/1170704.sht
- /data/media/####/1170706.sht
- /data/media/####/1170708.sht
- /data/media/####/1170710.sht
- /data/media/####/1219259.sht
- /data/media/####/1219260.sht
- /data/media/####/1219261.sht
- /data/media/####/1244429.sht
- /data/media/####/1247574.sht
- /data/media/####/1248696.sht
- /data/media/####/1249981.sht
- /data/media/####/1251818.sht
- /data/media/####/1252888.sht
- /data/media/####/1255397.sht
- /data/media/####/811812.sht
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.yanqingkong.m.bin
- /data/media/####/com.yanqingkong.m.db
- /data/media/####/http___android.client.yanqingkong.com_Bookajax...=1.4.8
- /data/media/####/store_cache_grilzh_TW
- /data/media/####/store_category_grilzh_TW
- /data/media/####/store_free_grilzh_TW
- /data/media/####/store_rank_grilzh_TW
- /data/media/####/tdata_MkX219
- /data/media/####/tdata_iGj879
- /data/media/####/test.log
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.miqingshucheng.PushService 24710 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu1631306394.so
- getprop ro.product.cpu.abi
- ls /
- ls /sys/class/thermal
- mount
Загружает динамические библиотеки:
- getuiext2
- libjiagu1631306394
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- DESede-ECB-PKCS5Padding
- RSA-ECB-NoPadding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
