Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.Backdoor.657.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c.appj####.com:80
- TCP(HTTP/1.1) 1####.55.28.235:80
- TCP(HTTP/1.1) c####.360.cn:80
- TCP(HTTP/1.1) t####.zhiz####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) c.g####.qq.com:80
- TCP(HTTP/1.1) u####.bfsspad####.8l####.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(HTTP/1.1) a.e####.cn:80
- TCP(HTTP/1.1) ap####.adi####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) rtb.m####.net:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) pic.e####.cn:80
- TCP(HTTP/1.1) op####.im####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) cm.adi####.com:80
- TCP(HTTP/1.1) 1####.11.61.135:80
- TCP(HTTP/1.1) dsp.zhiz####.com:80
- TCP(HTTP/1.1) rcv.a####.com:80
- TCP(HTTP/1.1) dsp.tou####.com:80
- TCP(HTTP/1.1) d####.c####.l####.####.com:80
- TCP(HTTP/1.1) 1####.26.247.23:80
- TCP(HTTP/1.1) 1####.31.213.162:80
- TCP(HTTP/1.1) d.g####.qq.com:80
- TCP(HTTP/1.1) pic.ange####.cn:80
- TCP(HTTP/1.1) si####.tra####.org.cn:80
- TCP(HTTP/1.1) 47.97.1####.144:6578
- TCP(HTTP/1.1) 47.97.2####.214:80
- TCP(HTTP/1.1) api.map.b####.com:80
- TCP(HTTP/1.1) rtb.fas####.net:80
- TCP(HTTP/1.1) amdc####.m.ta####.com:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) api.e####.cn:80
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) regi####.xm####.xi####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) hm.b####.com:443
Запросы DNS:
- a.e####.cn
- ag####.m.ta####.com
- amdc####.m.ta####.com
- ap####.adi####.com
- api.e####.cn
- api.map.b####.com
- c####.360.cn
- c####.mm####.com
- c.appj####.com
- c.c####.com
- c.g####.qq.com
- cm.adi####.com
- d.g####.qq.com
- dsp.tou####.com
- dsp.zhiz####.com
- hm.b####.com
- imgc####.qq.com
- l.fas####.net
- mi.g####.qq.com
- op####.im####.com
- p####.ugd####.com
- p60v3####.bkt.clo####.com
- pbonq####.bkt.clo####.com
- pic.ange####.cn
- pic.e####.cn
- plb####.u####.com
- qts.shquanc####.com
- qzones####.g####.cn
- rcv.a####.com
- regi####.xm####.xi####.com
- rtb.m####.net
- s####.e.qq.com
- s13.c####.com
- s19.c####.com
- si####.tra####.org.cn
- t####.zhiz####.com
- u####.bfsspad####.8l####.com
- u####.u####.com
- umen####.m.ta####.com
- umengj####.m.ta####.com
- y####.m####.com
- z8.c####.com
Запросы HTTP GET:
- a.e####.cn/public/getClickUrlList.shtml?lng=####&sd=####&screenheight=##...
- a.e####.cn/public/getClickUrlPoList.shtml?lng=####&sd=####&screenheight=...
- a.e####.cn/public/getCommonBannerAd.shtml?height=####&width=####&lng=###...
- a.e####.cn/public/getCommonInformationAd.shtml?height=####&width=####&ln...
- a.e####.cn/public/getCommonStartUpAd.shtml?height=####&width=####&lng=##...
- a.e####.cn/public/isDebugAd.shtml?ts=####&appid=####&sign=####
- a.e####.cn/public/rab.shtml?id=####&network=####&machine=####
- a.e####.cn/public/showUrlVisit.shtml?os=####&osversion=####&appversion=#...
- ap####.adi####.com/tj?key=####&rd=####&req=####&token=####
- ap####.adi####.com/tj?key=####&rd=####&req=YWR####&token=####
- api.e####.cn/public/getSecondaryHomeData.shtml?machine=####&version=####...
