Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) pe####.zhixia####.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5226
Запросы DNS:
- 7j####.c####.z0.####.com
- c####.g####.ig####.com
- c-h####.g####.com
- pe####.zhixia####.com
- pub-####.qin####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
Запросы HTTP GET:
- pe####.zhixia####.com/Uploads/images/201605/5746b2b8ccf49.jpg
- pe####.zhixia####.com/Uploads/images/201606/57514ba78ae3c.jpg
- pe####.zhixia####.com/Uploads/images/201606/5763b0441c15b.jpg
- pe####.zhixia####.com/Uploads/images/201606/57679d08a5ed2.jpg
- pe####.zhixia####.com/Uploads/images/201606/57679ecde64f5.jpg
- pe####.zhixia####.com/Uploads/images/201606/5767a38c352da.jpg
- pe####.zhixia####.com/Uploads/images/201606/5767a6e5ab1ee.jpg
- pe####.zhixia####.com/Uploads/images/201606/5767a73a4831a.jpg
- pe####.zhixia####.com/Uploads/images/201606/5768a18d8f603.jpg
- pe####.zhixia####.com/Uploads/images/201606/5768a386447ef.jpg
- pe####.zhixia####.com/Uploads/images/201606/5768a631d15dc.jpg
- pe####.zhixia####.com/Uploads/images/201606/5768f17e226d9.jpg
- pe####.zhixia####.com/Uploads/images/201606/5768faa63d104.jpg
- pe####.zhixia####.com/Uploads/images/201606/5768fd34bdbbc.jpg
- pe####.zhixia####.com/Uploads/images/201606/5768ff83d0de4.jpg
- pe####.zhixia####.com/Uploads/images/201610/57ef12909d34d.jpg
- pe####.zhixia####.com/Uploads/images/201610/58047c334cf8c.jpg
- pe####.zhixia####.com/Uploads/images/201610/58073432b69fd.jpg
- pe####.zhixia####.com/Uploads/images/201610/5808672495bb1.jpg
- pe####.zhixia####.com/Uploads/images/201610/580b0f4d34faf.jpg
- pe####.zhixia####.com/Uploads/images/201611/5834f1b6d8c5a.jpg
- pe####.zhixia####.com/Uploads/images/201611/5834f32564fc5.jpg
- pe####.zhixia####.com/Uploads/images/201611/5834f5f5f08e7.jpg
- pe####.zhixia####.com/Uploads/images/201704/590072468b7db.jpg
- pe####.zhixia####.com/Uploads/images/201704/590072e7cdd4d.jpg
- pe####.zhixia####.com/Uploads/images/201704/5900748f50ac0.jpg
- pe####.zhixia####.com/Uploads/images/201704/5900754058038.jpg
- pe####.zhixia####.com/Uploads/images/201707/5962e127742da.jpg
- pe####.zhixia####.com/Uploads/images/201707/597b07c695635.jpg
- pe####.zhixia####.com/Uploads/images/201708/599d35465cc60.jpg
- pe####.zhixia####.com/Uploads/images/201709/59bf811a6e6e5.jpg
- pe####.zhixia####.com/Uploads/images/201709/59c4b3f83c9db.jpg
- pe####.zhixia####.com/Uploads/images/201709/59c4bfd7c3cd5.jpg
- pe####.zhixia####.com/Uploads/images/201709/59c8aa59023da.png
- pe####.zhixia####.com/Uploads/images/201711/1512057193.jpg
- pe####.zhixia####.com/Uploads/images/201712/1512390079.jpg
- pe####.zhixia####.com/Uploads/images/201712/1512400168.jpg
- pe####.zhixia####.com/Uploads/images/201712/1512478759.jpg
- pe####.zhixia####.com/Uploads/images/201712/1512634391.jpg
- pe####.zhixia####.com/Uploads/images/201805/1526609155.jpg
- pe####.zhixia####.com/Uploads/images/201805/1526632121.jpg
- pe####.zhixia####.com/Uploads/images/201805/1526632206.jpg
- pe####.zhixia####.com/Uploads/images/201805/1526632246.jpg
- pe####.zhixia####.com/Uploads/images/201805/1526632284.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527241433.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527241601.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527241771.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527501525.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527559221.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527560630.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527560825.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527575701.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527576972.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527577028.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527577075.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527577124.jpg
- pe####.zhixia####.com/Uploads/images/201805/1527578635.jpg
- pe####.zhixia####.com/Uploads/images/201806/1528083586.jpg
- pe####.zhixia####.com/Uploads/images/201806/1529137098.jpg
- pe####.zhixia####.com/Uploads/images/201806/1529659044.jpg
- pe####.zhixia####.com/Uploads/images/201807/1530512956.jpg
- t####.c####.q####.####.com/tdata_Soq141
- t####.c####.q####.####.com/tdata_vxj811
- ti####.c####.l####.####.com/config/hz-hzv3.conf
Запросы HTTP POST:
- c-h####.g####.com/api.php?format=####&t=####
- pe####.zhixia####.com/ApiCategory/get_list
- pe####.zhixia####.com/ApiCourse/course_list?
- pe####.zhixia####.com/ApiIndex/index?
- pe####.zhixia####.com/ApiIndex/welcome/?type=####
- pe####.zhixia####.com/ApiLecturer/detail?
- pe####.zhixia####.com/ApiLecturer/lists?
- pe####.zhixia####.com/ApiPublic/version?
- pe####.zhixia####.com/ApiQA/index?page=####&num=####
- pe####.zhixia####.com/ApiUserDynamic/dynamic_list?page=####&num=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.jg.ic
- /data/data/####/com.huizhong.education_preferences.xml
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/libjiagu-1313525027.so
- /data/data/####/pri_tencent_analysis.db-journal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qihoo_jiagu_crash_report.xml
- /data/data/####/run.pid
- /data/data/####/tdata_Soq141
- /data/data/####/tdata_Soq141.jar
- /data/data/####/tdata_vxj811
- /data/data/####/tdata_vxj811.jar
- /data/data/####/tencent_analysis.db
- /data/data/####/tencent_analysis.db-journal
- /data/data/####/umeng_socialize_qq.xml
- /data/media/####/.nomedia
- /data/media/####/19l2vl1dj33qjsgb96qgm0z2q.tmp
- /data/media/####/1szsbp7i6lisai1s57ssyfgwn.tmp
- /data/media/####/218tmju9yss2hc86ggz61b9qc.tmp
- /data/media/####/2n9poj7ffhal0gd12utb618dy.tmp
- /data/media/####/2w74l530mi4et5o2f9mtl9nxo.tmp
- /data/media/####/3sjrloqccko3ludt48uyifkw3.tmp
- /data/media/####/4dvabl0p7foqbfa9i2mtsjnk3.tmp
- /data/media/####/6pf54ea23mmjxhu85zoynib61.tmp
- /data/media/####/6pyl7xugp30kj2g7h4wk6e24j.tmp
- /data/media/####/7hx1390bxmdaxfrlkz6arzcy0.tmp
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.huizhong.education.bin
- /data/media/####/com.huizhong.education.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/tdata_Soq141
- /data/media/####/tdata_vxj811
- /data/media/####/test.log
- /data/media/####/vrac66rnnu7s9hl6nasjo498.tmp
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.huizhong.push.PushStartService 25243 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- mount
Загружает динамические библиотеки:
- MtaNativeCrash
- getuiext2
- libjiagu-1313525027
Использует следующие алгоритмы для шифрования данных:
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
