Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.RemoteCode.41.origin
- Android.Triada.417.origin
- Android.Triada.440.origin
- Android.Xiny.20
Загружает из Интернета следующие детектируемые угрозы:
- Android.Xiny.20
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 58.2####.198.165:888
- TCP(HTTP/1.1) 1####.75.90.129:80
- TCP(HTTP/1.1) qiniu-s####.cdn.d####.com:80
- TCP(HTTP/1.1) ob.nic####.cn:80
- TCP(HTTP/1.1) yun.russi####.cn.####.com:80
- TCP(HTTP/1.1) dup.baidust####.com:80
- TCP(HTTP/1.1) www.pc####.com.####.cn:80
- TCP(HTTP/1.1) pos.b####.com:80
- TCP(HTTP/1.1) yun.d####.com.cn:80
- TCP(HTTP/1.1) s####.x####.com.cn:80
- TCP(HTTP/1.1) loc.map.b####.com:80
- TCP(HTTP/1.1) d0.x####.com.cn:80
- TCP(HTTP/1.1) ec####.b####.com:80
- TCP(HTTP/1.1) zf####.v.qin####.com:80
- TCP(HTTP/1.1) v####.funs####.com:80
- TCP(HTTP/1.1) b####.www.ye####.org:80
- TCP(HTTP/1.1) cd.kw####.com:80
- TCP(HTTP/1.1) acti####.russi####.cn:80
- TCP(HTTP/1.1) pco####.ta####.com:80
- TCP(HTTP/1.1) 1####.75.115.32:80
- TCP(HTTP/1.1) z####.heyc####.net:80
- TCP(HTTP/1.1) www.ye####.org:80
- TCP(HTTP/1.1) z.no####.net:80
- TCP(HTTP/1.1) ne####.x####.com.cn:80
- TCP(HTTP/1.1) m.jlru####.com:80
- TCP(HTTP/1.1) p####.cdb####.cn:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) fp-st####.b0.a####.com:80
- TCP(HTTP/1.1) i####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) MY####.huita####.com:10091
- TCP(HTTP/1.1) 2####.187.226.25:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) 61.1####.211.17:80
- TCP(HTTP/1.1) yun.tuis####.com:80
- TCP(HTTP/1.1) s####.funs####.net:80
- TCP(HTTP/1.1) ip.ch####.com:80
- TCP(HTTP/1.1) 7k####.46####.com:15215
- TCP(HTTP/1.1) m1.laogeda####.com:80
- TCP(HTTP/1.1) 1####.40.20.155:80
- TCP(HTTP/1.1) g.cn.miao####.com:80
- TCP(HTTP/1.1) i####.pcon####.fas####.com:80
- TCP(HTTP/1.1) en####.tui####.com:80
- TCP(HTTP/1.1) p2.ai####.com:80
- TCP(HTTP/1.1) m.v####.com:80
- TCP(HTTP/1.1) r####.qq####.cn:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) do.soi####.com:80
- TCP(HTTP/1.1) idu####.qini####.com:80
- TCP(HTTP/1.1) 7k####.46####.com:20351
- TCP(HTTP/1.1) w####.c####.com:80
- TCP(HTTP/1.1) c####.x####.com.cn:80
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) dev-tes####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) z.c####.com:443
- TCP(TLS/1.0) pc####.i####.com:443
- TCP(TLS/1.0) fp.ton####.net:443
- TCP(TLS/1.0) api.nic####.cn:443
- TCP(TLS/1.0) s####.tc.qq.com:443
- TCP(TLS/1.0) fp.fraudme####.cn:443
- TCP(TLS/1.0) c####.pc####.com.cn:443
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) pos.b####.com:443
- TCP(TLS/1.0) aliyuns####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) ad.doublec####.net:443
- TCP(TLS/1.0) st####.adhu####.com:443
- TCP(TLS/1.0) 2b.tand####.com:443
- TCP(TLS/1.0) img.pcon####.com.####.cn:443
- TCP(TLS/1.0) c####.baidust####.com:443
- TCP(TLS/1.0) v.adma####.com.cn:443
- TCP(TLS/1.0) ec####.b####.com:443
- TCP(TLS/1.0) aliyuno####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) hotfix####.oss-cn-####.aliy####.com:443
- TCP(TLS/1.0) m.cuda####.com:443
