Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.225
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) androi####.b####.com:80
- TCP(HTTP/1.1) img.p####.b####.####.net:80
- TCP(HTTP/1.1) u####.b####.com:80
- TCP(TLS/1.0) t####.appsf####.com:443
- TCP(TLS/1.0) d####.fl####.com:443
- TCP(TLS/1.0) api.appsf####.com:443
Запросы DNS:
- androi####.b####.com
- api.appsf####.com
- d####.fl####.com
- img.p####.b####.com
- s####.appre####.b####.com
- t####.appsf####.com
- u####.b####.com
- up####.mobilea####.b####.com
Запросы HTTP GET:
- androi####.b####.com/index.php/Applist/GetAppDetail?_branch=####&docid=#...
- androi####.b####.com/index.php/Applist/GetAppOperationList?_branch=####&...
- androi####.b####.com/index.php/Applist/GetHotWords/new/1/?_branch=####&p...
- androi####.b####.com/index.php/Applist/GetHotWords?_branch=####&list_id=...
- androi####.b####.com/index.php/Applist/GetRecommendedList?_branch=####&p...
- androi####.b####.com/index.php/Fb/getFbConfig?_branch=####&_language=####
- androi####.b####.com/index.php/Guid/GetGuidTab?_branch=####&simCode=####...
- androi####.b####.com/index.php/Home/getHomeAppInfo?group_name=####&_bran...
- androi####.b####.com/index.php/Home/getHomeAppInfo?group_name=####&app_t...
- androi####.b####.com/index.php/Tag/getTagDetail?group_name=####&_branch=...
- androi####.b####.com/index.php/ToolBox/getItems?_branch=####&picsize=###...
- img.p####.b####.####.net/public/uploads/store_0/1/f/a/1fac0445caa5e926b0...
- img.p####.b####.####.net/public/uploads/store_0/4/4/2/442fcd99c6fcf6d21c...
- img.p####.b####.####.net/public/uploads/store_0/7/f/9/24e2cd0ced2c03fbb7...
- img.p####.b####.####.net/public/uploads/store_0/9/b/e/9be3c10898ae91e7bc...
- img.p####.b####.####.net/public/uploads/store_0/static/avatar2.png
- img.p####.b####.####.net/public/uploads/store_0/static/avatar8.png
- img.p####.b####.####.net/public/uploads/store_1/5/0/8/508c10917ac09ab13d...
- img.p####.b####.####.net/public/uploads/store_1/8/c/8/8c86cf406d1b60fc06...
- img.p####.b####.####.net/public/uploads/store_1/9/4/b/5ff6130b4eff55a498...
- img.p####.b####.####.net/public/uploads/store_1/a/c/4/ac4faf9b8530fac0fc...
- img.p####.b####.####.net/public/uploads/store_1/f/c/e//fce4f88e4488e8cf8...
- img.p####.b####.####.net/public/uploads/store_10/0/b/6//0b6593fe78e01d34...
- img.p####.b####.####.net/public/uploads/store_10/3/1/5/eed1aa19a824cedac...
- img.p####.b####.####.net/public/uploads/store_2/0/1/8/4d07c30e3588b972f9...
- img.p####.b####.####.net/public/uploads/store_2/1/0/5/105348f06f28bc485f...
- img.p####.b####.####.net/public/uploads/store_2/3/3/0/33049312ab9acfabc6...
- img.p####.b####.####.net/public/uploads/store_2/6/2/0/620096e8c2f36c7c47...
- img.p####.b####.####.net/public/uploads/store_2/8/a/6/743d9bdbbf44db649d...
- img.p####.b####.####.net/public/uploads/store_2/a/6/c/a6c460f37e45e5ea88...
- img.p####.b####.####.net/public/uploads/store_2/a/9/4/a9488a4a2edc57e8f4...
- img.p####.b####.####.net/public/uploads/store_2/c/7/a/1e32e13062fe543b6d...
- img.p####.b####.####.net/public/uploads/store_2/c/e/d/a35e8f9d3fd99d466e...
- img.p####.b####.####.net/public/uploads/store_2/f/d/a/fda158a5b0c770e2f1...
- img.p####.b####.####.net/public/uploads/store_3/4/c/f/4cf1ac79c74718774e...
- img.p####.b####.####.net/public/uploads/store_3/6/f/b/6fbda04af5ffd5bdf9...
- img.p####.b####.####.net/public/uploads/store_3/7/5/a/75a8ba08f36e4fc7a2...
- img.p####.b####.####.net/public/uploads/store_3/c/a/2/ca2153c4565deb3cdd...
- img.p####.b####.####.net/public/uploads/store_3/c/e/3/ce30281259a04682b2...
