Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.792.origin
- Android.DownLoader.793.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) as.j####.com:80
- TCP(HTTP/1.1) h####.opensp####.cn:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) yy.hotgo####.com:80
- TCP(HTTP/1.1) i####.in####.j####.com:80
- TCP(HTTP/1.1) v####.6####.com:80
- TCP(HTTP/1.1) h####.b####.com:80
- TCP(HTTP/1.1) dps.wt####.com:8085
- TCP(HTTP/1.1) s####.ch####.com:80
- TCP(HTTP/1.1) s####.j####.cn:80
- TCP(HTTP/1.1) 362b3d8####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) api.voic####.cn:80
- TCP(HTTP/1.1) d####.opensp####.cn:80
- TCP(HTTP/1.1) www.3####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) ss.wx1####.com:80
- TCP(HTTP/1.1) pco####.ta####.com:80
- TCP(HTTP/1.1) x1.api.gg####.com:80
- TCP(HTTP/1.1) 5g.bai####.net.####.com:80
- TCP(HTTP/1.1) n.k####.com:80
- TCP(HTTP/1.1) s.c####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) m.chin####.com:80
- TCP(HTTP/1.1) www.leop####.com:80
- TCP(HTTP/1.1) bb.dugeshe####.com:80
- TCP(HTTP/1.1) ip.adi####.net:80
- TCP(HTTP/1.1) ads.voic####.cn:80
- TCP(HTTP/1.1) dsp.tou####.com:80
- TCP(HTTP/1.1) sf1-ttc####.ps####.com:80
- TCP(HTTP/1.1) js.lotu####.com:80
- TCP(HTTP/1.1) ss####.mogu####.com:80
- TCP(HTTP/1.1) src.r####.com.####.com:80
- TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
- TCP(HTTP/1.1) q.in####.j####.com:80
- TCP(HTTP/1.1) ssp.huay####.com:80
- TCP(HTTP/1.1) sdk.c####.com:80
- TCP(HTTP/1.1) sdk.91a####.com:80
- TCP(HTTP/1.1) w####.5####.com:80
- TCP(SSL/3.0) z.c####.com:443
- TCP(TLS/1.0) ssl.gst####.com:443
- TCP(TLS/1.0) an####.l####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) ip.adi####.net:443
- TCP(TLS/1.0) 5g.bai####.net.####.com:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) sl####.b0.a####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) res####.a####.com:443
- TCP(TLS/1.0) s####.tc.qq.com:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) www.leop####.com:443
- TCP(TLS/1.0) l####.b####.com:443
- TCP(TLS/1.0) gov.coc####.cn:443
- TCP(TLS/1.0) www.go####.nl:443
- TCP(TLS/1.0) n.k####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) ei.c####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) ad.i####.xyz:443
- TCP(TLS/1.0) adser####.go####.com:443
- TCP(TLS/1.0) org.wt####.cn:443
- TCP 1####.46.30.56:7001
- UDP s.j####.cn:19000
Запросы DNS:
- 362b3d8####.oss-cn-####.aliy####.com
- 5g.bai####.net
- ad.i####.xyz
- ads.voic####.cn
- adser####.go####.com
- amap####.cn-hang####.oss####.####.com
- an####.l####.com
- api.heart####.cn
- api.voic####.cn
- as.j####.com
- bb.dugeshe####.com
- bj.imp.voic####.cn
- c####.mm####.com
- c.c####.com
- cx.v####.com
- d####.opensp####.cn
- dd.arg####.com
- dps.wt####.com
- dsp.tou####.com