- TCP(TLS/1.0) i####.pcon####.fas####.com:443
- TCP(TLS/1.0) mg####.pcon####.com.cn:443
- TCP(TLS/1.0) js.3con####.com:443
- TCP(TLS/1.0) t####.c####.q####.####.com:443
- TCP(TLS/1.0) dis####.in####.com:443
- TCP(TLS/1.0) www.pc####.com.####.cn:443
- TCP(TLS/1.0) p####.pc####.com.cn:443
- TCP(TLS/1.0) c.c####.com:443
- TCP(TLS/1.0) ivy.pcon####.com.cn:443
- TCP(TLS/1.0) pp.c####.com:443
- TCP(TLS/1.0) i.tand####.com:443
- TCP(TLS/1.0) hm.b####.com:443
- TCP(TLS/1.0) log.cuda####.com:10090
- TCP(TLS/1.0) bu####.bianxia####.com:443
- TCP(TLS/1.0) dup.baidust####.com:443
- TCP(TLS/1.0) w####.pcon####.com.cn:443
- TCP(TLS/1.0) adsc####.tand####.com:443
Запросы DNS:
- 2.and####.p####.####.org
- 2b.tand####.com
- 7k####.46####.com
- MY####.huita####.com
- acti####.russi####.cn
- ad.doublec####.net
- adm.t####.com
- adsc####.tand####.com
- aliyuno####.oss-cn-####.aliy####.com
- aliyuns####.oss-cn-####.aliy####.com
- aliyuns####.oss-cn-####.aliy####.com
- api.nic####.cn
- b####.www.ye####.org
- bu####.bianxia####.com
- c####.baidust####.com
- c####.mm####.com
- c####.pc####.com.cn
- c####.x####.com.cn
- c.c####.com
- cd.kw####.com
- d0.x####.com.cn
- dev-tes####.oss-cn-####.aliy####.com
- dis####.in####.com
- do.soi####.com
- dup.baidust####.com
- ec####.b####.com
- en####.tui####.com
- fp.fraudme####.cn
- fp.ton####.net
- g.cn.miao####.com
- h####.c####.com
- hm.b####.com
- hotfix####.oss-cn-####.aliy####.com
- i####.com
- i####.pcon####.com.cn
- i####.x####.com.cn
- i####.xca####.com
- i.tand####.com
- im####.nic####.cn
- img.pc####.com.cn
- img.pcon####.com.cn
- ip.ch####.com
- ivy.pcon####.com.cn
- js.3con####.com
- js.x####.com.cn
- loc.map.b####.com
- log.cuda####.com
- m.cuda####.com
- m.jlru####.com
- m.v####.com
- m1.laogeda####.com
- mg####.pcon####.com.cn
- ne####.x####.com.cn
- ob.nic####.cn
- p####.cdb####.cn
- p####.pc####.com.cn
- p2.ai####.com
- pc####.i####.com
- pco####.c####.com
- pos.b####.com
- pp.c####.com
- r####.qq####.cn
- r####.wx.qq.com
- s####.funs####.net
- s####.x####.com.cn
- s11.c####.com
- s13.c####.com
- s19.c####.com
- s22.c####.com
- s23.c####.com
- s4.c####.com
- s95.c####.com
- s96.c####.com
- st####.adhu####.com
- st####.fraudme####.cn
- v####.fun.tv
- v####.fun.tv
- v.adma####.com.cn
- v1.c####.com
- w####.c####.com
- w####.iy####.cn
- w####.pc####.com.cn
- w####.pcon####.com.cn
- www.pc####.com.cn
- www.pcon####.com.cn
- www.ye####.org
- y2####.uw####.com
- yun.d####.com.cn
- yun.russi####.cn
- yun.tuis####.com
- yun.tuit####.com
- z####.heyc####.net
- z.no####.net
- z1.c####.com
- z11.c####.com
- z13.c####.com
- z2.c####.com
- z4.c####.com
- z5.c####.com
- z6.c####.com
- z7.c####.com
- z8.c####.com
Запросы HTTP GET:
- acti####.russi####.cn/activity/getAllSkin?timestamp=####&couponSkinId=##...
- acti####.russi####.cn/activity/getReturnPage?slotId=####&id=####&login=#...
- acti####.russi####.cn/activity/index?id=####&slotId=####&login=####&appK...
- acti####.russi####.cn/statistics/activityPagePerf?group_type=####&platfo...
- c####.x####.com.cn/push/adv.php?pid=####&id=####&oid=####&m=####&pv=####...