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/stat.php?id=####&show=####
- c.g####.qq.com/gdt_mclick.fcg?viewid=####&jtype=####&i=####&os=####&asi=...
- cm.adi####.com/?t=####&d=####&k=####&rd=####&c=####&code=####&pcode=####...
- d####.c####.l####.####.com/
- d####.c####.l####.####.com/index310.js
- d####.c####.l####.####.com/indexGo.js
- d####.c####.l####.####.com/jquery.js
- d####.c####.l####.####.com/qts.shquancheng.com.js
- d.g####.qq.com/fcg-bin/gdt_appdetail.fcg?ico=####&op_appid=####
- dsp.tou####.com/api/ruangao/ads/show?extra=####&price=####
- dsp.tou####.com/api/ruangao/ads/show?extra=L####&price=####
- dsp.tou####.com/api/ruangao/ads/show?extra=M####&price=####
- dsp.tou####.com/api/ruangao/ads/show?extra=a####&price=####
- dsp.tou####.com/api/ruangao/ads/show?extra=s####&price=####
- dsp.zhiz####.com/track/pixel?op=####&ct=####&price=####&ext=####
- gm.mm####.com/9.gif?abc=####&rnd=####
- mi.g####.qq.com/gdt_mview.fcg?actual_width=####&count=####&r=####&templa...
- mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
- mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
- op####.im####.com/dsp/caipudaquan/click?tid=####&adId=####&media_id=####...
- op####.im####.com/dsp/caipudaquan/display?tid=####&adId=####&media_id=##...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.appcache
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.html
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/banner_close_b...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg02.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg03.jpg
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg07.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close02.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close03.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon....
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon_...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/gdt_logo_black...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-ad.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/sdk_bg.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tc-gdt-sdk-ope...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20170821/b...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android02/images/tsa_ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
- pic.ange####.cn/web/258054709.jpg!s1
- pic.ange####.cn/web/258303639.jpg!m3
- pic.ange####.cn/web/258587663.jpg!m720
- pic.ange####.cn/web/258587664.jpg!m720
- pic.ange####.cn/web/258587666.jpg!m720
- pic.ange####.cn/web/258587668.jpg!m720
- pic.ange####.cn/web/258587670.jpg!m720
- pic.ange####.cn/web/258587671.jpg!m720
- pic.ange####.cn/web/258587673.jpg!m720
- pic.ange####.cn/web/258587675.jpg!m720
- pic.ange####.cn/web/258587677.jpg!s1
- pic.ange####.cn/web/259492074.jpg!s1
- pic.ange####.cn/web/259512102.jpg!s1
- pic.ange####.cn/web/259822211.jpg!s1
- pic.ange####.cn/web/260069744.jpg!s1
- pic.ange####.cn/web/260275543.jpg!s1
- pic.ange####.cn/web/260409675.jpg!s1
- pic.ange####.cn/web/260506240.jpg!m3
- pic.ange####.cn/web/260553828.jpg!s1
- pic.ange####.cn/web/261117782.jpg!s1
- pic.e####.cn/web/258587663.jpg!m720
- pic.e####.cn/web/258587664.jpg!m720
- pic.e####.cn/web/258587668.jpg!m720
- pic.e####.cn/web/258587670.jpg!m720
- pic.e####.cn/web/258587671.jpg!m720
- pic.e####.cn/web/258587675.jpg!m720
- pic.e####.cn/web/258587677.jpg!m3
- rcv.a####.com/show?CAAQEw.####
- rcv.a####.com/show?CAAQFA.####
- rcv.a####.com/show?CAAQIA.####
- rtb.fas####.net/imp?e=####&pid=####&sid=####&mid=####
- rtb.m####.net/vw?info=####&wp=####
- rtb.m####.net/vw?info=CM####&wp=####
- s####.tc.qq.com/gdt/0/DAAOTgCAKAAPAAAeBagvlhDSjVQ27-.jpg/0?ck=####
- si####.tra####.org.cn/
- t####.c####.q####.####.com/copy/clipboard.js
- t####.c####.q####.####.com/copy/jquery2.0.js
- t####.c####.q####.####.com/fhsj/gongxi.png
- t####.c####.q####.####.com/fhsj/main.css
- t####.zhiz####.com/mad.do?zzat=####&siteid=####&zzid=####&pr=####&adx=##...