- ei.c####.com
- gov.coc####.cn
- h####.b####.com
- h####.opensp####.cn
- hm.b####.com
- i####.in####.j####.com
- ip.adi####.net
- js.c####.com
- js.lotu####.com
- l####.b####.com
- m.chin####.com
- n.k####.com
- org.wt####.cn
- p####.be####.com
- pco####.c####.com
- q.in####.j####.com
- r####.wx.qq.com
- res####.a####.com
- s####.ch####.com
- s####.j####.cn
- s.c####.com
- s.j####.cn
- s13.c####.com
- s19.c####.com
- s22.c####.com
- sdk.91a####.com
- sdk.c####.com
- sf1-ttc####.ps####.com
- src.r####.com
- ss####.mogu####.com
- ss.wx1####.com
- ssl.gst####.com
- ssp.huay####.com
- v####.6####.com
- w####.5####.com
- w####.5####.com
- www.3####.com
- www.go####.com
- www.go####.nl
- www.gst####.com
- www.leop####.com
- x1.api.gg####.com
- yy.hotgo####.com
- z1.c####.com
- z7.c####.com
- z8.c####.com
Запросы HTTP GET:
- 362b3d8####.oss-cn-####.aliy####.com/h.html?id=id=1####&web_id=####
- 5g.bai####.net.####.com/es/htpddjs/css/Swiper-4.0.5.css
- 5g.bai####.net.####.com/es/htpddjs/css/animate.min.css
- 5g.bai####.net.####.com/es/htpddjs/css/index.css
- 5g.bai####.net.####.com/es/htpddjs/css/item.css
- 5g.bai####.net.####.com/es/htpddjs/css/loading.css
- 5g.bai####.net.####.com/es/htpddjs/img/hongbao.png
- 5g.bai####.net.####.com/es/htpddjs/img/search.png
- 5g.bai####.net.####.com/es/htpddjs/index.html?cid=####
- 5g.bai####.net.####.com/es/htpddjs/js/Swiper-4.0.5.js
- 5g.bai####.net.####.com/es/htpddjs/js/Tools.js
- 5g.bai####.net.####.com/es/htpddjs/js/echo.js
- 5g.bai####.net.####.com/es/htpddjs/js/index.js
- 5g.bai####.net.####.com/es/htpddjs/js/sy.js
- 5g.bai####.net.####.com/es/htpddz/css/Swiper-4.0.5.css
- 5g.bai####.net.####.com/es/htpddz/css/animate.min.css
- 5g.bai####.net.####.com/es/htpddz/css/index.css
- 5g.bai####.net.####.com/es/htpddz/css/item.css
- 5g.bai####.net.####.com/es/htpddz/css/loading.css
- 5g.bai####.net.####.com/es/htpddz/img/hongbao.png
- 5g.bai####.net.####.com/es/htpddz/img/search.png
- 5g.bai####.net.####.com/es/htpddz/index.html?cid=####
- 5g.bai####.net.####.com/es/htpddz/js/Swiper-4.0.5.js
- 5g.bai####.net.####.com/es/htpddz/js/Tools.js
- 5g.bai####.net.####.com/es/htpddz/js/echo.js
- 5g.bai####.net.####.com/es/htpddz/js/index.js
- 5g.bai####.net.####.com/es/htpddz/js/sy.js
- 5g.bai####.net.####.com/lh/smart/common/gz_176_1.js
- 5g.bai####.net.####.com/lh/smart/inv/pxinteraction_400554.html?td_channe...
- 5g.bai####.net.####.com/lh/smart/inv/pxinteraction_lx_up_81001.html?td_c...
- 5g.bai####.net.####.com/lh/smart/smartpull_400554.js
- api.voic####.cn/a/impress?impressId=####&traceId=####&inAId=####&wPltId=...
- api.voic####.cn/hotUpdate/?ver=####
- as.j####.com/getStatus?id=MgV9F6P6LHs=&h=/yy.hotgopark.com/OYTS/Index?Pe...
- as.j####.com/getStatus?id=fdQ3MD0mlvU=&h=/yy.hotgopark.com/OYTS/Index?Pe...
