Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.HiddenAds.4.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) api.jiu####.com:80
- TCP(HTTP/1.1) g.1####.cn:80
- TCP(HTTP/1.1) a.appj####.com:80
- TCP(HTTP/1.1) s.traffi####.cn:80
- TCP(HTTP/1.1) www.go####.com:80
- TCP(HTTP/1.1) pu####.mig####.cdn.####.cn:80
- TCP(HTTP/1.1) p####.vqs.com:80
- TCP(TLS/1.0) hm.b####.com:443
Запросы DNS:
- a.appj####.com
- api.jiu####.com
- g.1####.cn
- hm.b####.com
- p####.vqs.com
- pu####.mig####.com
- s.traffi####.cn
- www.go####.com
Запросы HTTP GET:
- g.1####.cn/4QbVtADbnLVIc/c.FxJzG50F.js?D9PVtGL=####
- g.1####.cn/4QbVtADbnLVIc/d.FxJzG50F.js?D9PVtGL=####
- g.1####.cn/a/?utm=####
- g.1####.cn/d/file/2014/10/29/aba5f85e2d403417b79b18aca6ac5a0d.png
- g.1####.cn/d/file/2017/10/10/9ba2a3835b8bc004a4c7d79d71185877.jpg
- g.1####.cn/d/file/2017/10/25/2cefff6ac7aa114d7c35da51e6ef26b8.jpg
- g.1####.cn/d/file/2017/10/25/c0a58e33e759113ac45053f5e902a91e.jpg
- g.1####.cn/d/file/2018/01/25/e11afab0bd15af75700dba5d494cf004.png
- g.1####.cn/d/file/2018/01/25/f375516eb2cc202101adb08d7794119a.png
- g.1####.cn/d/file/2018/02/01/2ee20d38656d49436eda8aae99fac088.png
- g.1####.cn/d/file/2018/02/08/9b4491b47cc59ceb4466623944d72041.png
- g.1####.cn/d/file/2018/02/13/3cf3e3c9ea328eb47ea5839ea228305e.png
- g.1####.cn/d/file/2018/02/13/f28ad0f633079a1b6bbd19b38702abf6.png
- g.1####.cn/d/file/2018/03/30/a0c7f2799074d3635b9ac6aa8561ce2c.png
- g.1####.cn/d/file/2018/07/13/cab4e2f136044e57c9838cf631430ce6.jpg
- g.1####.cn/d/file/2018/07/27/2a228dd03cb1ddb0eca79a986198835c.jpg
- g.1####.cn/d/file/2018/08/17/2bac2ba8c8f29165aa061db4ccb20f12.jpg
- g.1####.cn/d/file/2018/08/29/b8e840b5e3532c358ac708988693b341.jpg
- g.1####.cn/d/file/2018/09/19/ef38eb3d50a1d2668e53d93ed26973d9.jpg
- g.1####.cn/e/a/Search/migu_gg?authid=####&token=####&imp[0][id]=####&imp...
- g.1####.cn/favicon.ico
- g.1####.cn/skin/common/img/icon-police.png
- g.1####.cn/skin/default/js/androidAsyncLoad.js?v=####
- g.1####.cn/skin/default/uc/css/change.css?v=####
- g.1####.cn/skin/html4/androidMetro/images/jbmail.gif
- g.1####.cn/skin/html4/androidMetro/images/online_service_phone.png?v=####
- g.1####.cn/skin/html4/androidMetro/images/tcClose.gif
- g.1####.cn/skin/html4/androidNew/css/cjpf2016.css?v=####
- g.1####.cn/skin/html4/androidNew/css/ylnews.css?v=####
- g.1####.cn/skin/html4/anzhuonew1/css/indexofrem.css?v=####
- g.1####.cn/skin/html4/anzhuonew1/css/publicT1.css?v=####
- g.1####.cn/skin/html4/anzhuonew1/css/search.css?v=####
- g.1####.cn/skin/html4/anzhuonew1/css/topT1.css?v=####
- g.1####.cn/skin/html4/anzhuonew1/images/dingzi.png
- g.1####.cn/skin/html4/anzhuonew1/images/gouwuche.png
- g.1####.cn/skin/html4/anzhuonew1/images/hot_zhuanji.png
- g.1####.cn/skin/html4/anzhuonew1/images/huiyuan.png
- g.1####.cn/skin/html4/anzhuonew1/images/jrhd.png
- g.1####.cn/skin/html4/anzhuonew1/images/line-sgrey.png
- g.1####.cn/skin/html4/anzhuonew1/images/linegray.png
- g.1####.cn/skin/html4/anzhuonew1/images/linegre.png
- g.1####.cn/skin/html4/anzhuonew1/images/linegre2.png
- g.1####.cn/skin/html4/anzhuonew1/images/linered.png
- g.1####.cn/skin/html4/anzhuonew1/images/lineyel.png
- g.1####.cn/skin/html4/anzhuonew1/images/little.png
- g.1####.cn/skin/html4/anzhuonew1/images/logo.png
- g.1####.cn/skin/html4/anzhuonew1/images/logo_new.png
- g.1####.cn/skin/html4/anzhuonew1/images/meitu.png
- g.1####.cn/skin/html4/anzhuonew1/images/mgsp0725.png
- g.1####.cn/skin/html4/anzhuonew1/images/new.png
- g.1####.cn/skin/html4/anzhuonew1/images/picsix.png
- g.1####.cn/skin/html4/anzhuonew1/images/picture1.png
- g.1####.cn/skin/html4/anzhuonew1/images/picture2.png
- g.1####.cn/skin/html4/anzhuonew1/images/picture3.png
- g.1####.cn/skin/html4/anzhuonew1/images/picture4.png
- g.1####.cn/skin/html4/anzhuonew1/images/picture5.png
- g.1####.cn/skin/html4/anzhuonew1/images/picture6.png
- g.1####.cn/skin/html4/anzhuonew1/images/sousuo.png
- g.1####.cn/skin/html4/anzhuonew1/images/star.png
- g.1####.cn/skin/html4/anzhuonew1/images/try_btn.png
- g.1####.cn/skin/html4/anzhuonew1/images/xy.png
- g.1####.cn/skin/html4/anzhuonew1/images/yonghu.png
- g.1####.cn/skin/html4/anzhuonew1/images/zhuanti.png
- g.1####.cn/skin/html4/anzhuonew1/js/cloud.js?v=####
- g.1####.cn/skin/html4/anzhuonew1/js/jq.Slide.js?v=####
- g.1####.cn/skin/html4/anzhuonew1/js/jquery-1.8.3.min.js?v=####
- g.1####.cn/skin/html4/anzhuonew1/js/jquery.lazyload.min.js?v=####
- g.1####.cn/skin/html4/anzhuonew1/js/mb.js?v=####
- g.1####.cn/skin/html4/anzhuonew1/js/mb1.js?v=####
- g.1####.cn/skin/html4/anzhuonew1/js/myjs.js?v=####
- g.1####.cn/skin/html4/anzhuonew1/js/touchslider.js?v=####
- g.1####.cn/skin/html4/default/css/iconforinfo.css?v=####