- ti####.c####.l####.####.com/jrcj-toutiao/3333.jpg
- ti####.c####.l####.####.com/jrcj-toutiao/4444.jpg
- ti####.c####.l####.####.com/jrcj-toutiao/85effd840e346899.jpg
- ti####.c####.l####.####.com/jrcj-toutiao/LL.png
- ti####.c####.l####.####.com/jrcj-toutiao/QQWZ2.jpg
- ti####.c####.l####.####.com/jrcj-toutiao/cjtt.jpg
- ti####.c####.l####.####.com/jrcj-toutiao/gz.png
- ti####.c####.l####.####.com/jrcj-toutiao/jquery_002.js
- ti####.c####.l####.####.com/jrcj-toutiao/mmm.css
- ti####.c####.l####.####.com/jrcj-toutiao/stat.php
- ti####.c####.l####.####.com/jrcj-toutiao/toutiaohao.png
- ti####.c####.l####.####.com/jrcj-toutiao/wz3.jpg
- u####.bfsspad####.8l####.com/adClick?v=####&b=####&st=####&p=####&g=####...
- u####.bfsspad####.8l####.com/adShow?v=####&b=####&i=####&r=####&bid=####...
- u####.bfsspad####.8l####.com/dplClick?v=####&b=####&st=####&p=####&g=###...
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Запросы HTTP POST:
- amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
- api.map.b####.com/location/ip?ak=####&coor=####
- c####.360.cn/stra_packet
- c.appj####.com/ad/splash/stats.html
- s####.e.qq.com/activate
- s####.e.qq.com/click
- s####.e.qq.com/msg
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/.jgrpa.xml
- /data/data/####/.log.lock
- /data/data/####/.log.rpa
- /data/data/####/2090.yaqcookie
- /data/data/####/5ead7c1916e321af3ee0d7d6aa595238.temp
- /data/data/####/9c39384b9ef64df538280266bad7a7cc.temp
- /data/data/####/ACCS_SDK.xml
- /data/data/####/ACCS_SDK_CHANNEL.xml
- /data/data/####/AdloadStore.xml
- /data/data/####/Agoo_AppStore.xml
- /data/data/####/Alvin2.xml
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/ContextData.xml
- /data/data/####/DaemonServer
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/Ji.xml
- /data/data/####/MessageStore.db-journal
- /data/data/####/MsgLogStore.db-journal
- /data/data/####/accs.db-journal
- /data/data/####/ad_show_time.xml
- /data/data/####/agoo.pid
- /data/data/####/cn.ecook.xml
- /data/data/####/collectiondatabase
- /data/data/####/collectiondatabase-journal
- /data/data/####/com.google.android.gms.analytics.prefs.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/dexMethod.94151578.dat
- /data/data/####/ecookdatabase
- /data/data/####/ecookdatabase-journal
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f1666e1f731a3cc1c45ff5d6fcedcbeb.xml
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/gaClientId
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/gdt_plugin.tmp
- /data/data/####/gdt_plugin.tmp.sig
- /data/data/####/gdt_suid
- /data/data/####/geofencing.db
- /data/data/####/geofencing.db-journal
- /data/data/####/google_analytics_v4.db-journal
- /data/data/####/i==1.2.0&&4.31.40_1535020244627_envelope.log
- /data/data/####/index
- /data/data/####/info.xml
- /data/data/####/jg_app_update_settings_random.xml
- /data/data/####/jg_so_upgrade_setting.xml
- /data/data/####/libjiagu2063946030.so
- /data/data/####/libyaqbasic.94151578.so
- /data/data/####/libyaqpro.94151578.so
