Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.192.origin
- Android.DownLoader.652
Перекрывает экран собственным окном, блокируя доступ к GUI.
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) v2.edu####.100.com:80
- TCP(HTTP/1.1) s.edu####.100.com:80
- TCP(HTTP/1.1) i####.c####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) st####.edu####.com:80
- TCP(HTTP/1.1) ip.ta####.com:80
- TCP(HTTP/1.1) q.c####.com:80
- TCP(HTTP/1.1) api.appj####.com:80
- TCP(HTTP/1.1) hm2.c####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) pco####.ta####.com:80
- TCP(HTTP/1.1) w####.qq.com:80
- TCP(HTTP/1.1) ads.m####.net:80
- TCP(HTTP/1.1) api.m####.net:80
- TCP(HTTP/1.1) www.du####.com:80
- TCP(HTTP/1.1) www.y####.com.####.com:80
- TCP(HTTP/1.1) pub.idq####.com.####.com:80
- TCP(HTTP/1.1) s.h####.com:80
- TCP(HTTP/1.1) m.y####.com.####.com:80
- TCP(HTTP/1.1) gl####.b2.edu####.com:80
- TCP(HTTP/1.1) web####.360.cn:80
- TCP(HTTP/1.1) www.h####.com:80
- TCP(HTTP/1.1) h####.h####.com:80
- TCP(HTTP/1.1) st####.h####.com:80
Запросы DNS:
- ads.m####.net
- api.appj####.com
- api.m####.net
- c####.mm####.com
- c.c####.com
- h####.c####.com
- h####.h####.com
- i####.c####.com
- ip.ta####.com
- kc.y####.com
- l####.sope####.com
- m.h####.com
- m.y####.com
- mt####.go####.com
- p1.w####.com
- p2.w####.com
- pco####.c####.com
- pub.idq####.com
- q1.c####.com
- q11.c####.com
- q14.c####.com
- s.edu####.com
- s.h####.com
- s1.w####.com
- s2.w####.com
- st####.edu####.com
- st####.h####.com
- v2.edu####.com
- w####.qq.com
- w.c####.com
- web####.360.cn
- www.du####.com
- www.edu####.com
- www.h####.com
- www.y####.com
Запросы HTTP GET:
- ads.m####.net/newsdk/PopupAd_desc_1_3_1.zip
- ads.m####.net/newsdk/PopupAd_dex_1_3_1.zip
- c.c####.com/c.php?id=####
- c.c####.com/c.php?id=####&l=####
- c.c####.com/core.php?web_id=####&l=####&t=####
- c.c####.com/core.php?web_id=####&t=####
- gl####.b2.edu####.com/css/ment_crgk.css
- gl####.b2.edu####.com/css/pagebottomlink.css
- gl####.b2.edu####.com/js/footer2016_pd.js
- gl####.b2.edu####.com/js/newpage-public.js
- gl####.b2.edu####.com/leraning/class_chengrengk/
- gm.mm####.com/9.gif?abc=####&rnd=####
- h####.h####.com/index.php?m=####&c=####&a=####&id=####
- h####.h####.com/show_code?id=####
- h####.h####.com/show_post?id=####
- hm2.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&s...
- i####.c####.com/img/2.gif
- ip.ta####.com/service/getIpInfo.php?ip=####
- m.y####.com.####.com/
- pco####.ta####.com/app.gif?&cna=####
- pub.idq####.com.####.com/qconn/wpa/button/button_11.gif
- q.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
- s.edu####.100.com/statics/home/js/live_banner/live_banner_main.js
- s.h####.com/statics/home/js/live_banner/live_banner_main.js
- st####.edu####.com/gedu_plugin/jquery-cookie/jquery.cookie.1.4.1.min.js
- st####.edu####.com/js/gedu-ShoppingCart.min.js
- st####.edu####.com/js/gedu-shoppingcart.min.js
- st####.h####.com/class_jzs2/css/fudong.css
- st####.h####.com/class_jzs2/css/fudong.css/
- st####.h####.com/gedu_plugin/jquery-cookie/jquery.cookie.1.4.1.min.js
- v2.edu####.100.com/jsapi/changecart/index
- w####.qq.com/pa?p=####
- web####.360.cn/status/pai/hash/7224be1218b7bed1d31f2c5244915526
- www.du####.com/20000156/10040325.js
- www.du####.com/duowan.js
- www.h####.com/leraning/class_jzs2/css/fudong.css
- www.h####.com/leraning/statics/blue/css/screen.css?v####
- www.h####.com/leraning/statics/blue/js/gedu-newpage-min.js
- www.y####.com.####.com/
- www.y####.com.####.com/crgk/
- www.y####.com.####.com/crgk/css/style.css
- www.y####.com.####.com/crgk/images/clip002.gif
- www.y####.com.####.com/crgk/images/f_qq.png
- www.y####.com.####.com/crgk/images/logo.jpg
- www.y####.com.####.com/crgk/images/new.gif
- www.y####.com.####.com/crgk/images/news_em.jpg
- www.y####.com.####.com/crgk/images/news_icon.png
- www.y####.com.####.com/crgk/images/pic_01.gif
- www.y####.com.####.com/crgk/images/pic_27.gif
- www.y####.com.####.com/crgk/images/shouye_at.jpg
- www.y####.com.####.com/crgk/images/shouye_chengkao.jpg
- www.y####.com.####.com/crgk/images/shouye_hgd.jpg
- www.y####.com.####.com/crgk/images/shouye_huanqiu.jpg
- www.y####.com.####.com/crgk/images/shouye_lg.jpg
- www.y####.com.####.com/crgk/images/shouye_rd.jpg
- www.y####.com.####.com/crgk/images/shouye_renda.jpg