- g.1####.cn/skin/html4/default/css/subscriptShow.css?v=####
- g.1####.cn/skin/html4/default/js/nav.js?v=####
- g.1####.cn/skin/html4/ios/js/jquery.cookie.js?v=####
- g.1####.cn/skin/revision/skin2/images/bmd_logo.png
- p####.vqs.com/2016/0519/lALOIoHVKGBg_96_96.png
- p####.vqs.com/2016/0519/lALOIoHVSGBg_96_96.png
- pu####.mig####.cdn.####.cn/resource/20141219/741384/000068469000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20150320/798239/006062323000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20150327/794595/006060157000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20150602/796101/006078009000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20151027/799049/006095904000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20151206/796101/006100610000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20151209/799087/006097369000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160108/780412/006103934000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160331/782455/006111937000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160419/772420/006113052000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160422/741156/006030454000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160525/799087/006101401000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160602/701001/006115989000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160602/701001/006116005000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160603/701001/006116080000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160620/710215/006117045000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160714/710517/006034033000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160728/799087/006102047000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160901/783333/006121895000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20160913/741032/006116099000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20161104/710517/006085789000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20161209/710517/006127156000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20161222/701001/006127904000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20161222/701001/006127915000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20161230/799087/006071018000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20170106/701001/006128712000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20170329/741032/006037638000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20170418/710245/006116030000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20170424/799087/006133129000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20170427/701001/006133304000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20170524/799087/006132474000/icon/14...
- pu####.mig####.cdn.####.cn/resource/20170612/780569/006135609000/icon/14...
- pu####.mig####.cdn.####.cn/resource/610524/006142859000/icon/15120995605...
- pu####.mig####.cdn.####.cn/resource/613599/006144338000/icon/15172154181...
- pu####.mig####.cdn.####.cn/resource/613600/006144643000/icon/15180789704...
- pu####.mig####.cdn.####.cn/resource/710215/006117078000/icon/15433083815...
- pu####.mig####.cdn.####.cn/resource/710517/006137846000/icon/14991640212...
- pu####.mig####.cdn.####.cn/resource/741479/006036050000/icon/15216905254...
- pu####.mig####.cdn.####.cn/resource/772279/006137590000/icon/15483973243...
- pu####.mig####.cdn.####.cn/resource/780569/006140826000/icon/15054621585...
- pu####.mig####.cdn.####.cn/resource/780569/006140859000/icon/15055488908...
- pu####.mig####.cdn.####.cn/resource/794448/006141395000/icon/15076242592...
- pu####.mig####.cdn.####.cn/resource/794595/006139731000/icon/15027881243...
- pu####.mig####.cdn.####.cn/resource/795098/006140729000/icon/15052079738...
- pu####.mig####.cdn.####.cn/resource/799087/006141991000/icon/15095837872...
- s.traffi####.cn/s,8XPZx9l1yafDwQFCUg
- www.go####.com/complete/search?hl=####&client=####&q=####
Запросы HTTP POST:
- a.appj####.com/ad-service/ad/mark
- a.appj####.com/jiagu/check/upgrade
- api.jiu####.com/index.php?m=####&c=####&a=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.jg.ic
- /data/data/####/.log.lock
- /data/data/####/.log.ls
- /data/data/####/DKIII_Depot
- /data/data/####/DKIII_Pay
- /data/data/####/game_active.xml
- /data/data/####/jg_app_update_settings_random.xml
- /data/data/####/libjiagu.so
- /data/data/####/vqs_shared_data.xml
- /data/data/####/webview.db-journal
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- libjiagu
Использует следующие алгоритмы для расшифровки данных:
- DES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