- bb.dugeshe####.com/yhws/channel/wf/wfye.js
- bb.dugeshe####.com/yhws/channel/zy/zyikd.html
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/z_stat.php?id=####&web_id=####
- dps.wt####.com:8085/js/blhc11/yz.js
- dps.wt####.com:8085/js/blhc7/yz.js
- dps.wt####.com:8085/js/yys5/yz.js
- dsp.tou####.com/api/xunfei/ads/show?extra=####&price=####
- gm.mm####.com/9.gif?abc=####&rnd=####
- h####.opensp####.cn/launchconfig?t=####&p=ZWxwZ####
- i####.in####.j####.com/version?category=####&rest=####&client=####&ver=#...
- ip.adi####.net/api/ad/ad/getScreenAd?seq=####&ad_channal_code=####&fetch...
- ip.adi####.net/api/ad/ad/sendDeviceInfo
- ip.adi####.net/dspapi/ad/showurl?a=####&d=####&h=####&i=####&p=####&s=##...
- js.lotu####.com/lsd.js
- m.chin####.com/710.js
- m.chin####.com/hot/710.ashx
- n.k####.com/pos_891_.js
- n.k####.com/pos_891_tj.html
- n.k####.com/pos_891_tj.js
- n.k####.com/yt_1828.html?t=####
- n.k####.com/yt_1828.js
- pco####.ta####.com/app.gif?&cna=####
- q.in####.j####.com/getAdConfig?client=####&version=####
- q.in####.j####.com/userinfo?client=####&mid=hO7####&user_id####&key=####
- s####.ch####.com/extra/information/list?acc=####
- s.c####.com/s.htm?s=####&id=####&pid=####
- s.c####.com/s.htm?s=####&id=####&pid=####&2####
- sdk.91a####.com/static/20180925144459mod.enc
- sf1-ttc####.ps####.com/img/ad.union.api/7a6aee15c55d8b5477634ece887dcc99...
- sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
- src.r####.com.####.com/kubo/dex/hh_8.6_109.dex
- ss####.mogu####.com/singlefun/jspullup/recentjspullup?ggid=####&cid=####...
- ss.wx1####.com/yhws/channel/wf/as_wfyei.html
- ss.wx1####.com/yhws/channel/wf/as_wfyeo.html
- ssp.huay####.com/adinfo.htm?pid=####&protocol=####
- www.3####.com/s.htm?s=####&id=####&pid=####
- www.leop####.com/index.php?m=####&c=####&a=####&type=####
- www.leop####.com/index.php?m=####&c=####&a=####&url=####
- www.leop####.com/mattu.html
- yy.hotgo####.com/OYTS/Index?Personcode=####&TICKETCODE=####
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
- z.c####.com/stat.htm?id=1271523318&r=http://n.kzsha.com/yt_1828.html?t=#...
Запросы HTTP POST:
- ads.voic####.cn/ad/request
- d####.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
- h####.b####.com/app.gif
- q.in####.j####.com/addUserInfo
- s####.j####.cn/v2/report
- sdk.91a####.com/api/DeviceReport.ashx
- sdk.c####.com/getsiteapi.php
- sdk.c####.com/sdkallapi.php
- sdk.c####.com/sdkreapi.php
- sdk.c####.com/versiontapi.php?v=####&type=####
- v####.6####.com/0/ca477c3b25914a5f821296be846eca73.html
- v####.6####.com/18/a41844eff5ff4a0a96c9603142acfcf6.html
- v####.6####.com/20/8c10c5184b36491eb6ed32bdbafb1eb4.html
- v####.6####.com/21/951b059d52e34526bd44b82d5204ff96.html
- v####.6####.com/9/17ecff40f1644f1a9cbb04dad5d6013f.html
- v####.6####.com/9/83c2961314204ae699a3379a8f3dbc1e.html
- v####.6####.com/api/CheckModule.ashx
- v####.6####.com/api/GetLockAppOpenTask.ashx
- v####.6####.com/api/GetModuleConfig.ashx
- v####.6####.com/api/GetPkNameList.ashx
- v####.6####.com/api/GetTSecret.ashx
- v####.6####.com/api/GetTreasureJS.ashx
- v####.6####.com/api/GetTreasureTask.ashx
- v####.6####.com/api/ReportAppLog.ashx
- v####.6####.com/api/ReportTreasure.ashx
- w####.5####.com/0/76179c31f5d04e21bcf7fee1debf1df1.html
- x1.api.gg####.com/api.htm?pid=####&appid=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.jg.ic