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/stat.php?id=####
- c.c####.com/stat.php?id=####&web_id=####
- d0.x####.com.cn/pvlog/ad_count.php
- d0.x####.com.cn/pvlog/ad_count.php?t=####
- do.soi####.com/201811/wwn.jar
- dup.baidust####.com/js/os.js
- ec####.b####.com/rs.jpg?type=####&stamp=####
- en####.tui####.com/index/activity?appKey=####&adslotId=####
- fp-st####.b0.a####.com/v2/fm.js?ver=####&t=####
- g.cn.miao####.com/x/k=2100594&p=7J5YG&dx=__IPDX__&rt=2&ns=__IP__&ni=__IE...
- gm.mm####.com/9.gif?abc=####&rnd=####
- i####.com/irt?_iwt_UA=####&jsonp=####
- i####.com/irt?_iwt_UA=####&ref=####&jsonp=####
- i####.pcon####.fas####.com/blank.gif
- idu####.qini####.com/2011newcar/images/wb_btn1.jpg
- ip.ch####.com/getip.aspx
- m.jlru####.com/ZDNpKVauaBbK.php?o=####&i=####&s=####&ad=####
- m.jlru####.com/jiatinghuli/25/2196.html
- m.v####.com/JdcPAGsskmgA.php?o=####&i=####&s=####&ad=####
- m.v####.com/shengwuzhinen/29/3018.html
- m1.laogeda####.com/ads/admaster24.php?o=####
- m1.laogeda####.com/ads/admaster240.php?o=####
- m1.laogeda####.com/templets/tui/js/jquery-1.8.3.min.js
- ne####.x####.com.cn/images/np_ps_bj.jpg
- ne####.x####.com.cn/images/r_map.gif
- ne####.x####.com.cn/images/rl_bj.gif
- ne####.x####.com.cn/js/Jump.js?v=####
- ne####.x####.com.cn/jsinclude/jquery.js
- ne####.x####.com.cn/photo/sdb5553_4/1599727.htm
- ne####.x####.com.cn/photo/sdb5553_4/1599730.htm
- ne####.x####.com.cn/photo/sdb5553_4/1599732.htm
- ne####.x####.com.cn/photo/sdb5553_4/1599734.htm
- ob.nic####.cn/huodong/Production/20181031/node_modules/iscroll/build/isc...
- ob.nic####.cn/huodong/Production/20181031/pkg/Common.js
- ob.nic####.cn/huodong/Production/20181031/pkg/Vendor.js
- ob.nic####.cn/huodong/Production/20181031/projects/page/SmashGoldenEgg/S...
- ob.nic####.cn/huodong/Production/20181031/projects/page/SmashGoldenEgg/c...
- p####.cdb####.cn/z/2gdbvnfgbdf4x.zip
- p####.cdb####.cn/z/2hadfvsdvdr4x.zip
- p####.cdb####.cn/z/2jafghbdf4x.zip
- p####.cdb####.cn/z/2mbfgsdgfkl4x.zip
- p####.cdb####.cn/z/2wofgghjyj4x.zip
- p2.ai####.com/activity/index?key=####
- pco####.ta####.com/app.gif?&cna=####
- pos.b####.com/hcgm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
- pos.b####.com/icxm?di=####&dri=####&dis=####&dai=####&ps=####&enu=####&d...
- qiniu-s####.cdn.d####.com/cms/iwt/iwt-min.js
- r####.qq####.cn/f/AAAfgskyg026
- r####.qq####.cn/g/fbgfby026
- s####.funs####.net/ecom-ad/ifar_all/?oc=####
- s####.funs####.net/ecom-ad/ifar_duration/?rprotocol=####&fck=####&mick=#...
- s####.funs####.net/ecom-ad/ifar_load/?rprotocol=1&fck=15422339596925f&mi...
- s####.x####.com.cn/flow/flow.php?t=####
- t####.c####.q####.####.com/b25/s5553/m_20131010003031377928.jpg
- t####.c####.q####.####.com/b25/s5553/m_20131010003036394852.jpg
- t####.c####.q####.####.com/b25/s5553/m_20131010003042504363.jpg
- t####.c####.q####.####.com/b25/s5553/s_20131010003006263076.jpg
- t####.c####.q####.####.com/b25/s5553/s_20131010003016739735.jpg
- t####.c####.q####.####.com/b25/s5553/s_20131010003031377928.jpg
- t####.c####.q####.####.com/b25/s5553/s_20131010003036394852.jpg
- t####.c####.q####.####.com/b25/s5553/s_20131010003042504363.jpg
- t####.c####.q####.####.com/b25/s5553/s_20131010003049732764.jpg
- t####.c####.q####.####.com/b25/s5553/s_20131010003055738020.jpg
- v####.funs####.com/vasd/pa/index?zzt=####&sid=####&ref=####&mick=####&cv...