- www.y####.com.####.com/crgk/images/shouye_slide_01.jpg
- www.y####.com.####.com/crgk/images/shouye_slide_02.jpg
- www.y####.com.####.com/crgk/images/slide.gif
- www.y####.com.####.com/crgk/images/tx_icon.png
- www.y####.com.####.com/css/reset.css
- www.y####.com.####.com/css/style.css
- www.y####.com.####.com/css/yuloo_footer.css
- www.y####.com.####.com/css/yuloo_head.css
- www.y####.com.####.com/cyzg/images/scroll_02.png
- www.y####.com.####.com/d/file/1810/0bf9c811d0009fc0aa2d6b794d44f1e9.jpg
- www.y####.com.####.com/d/file/1810/54f265e3450ccf9c5d1194f704c13c80.jpg
- www.y####.com.####.com/d/file/1810/66adcc5cb3a2415ecdf4798375fae998.jpg
- www.y####.com.####.com/d/file/1810/6fa75ae07d19ea5152769b9a0d2fa4d1.jpg
- www.y####.com.####.com/d/file/1810/fb3b2daa4fd9056118e805757a5ca244.jpg
- www.y####.com.####.com/d/file/1811/19afa210f5e501539f70d72f24fdaa26.jpg
- www.y####.com.####.com/d/file/1811/60ef8055e1935b6bfdcba388cf97ab13.jpg
- www.y####.com.####.com/d/file/1811/dbe841910b194fe1bccf3f16f2946955.jpg
- www.y####.com.####.com/e/public/onclick/?enews=####&classid=####
- www.y####.com.####.com/images/course.jpg
- www.y####.com.####.com/images/icon-01.png
- www.y####.com.####.com/images/li_img.png
- www.y####.com.####.com/images/nav-tit.png
- www.y####.com.####.com/images/public-img/icon-ba.png
- www.y####.com.####.com/images/public-img/loadimg.png
- www.y####.com.####.com/images/school.jpg
- www.y####.com.####.com/images/slider-arrow.png
- www.y####.com.####.com/images/style/weixin_close.jpg
- www.y####.com.####.com/images/yuloo-logo.png
- www.y####.com.####.com/jingjishi/images/slide_box.jpg
- www.y####.com.####.com/js/a_lj.js
- www.y####.com.####.com/js/img_lazy_load.js
- www.y####.com.####.com/js/jquery1.4.2.js
- www.y####.com.####.com/js/mdcfocus.min.js
- www.y####.com.####.com/js/style.js
- www.y####.com.####.com/js/superslide.2.1.1.js
- www.y####.com.####.com/js/tab.js
- www.y####.com.####.com/js/yuloo-head.js
- www.y####.com.####.com/yuloo-images/footer-ba01.png
- www.y####.com.####.com/yuloo-images/footer-ba02.png
- www.y####.com.####.com/yuloo-images/footer-ba03.png
- www.y####.com.####.com/yuloo-images/footer-icon01.png
- www.y####.com.####.com/yuloo-images/footer-kf.png
- www.y####.com.####.com/yuloo-images/footer-wb.png
- www.y####.com.####.com/yuloo-images/footer-wx.jpg
- www.y####.com.####.com/yuloo-images/footer-wx.png
- www.y####.com.####.com/yuloo-images/footer-yuloo-logo.png
- www.y####.com.####.com/yuloo-images/icon-city.png
- www.y####.com.####.com/yuloo-images/icon-search.png
- www.y####.com.####.com/yuloo-images/icon.png
- www.y####.com.####.com/yuloo-images/jt-02.png
- www.y####.com.####.com/yuloo-images/t-tel.png
Запросы HTTP POST:
- ads.m####.net/appscore4/active.bin
- ads.m####.net/appscore4/getappconf.bin
- ads.m####.net/appscore4/popscreen.bin
- api.appj####.com/appjiagu
- api.m####.net/sys_sta/aa.bin
- api.m####.net/sys_sta/an.bin
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/823968622
- /data/data/####/Download-journal
- /data/data/####/Downloado
- /data/data/####/Downloado-journal
- /data/data/####/Log-journal
- /data/data/####/Logo
- /data/data/####/Logo-journal
- /data/data/####/android_cache1.jar
- /data/data/####/com.snishifjisjfihsi.yulujiaoyujishu_preferences.xml
- /data/data/####/config.xml
- /data/data/####/configo.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/iConfig.xml
- /data/data/####/iDownload-journal
- /data/data/####/iLog-journal
- /data/data/####/index
- /data/data/####/jiagu.lock
- /data/data/####/libjiagu.so
- /data/data/####/pop_app_data.xml
- /data/data/####/popup_clientprofile.xml
- /data/data/####/setting1.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.android.dat
- /data/media/####/.android.dat-journal
- /data/media/####/.id
- /data/media/####/.iid
- /data/media/####/.mii
- /data/media/####/com.jssihh.nnhiddc.dex
- /data/media/####/com.jssihh.nnhiddk.dex
- /data/media/####/com.jssihh.nnhiddl.dex
- /data/media/####/download.db
- /data/media/####/download.db-journal
- /data/media/####/id
- /data/media/####/logo.png
- /data/media/####/spot_in.png
Другие:
Загружает динамические библиотеки:
- jiagu
- libjiagu
Использует следующие алгоритмы для шифрования данных:
- DES
- DES-CBC-PKCS5Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CFB-NoPadding
- DES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