- /data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
- /data/data/####/35104416806479.0
- /data/data/####/3963235188808.0
- /data/data/####/8042581554585.0
- /data/data/####/9883869494053.0
- /data/data/####/AdDex.3.1.0.dex
- /data/data/####/DownloadTaskStore.db-journal
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/__local_last_session.json
- /data/data/####/__local_stat_cache.json
- /data/data/####/adsp.xml
- /data/data/####/ax_c.xml
- /data/data/####/cn.jpush.android.user.profile.xml
- /data/data/####/cn.jpush.preferences.v2.xml
- /data/data/####/com.iflytek.id.xml
- /data/data/####/com.iflytek.msc.xml
- /data/data/####/d734a396262fed7b7e4fa1276c05b624.0
- /data/data/####/data.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_2 (deleted)
- /data/data/####/data_3
- /data/data/####/data_3 (deleted)
- /data/data/####/domainset
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/f_000021
- /data/data/####/f_000022
- /data/data/####/f_000023
- /data/data/####/f_000024
- /data/data/####/f_000025
- /data/data/####/f_000026
- /data/data/####/f_000027
- /data/data/####/f_000028
- /data/data/####/f_000029
- /data/data/####/f_00002a
- /data/data/####/f_00002b
- /data/data/####/f_00002c
- /data/data/####/f_00002d
- /data/data/####/f_00002e
- /data/data/####/f_00002f
- /data/data/####/f_000030
- /data/data/####/f_000031
- /data/data/####/f_000032
- /data/data/####/f_000033
- /data/data/####/hh_8.6.dex
- /data/data/####/hmdb
- /data/data/####/hmdb-journal
- /data/data/####/ibkad_config.xml
- /data/data/####/ibus_20180712
- /data/data/####/ifly_launch_lib.xml
- /data/data/####/iflytek_state_com.cn.bushelper.xml
- /data/data/####/index
- /data/data/####/indexnews
- /data/data/####/journal
- /data/data/####/journal.tmp
- /data/data/####/jpush_device_info.xml
- /data/data/####/jpush_local_notification.db
- /data/data/####/jpush_local_notification.db-journal
- /data/data/####/jpush_stat_cache_history.json
- /data/data/####/jpush_statistics.db
- /data/data/####/jpush_statistics.db-journal
- /data/data/####/libjiagu312090826.so
- /data/data/####/loctemp.so
- /data/data/####/logdb.db
- /data/data/####/logdb.db-journal
- /data/data/####/max_pref.xml
- /data/data/####/mc109.dex
- /data/data/####/mc_cache.xml
- /data/data/####/mod.dec
- /data/data/####/mod.dex
- /data/data/####/mod.enc
- /data/data/####/multidex.version.xml
- /data/data/####/native_plates
- /data/data/####/native_plates-journal
- /data/data/####/phan.xml
- /data/data/####/pref.xml
- /data/data/####/smartbusdata.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromium.db-journal (deleted)
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal (deleted)
- /data/data/####/welcome
- /data/media/####/.nomedia
- /data/media/####/.push_deviceid
- /data/media/####/1538307463133.db
- /data/media/####/47674591a9ea569e6b2e48192292fbf8
- /data/media/####/alsn20170807.db
- /data/media/####/alsn20170807.db-journal
- /data/media/####/id.tmp
- /data/media/####/iflyworkdir_test
Другие:
Запускает следующие shell-скрипты:
- cat /sys/class/net/wlan0/address
- chmod 755 <Package Folder>/.jiagu/libjiagu312090826.so
Загружает динамические библиотеки:
- jpush213
- libjiagu312090826
- msc
- sqlcipher
- utlilib
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
