Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Plague.1.origin
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.lion####.com:80
- TCP(HTTP/1.1) upd####.lion####.com:80
- TCP(HTTP/1.1) gameboo####.lion####.com:80
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) d####.fl####.com:443
Запросы DNS:
- cn.wa####.com
- cn1.wa####.com
- cn2.wa####.com
- d####.fl####.com
- g####.face####.com
- gameboo####.lion####.com
- upd####.lion####.com
- www.lion####.com
Запросы HTTP GET:
- upd####.lion####.com/public/games/candyrain/?lang=####
- upd####.lion####.com/public/games/candyrain/assets/art/0.png
- upd####.lion####.com/public/games/candyrain/assets/art/1.png
- upd####.lion####.com/public/games/candyrain/assets/art/2.png
- upd####.lion####.com/public/games/candyrain/assets/art/3.png
- upd####.lion####.com/public/games/candyrain/assets/art/4.png
- upd####.lion####.com/public/games/candyrain/assets/art/5.png
- upd####.lion####.com/public/games/candyrain/assets/art/6.png
- upd####.lion####.com/public/games/candyrain/assets/art/7.png
- upd####.lion####.com/public/games/candyrain/assets/art/8.png
- upd####.lion####.com/public/games/candyrain/assets/art/9.png
- upd####.lion####.com/public/games/candyrain/assets/art/arrow_bonus_hor.png
- upd####.lion####.com/public/games/candyrain/assets/art/arrow_bonus_vert....
- upd####.lion####.com/public/games/candyrain/assets/art/awesome.png
- upd####.lion####.com/public/games/candyrain/assets/art/back.jpg
- upd####.lion####.com/public/games/candyrain/assets/art/big_shining.png
- upd####.lion####.com/public/games/candyrain/assets/art/bomb_bonus.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_1.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_10.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_11.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_2.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_3.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_4.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_5.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_6.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_7.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_8.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_9.png
- upd####.lion####.com/public/games/candyrain/assets/art/border_corner.png
- upd####.lion####.com/public/games/candyrain/assets/art/border_side.png
- upd####.lion####.com/public/games/candyrain/assets/art/button_close.png
- upd####.lion####.com/public/games/candyrain/assets/art/button_exit.png
- upd####.lion####.com/public/games/candyrain/assets/art/button_pause.png
- upd####.lion####.com/public/games/candyrain/assets/art/button_play.png
- upd####.lion####.com/public/games/candyrain/assets/art/button_restart.png
- upd####.lion####.com/public/games/candyrain/assets/art/button_sound_off....
- upd####.lion####.com/public/games/candyrain/assets/art/button_sound_on.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_1.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_2.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_3.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_4.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_5.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_6.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_7.png
- upd####.lion####.com/public/games/candyrain/assets/art/cell.png
- upd####.lion####.com/public/games/candyrain/assets/art/dirt.png
- upd####.lion####.com/public/games/candyrain/assets/art/donut.png
- upd####.lion####.com/public/games/candyrain/assets/art/drop.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_0.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_1.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_2.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_3.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_4.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_5.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_6.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_7.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_8.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_9.png
- upd####.lion####.com/public/games/candyrain/assets/art/gameover_caption....
- upd####.lion####.com/public/games/candyrain/assets/art/global_map.jpg
- upd####.lion####.com/public/games/candyrain/assets/art/gui.png
- upd####.lion####.com/public/games/candyrain/assets/art/heart_particle.png
- upd####.lion####.com/public/games/candyrain/assets/art/hint_arrow.png
- upd####.lion####.com/public/games/candyrain/assets/art/level_button.png
- upd####.lion####.com/public/games/candyrain/assets/art/lock.png
- upd####.lion####.com/public/games/candyrain/assets/art/main_menu_back_en...
- upd####.lion####.com/public/games/candyrain/assets/art/message_window.png
- upd####.lion####.com/public/games/candyrain/assets/art/out_of_moves.png
- upd####.lion####.com/public/games/candyrain/assets/art/p.png
- upd####.lion####.com/public/games/candyrain/assets/art/point_control_big...
- upd####.lion####.com/public/games/candyrain/assets/art/point_control_sma...
- upd####.lion####.com/public/games/candyrain/assets/art/rotate.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_0.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_1.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_2.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_3.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_4.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_5.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_6.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_7.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_8.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_9.png
- upd####.lion####.com/public/games/candyrain/assets/art/select_level_back...
- upd####.lion####.com/public/games/candyrain/assets/art/shining.png
- upd####.lion####.com/public/games/candyrain/assets/art/sickle.png
- upd####.lion####.com/public/games/candyrain/assets/art/stone_heart.png
- upd####.lion####.com/public/games/candyrain/assets/art/superb.png
- upd####.lion####.com/public/games/candyrain/assets/art/task_panel.png
- upd####.lion####.com/public/games/candyrain/assets/art/win_caption.png
- upd####.lion####.com/public/games/candyrain/assets/art/win_strings.png
- upd####.lion####.com/public/games/candyrain/js/game.min.js
- upd####.lion####.com/public/games/candyrain/sg/sg.hooks.js
- upd####.lion####.com/public/games/candyrain/sg/softgames-1.1.js
Запросы HTTP POST:
- gameboo####.lion####.com/view/portal/api.php
- upd####.lion####.com/api/check_update
- www.lion####.com/powerclean/analysis/api.php
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_XQZX8X42...M8_202
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/.jg.ic
- /data/data/####/.yflurrydatasenderblock.25f8a1d5-743f-4d65-9631...569e41
- /data/data/####/.yflurryreport.-5c0a4c881c3037f9
- /data/data/####/AppEventsLogger.persistedsessioninfo
- /data/data/####/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/app_ncxlclasses.jar
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.quick.gamebooster_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dbhcnjn-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/ignoreliondefdb
- /data/data/####/index
- /data/data/####/info
- /data/data/####/info-journal
- /data/data/####/libjiagu.so
- /data/data/####/lionigoredb-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- ls /system/xbin
Загружает динамические библиотеки:
- libjiagu
- vzrv
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- DES-ECB-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