- img.p####.b####.####.net/public/uploads/store_4/0/a/3/0a3a28168bd87fd02b...
- img.p####.b####.####.net/public/uploads/store_4/0/c/5/0c5504984de2973476...
- img.p####.b####.####.net/public/uploads/store_4/1/f/6/1f6e7fbafcf120a783...
- img.p####.b####.####.net/public/uploads/store_4/4/4/e/44ef4f557f873dcb93...
- img.p####.b####.####.net/public/uploads/store_4/7/a/1/7a103bbe47ddb34d86...
- img.p####.b####.####.net/public/uploads/store_4/8/b/5//8b5c55141c16a09be...
- img.p####.b####.####.net/public/uploads/store_4/8/f/f/8ff70bff30fdb9719f...
- img.p####.b####.####.net/public/uploads/store_4/c/2/d/c2d8d5b9d6504d248d...
- img.p####.b####.####.net/public/uploads/store_4/d/5/3//d5356cad70da0b4df...
- img.p####.b####.####.net/public/uploads/store_5/3/b/9/3b9956313206171ed9...
- img.p####.b####.####.net/public/uploads/store_5/9/f/5/9f5f869c0b6a14d513...
- img.p####.b####.####.net/public/uploads/store_5/a/9/2/a921d82b9c8ff379f0...
- img.p####.b####.####.net/public/uploads/store_5/b/d/3/bd37ce62939974e71c...
- img.p####.b####.####.net/public/uploads/store_5/d/b/c//dbc07d54319b6d83e...
- img.p####.b####.####.net/public/uploads/store_5/f/0/a/b4da657e1993d62f2f...
- img.p####.b####.####.net/public/uploads/store_6/1/f/5/1f5702bd9e33dec718...
- img.p####.b####.####.net/public/uploads/store_6/8/2/1/8215fdf6f730eadcb7...
- img.p####.b####.####.net/public/uploads/store_6/8/8/b/88b629eca32fbb51f8...
- img.p####.b####.####.net/public/uploads/store_6/c/4/9/c49bf512fa6eb23098...
- img.p####.b####.####.net/public/uploads/store_6/e/7/b/e7b3f23b6bbaff615d...
- img.p####.b####.####.net/public/uploads/store_6/f/c/1/9bfa9d830223814823...
- img.p####.b####.####.net/public/uploads/store_7/8/4/6/0a88a7e44e10c33488...
- img.p####.b####.####.net/public/uploads/store_7/d/f/1/6d6930b744e5da3771...
- img.p####.b####.####.net/public/uploads/store_7/e/0/6/e066fdc174b9272860...
- img.p####.b####.####.net/public/uploads/store_7/e/8/c/e8c55394743e0abb91...
- img.p####.b####.####.net/public/uploads/store_8/8/9/9/89995e32aca2bc2399...
- img.p####.b####.####.net/public/uploads/store_8/a/6/9//a697fbad89e702736...
- img.p####.b####.####.net/public/uploads/store_8/a/c/2/ac220ba3a47a2a24c1...
- img.p####.b####.####.net/public/uploads/store_8/e/0/5/e05260450d6c87ea41...
- img.p####.b####.####.net/public/uploads/store_8/f/d/e/fde0acc15f32dd6884...
- img.p####.b####.####.net/public/uploads/store_9/a/8/b/6118b04caa6e726d6d...
- img.p####.b####.####.net/public/uploads/store_9/c/4/5/a315d93c50062315b4...
- img.p####.b####.####.net/public/uploads/store_9/e/6/3/e3f4e56a354c8a6213...
- img.p####.b####.####.net/public/uploads/store_9/f/e/0//fe0e6683550e81a17...
- u####.b####.com/setting/mobomarket_client_config?_branch=####&_language=...
Запросы HTTP POST:
- androi####.b####.com/index.php/Applist/CheckAppUpdateList?_branch=####&c...