- w####.c####.com/abc/xyz/point/index.php
- www.pc####.com.####.cn/autox/x2.html
- yun.d####.com.cn/h5-tuia/couponPrize/lucky.png?nnn=####
- yun.russi####.cn.####.com/h5-mami/activity/turnCard/fs.3.0/index_2018082...
- yun.russi####.cn.####.com/h5-mami/activity/turnCard/fs.3.0/index_2018092...
- yun.russi####.cn.####.com/h5-mami/activity/turnCircle/5.0/actBase_201809...
- yun.russi####.cn.####.com/h5-mami/h5-discern-simulator-1.0.19.min.js?t=#...
- yun.russi####.cn.####.com/mami-media/img/9yh9jdqtb7.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/biqp1z8cep.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/onbxuaf71v.png
- yun.russi####.cn.####.com/mami-media/img/onbxuaf71v.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/ywek3sscba.png
- yun.russi####.cn.####.com/mami-media/img/ywek3sscba.png?x-oss-process=####
- yun.russi####.cn.####.com/mami-media/img/zbbtzawj5y.png?x-oss-process=####
- yun.russi####.cn.####.com/newactivity/assets/actBase.b18e731a.js
- yun.russi####.cn.####.com/newactivity/assets/actBase.b5ab31ee.css
- yun.russi####.cn.####.com/newactivity/assets/actCommon.525a819b.js
- yun.russi####.cn.####.com/newactivity/assets/actCommon.87b11218.css
- yun.russi####.cn.####.com/newactivity/assets/pluginActCommon.2a654174.js
- yun.tuis####.com/h5-mami/activity/components/incentive/gift.png?x-oss-pr...
- yun.tuis####.com/h5-mami/activity/turnCard/3.0/images/guideLayer_1.png?x...
- yun.tuis####.com/h5-mami/activity/turnCard/3.0/images/rules.png?x-oss-pr...
- yun.tuis####.com/h5-mami/couponPrize/1.22/redpacks.png
- yun.tuis####.com/h5-mami/couponPrize/3.2/back.png
- yun.tuis####.com/h5-mami/couponPrize/3.2/forward.png
- yun.tuis####.com/h5-mami/couponPrize/3.2/win.png
- yun.tuis####.com/h5-mami/couponPrize/3.3/btn.png
- yun.tuis####.com/h5-mami/couponPrize/3.3/index_201807182020.css
- yun.tuis####.com/h5-mami/couponPrize/3.3/index_201807182020.js
- yun.tuis####.com/h5-mami/couponPrize/alipay/index_201807161748.css
- yun.tuis####.com/h5-mami/couponPrize/alipay/index_201807161748.js
- yun.tuis####.com/h5-mami/couponPrize/close.png
- yun.tuis####.com/h5-mami/thanksPrize/index_201801031425.css
- yun.tuis####.com/h5-mami/thanksPrize/index_201803121444.js
- yun.tuis####.com/h5/showCouponPrize/4.0.0/assets/light.png
- yun.tuis####.com/newactivity/assets/encourageIcon.0c6fe406.css
- yun.tuis####.com/newactivity/assets/encourageIcon.2aa6e3e8.js
- yun.tuis####.com/newactivity/assets/encourageLayer.2fd1eb12.css
- yun.tuis####.com/newactivity/assets/encourageLayer.d3e12d72.js
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
- zf####.v.qin####.com/market/ext/udc/c00100085.html?zzt=####
- zf####.v.qin####.com/unet/static/udc.js?zzt=####
Запросы HTTP POST:
- 7k####.46####.com:15215/tr/
- 7k####.46####.com:15215/ts/
- 7k####.46####.com:20351/ds/
- MY####.huita####.com:10091/wisdom/marking
- acti####.russi####.cn/activity/ajaxOptions
- acti####.russi####.cn/pluginTools/responsiveIndex
- acti####.russi####.cn/pluginTools/timingIndex
- acti####.russi####.cn/statistics/activityPagePerf?type=####&skinName=###...