- /data/data/####/log.android.library.xml
- /data/data/####/lonLat.xml
- /data/data/####/material.db-journal
- /data/data/####/message_accs_db
- /data/data/####/message_accs_db-journal
- /data/data/####/mipush.xml
- /data/data/####/mipush_extra.xml
- /data/data/####/mipush_region
- /data/data/####/mipush_region.lock
- /data/data/####/multidex.version.xml
- /data/data/####/recipe.db-journal
- /data/data/####/recipedatabase-journal
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/tiny_data.data
- /data/data/####/tiny_data.lock
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/update_lc
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/yaqsdkcookie
- /data/media/####/.a.dat
- /data/media/####/.adfwe.dat
- /data/media/####/.cca.dat
- /data/media/####/.nomedia
- /data/media/####/.umm.dat
- /data/media/####/1dow6s2h4wzgjn5op3ajqlhf2.tmp
- /data/media/####/1fb8j30r1v2hqi4b5vks5d7wu.tmp
- /data/media/####/1ywa394jpo866sb5jvqvqtwfl.tmp
- /data/media/####/20s971lciar8ope8zm5pp0yn8.tmp
- /data/media/####/2j5lnkgulo61x6if67brn3t30.tmp
- /data/media/####/349m2w7y3ovhtlgtteefufccm.tmp
- /data/media/####/3l71rgvcaeb51q8alntemrmfr.tmp
- /data/media/####/3oyslw9hpae9v26desrm0zln8.tmp
- /data/media/####/3w0o2sk3xw8q5y6citne8krsu.tmp
- /data/media/####/3y81khktm45fmewbtwnsz8n70.tmp
- /data/media/####/4256kllgo8csg0f9dop8rzjc0.tmp
- /data/media/####/497dmi8zabo2zbxcnld8ecj1f.tmp
- /data/media/####/4b9utt6vn7oun48538z6fzmdk.tmp
- /data/media/####/4cqgkno6i58x2qhe3vdc3atgn.tmp
- /data/media/####/4okfo0pr0yehemb520m2ptc3r.tmp
- /data/media/####/4tcnarcv5qlra26u3e7w8ochc.tmp
- /data/media/####/4u2kwusime8l6o2tbrd7xjw25.tmp
- /data/media/####/4u48j2bbhm3pycwr6068uoph4.tmp
- /data/media/####/5bptsqhcd48rb9129kv3x46vk.tmp
- /data/media/####/5xpcsw7206irx4ilu1u1s0r13.tmp
- /data/media/####/6ie8j9r1tpt5wpurn48ebnbkn.tmp
- /data/media/####/6lq36hnaz8wtsz8f7ex8voy0s.tmp
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/fdgbl5xxs1pscfvp23vx8k6.tmp
- /data/media/####/i1kzdy29go0ufdqv6rxll3jh.tmp
- /data/media/####/log.lock
- /data/media/####/log1.txt
- /data/media/####/np2w1qb2zmf0hr9p3a8txmw8.tmp
- /data/media/####/vdekyxd1ytlsg01hvxvvo7fv.tmp
- /data/media/####/yane88wsfsyugm73kyze1yqk.tmp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5976e9333eae2526d4001388","utdid":"W36M1DmM3gUDAGdzx1GZO8Rf","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
- cat /sys/class/net/wlan0/address
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 755 <Package Folder>/.jiagu/libjiagu2063946030.so
- ls /sys/class/thermal
- sh
- su
Загружает динамические библиотеки:
- libjiagu2063946030
- libyaqbasic.94151578
- libyaqpro.94151578
- tnet-3.1
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- RSA
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- RSA-ECB-PKCS1Padding
Использует повышенные привилегии.
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации о настроках APN.
Осуществляет доступ к информации об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