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.FlurrySenderIndex.info.AnalyticsData_JPRCQJSP3...CR_159
- /data/data/####/.FlurrySenderIndex.info.AnalyticsMain
- /data/data/####/.flurryagent.3a4e6cb
- /data/data/####/.flurrydatasenderblock.a83a50c0-7886-477d-a409-...8d2367
- /data/data/####/.jiagu.ls
- /data/data/####/196db92cf68d05e4d6a65273c8e81f26
- /data/data/####/28c46b0b798b03f7d5e6f471437d5c29
- /data/data/####/AF_INSTALLATION
- /data/data/####/AdsBusiness-data.xml
- /data/data/####/action
- /data/data/####/appsflyer-data.xml
- /data/data/####/baidu_androidStore.db-journal
- /data/data/####/basicdata
- /data/data/####/batsdk_user_info.xml
- /data/data/####/bd.xml
- /data/data/####/bindcache.xml
- /data/data/####/com.baidu.androidstore.push_sync.xml
- /data/data/####/config.xml
- /data/data/####/d5ddce795aee8dd30573849d7374e953
- /data/data/####/downloads.db-journal
- /data/data/####/libjiagu.so
- /data/data/####/libprocmox_v1_4.so
- /data/data/####/statistic.xml
- /data/media/####/-101755991.0.tmp
- /data/media/####/-1057744629.0.tmp
- /data/media/####/-108659439.0.tmp
- /data/media/####/-1098429487.0.tmp
- /data/media/####/-1129254678.0.tmp
- /data/media/####/-1169704655.0.tmp
- /data/media/####/-1307755972.0.tmp
- /data/media/####/-1311916389.0.tmp
- /data/media/####/-1472005365.0.tmp
- /data/media/####/-1780652251.0.tmp
- /data/media/####/-1963360410.0.tmp
- /data/media/####/-1969793935.0.tmp
- /data/media/####/-20212040.0.tmp
- /data/media/####/-2057066155.0.tmp
- /data/media/####/-2093524577.0.tmp
- /data/media/####/-327472935.0.tmp
- /data/media/####/-517522217.0.tmp
- /data/media/####/-531835083.0.tmp
- /data/media/####/-572676346.0.tmp
- /data/media/####/-662095355.0.tmp
- /data/media/####/-666375162.0.tmp
- /data/media/####/-712326424.0.tmp
- /data/media/####/-759867080.0.tmp
- /data/media/####/-814229528.0.tmp
- /data/media/####/-871922614.0.tmp
- /data/media/####/-899228533.0.tmp
- /data/media/####/-967460456.0.tmp
- /data/media/####/-997244706.0.tmp
- /data/media/####/.cuid
- /data/media/####/.nomedia
- /data/media/####/1023828631.0.tmp
- /data/media/####/1070698272.0.tmp
- /data/media/####/1147109829.0.tmp
- /data/media/####/1168849274.0.tmp
- /data/media/####/1216674069.0.tmp
- /data/media/####/1222215195.0.tmp
- /data/media/####/1242309848.0.tmp
- /data/media/####/1280290265.0.tmp
- /data/media/####/1314062668.0.tmp
- /data/media/####/1401161307.0.tmp
- /data/media/####/1486862556.0.tmp
- /data/media/####/1540107902.0.tmp
- /data/media/####/1545339682.0.tmp
- /data/media/####/1617295416.0.tmp
- /data/media/####/1655503289.0.tmp
- /data/media/####/1695224337.0.tmp
- /data/media/####/1710140830.0.tmp
- /data/media/####/1844986244.0.tmp
- /data/media/####/1890951315.0.tmp
- /data/media/####/1992130509.0.tmp
- /data/media/####/2025862820.0.tmp
- /data/media/####/2098653485.0.tmp
- /data/media/####/2136976054.0.tmp
- /data/media/####/250672550.0.tmp
- /data/media/####/403194000.0.tmp
- /data/media/####/447954385.0.tmp
- /data/media/####/475538239.0.tmp
- /data/media/####/493400169.0.tmp
- /data/media/####/518482254.0.tmp
- /data/media/####/648785671.0.tmp
- /data/media/####/736722308.0.tmp
- /data/media/####/750140431.0.tmp
- /data/media/####/77418031.0.tmp
- /data/media/####/778312395.0.tmp
- /data/media/####/796665745.0.tmp
- /data/media/####/886777853.0.tmp
- /data/media/####/890699987.0.tmp
- /data/media/####/996091251.0.tmp
- /data/media/####/channel
- /data/media/####/journal.tmp
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/libprocmox_v1_4.so <Package Folder> /data/app-lib/<Package>-1 82c73a2dd158cfeb2e534fe7688aa652 http://sync.appreport.baidu.com/cgi-bin-py-appstore/appstore_report_get_msg.cgi?type=uninstall&userId=D28C39766B0284DADB8D6F5E246A94CC|598153950705653&channel=avazu2_gl_BD_CHANGE&subChannel=&currChannel=avazu2_gl_BD_CHANGE&appVer=186&appVerName=3.0.3.8408&networkType=UNKNOWN&networkCountryIos=xy&model=<System Property>&verRelease=4.3.1&screenHight=752&screenWidth=600&unInstallTime=1541894508686&countryIso=xy 1
- su
Загружает динамические библиотеки:
- bdpush_V2_3
- libjiagu
- procmoi_v1_4
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
Использует повышенные привилегии.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