- b####.www.ye####.org/i?requestId=####&g=####&ua=####
- cd.kw####.com/c
- loc.map.b####.com/sdk.php
- ob.nic####.cn/niceapi/getactivity
- ob.nic####.cn/niceapi/getactivitybuoy
- ob.nic####.cn/niceapi/orderdatainfo
- www.ye####.org/i?requestId=####&g=####&ua=####
- z####.heyc####.net/getlist
- z####.heyc####.net/xlogin
- z.no####.net/m/a/f
- z.no####.net/m/a/t
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.jg.ic
- /data/data/####/4e793485339d62b7f39474831e879f9a
- /data/data/####/518b137efcadca43d34c532689bb9f56.log
- /data/data/####/518b137efcadca43d34c532689bb9f56.log.temp
- /data/data/####/5ff9fbceaae1b0f381c9a2589fb0cc4c.log
- /data/data/####/5ff9fbceaae1b0f381c9a2589fb0cc4c.log.temp
- /data/data/####/718808d93795e42acb919bab227e6424.xml
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/JSON.xml
- /data/data/####/TMRFScDb.jar
- /data/data/####/W_Key.xml
- /data/data/####/WebViewSettings.xml
- /data/data/####/a4be9ff4668403efdb304dc0106533f6.log
- /data/data/####/a4be9ff4668403efdb304dc0106533f6.log.temp
- /data/data/####/cDmuEKSEH.jar
- /data/data/####/com.gghjk.comyyyus_preferences.xml
- /data/data/####/com_gghjk_comyyyus.txt
- /data/data/####/commmauwucik.xml
- /data/data/####/countClickIP.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/dpi
- /data/data/####/e2d119a1c8895232098cd0bba4d5750c.log
- /data/data/####/e2d119a1c8895232098cd0bba4d5750c.log.temp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/ff533ee364e852cd5369a6766a6f448b.log
- /data/data/####/ff533ee364e852cd5369a6766a6f448b.log.temp
- /data/data/####/firll.dat
- /data/data/####/gameid
- /data/data/####/gameid.zip
- /data/data/####/hid.db
- /data/data/####/index
- /data/data/####/lPkkJzxSc.jar
- /data/data/####/libjiagu99474394.so
- /data/data/####/libmbgv.so
- /data/data/####/libmbgv.so-32
- /data/data/####/libmbgv.so-64
- /data/data/####/ljhkndwh.jar
- /data/data/####/mFF2JMmcYZ.jar
- /data/data/####/plsghuaw.xml
- /data/data/####/st.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_message_state.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/yd_config_c.xml
- /data/media/####/.cuid
- /data/media/####/.nid
- /data/media/####/.uucrrux
- /data/media/####/0668F4008AFBD99853A8C2B6CF76D3FD.temp
- /data/media/####/0668F4008AFBD99853A8C2B6CF76D3FD.zip
- /data/media/####/5.0wwn.jar.u
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/com_gghjk_comyyyus.txt
- /data/media/####/conlts.dat
- /data/media/####/ls.db
- /data/media/####/ls.db-journal
- /data/media/####/restime.dat
Другие:
Запускает следующие shell-скрипты:
- /system/bin/sh
- cat /proc/version
- cat /sys/class/android_usb/android0/idProduct
- cat /sys/class/android_usb/android0/idVendor
- cat /sys/class/net/wlan0/address
- chmod 755 <Package Folder>/.jiagu/libjiagu99474394.so
- getprop
- getprop ro.board.platform
- getprop ro.product.cpu.abi
- ls -l /dev
- ls -l /dev/block
- ls -l /dev/block/vold
- ls -l /dev/bus
- ls -l /dev/bus/usb
- ls -l /dev/bus/usb/001
- ls -l /dev/com.android.settings.daemon
- ls -l /dev/cpuctl
- ls -l /dev/cpuctl/apps
- ls -l /dev/cpuctl/apps/bg_non_interactive
- ls -l /dev/graphics
- ls -l /dev/input
- ls -l /dev/log
- ls -l /dev/pts
- ls -l /dev/snd
- ls -l /dev/socket
- ps
Загружает динамические библиотеки:
- libjiagu99474394
- libmbgv
- locSDK4d
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- DES
- DES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- DES
- DES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию о настроках APN.
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
