Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.860.origin
- Android.DownLoader.861.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pub.idq####.com.####.com:80
- TCP(HTTP/1.1) src.r####.com.####.com:80
- TCP(HTTP/1.1) web.m####.ab####.com:80
- TCP(HTTP/1.1) w####.233.com:80
- TCP(HTTP/1.1) w####.qq.com:80
- TCP(HTTP/1.1) i####.233.com:80
- TCP(HTTP/1.1) sdk.c####.com:80
- TCP(HTTP/1.1) www.bbgus####.com:89
- TCP(HTTP/1.1) m.a.2####.com:80
- TCP(HTTP/1.1) xx.h####.net:80
- TCP(TLS/1.0) an####.l####.com:443
- TCP(TLS/1.0) 1####.217.17.78:443
- TCP(TLS/1.0) w####.qq.com:443
Запросы DNS:
- an####.l####.com
- i####.233.com
- i####.233.com
- m.a.2####.com
- pub.idq####.com
- sdk.c####.com
- src.r####.com
- w####.233.com
- w####.qq.com
- www.bbgus####.com
- www.h####.net
- xx.h####.net
Запросы HTTP GET:
- i####.233.com/??x/sea-modules/seajs/seajs/2.2.1/sea.js,a/sea-config.js,x...
- i####.233.com/a/uncore.js?v=####
- i####.233.com/student/img/v5/me.png
- i####.233.com/student/js/v6/Cookie.js?v=####
- i####.233.com/student/lm/css/default/course.css
- i####.233.com/student/lm/css/default/lm_base.css
- i####.233.com/student/lm/css/meadow/top_footer.css
- i####.233.com/student/lm/m/css/base.css
- i####.233.com/student/lm/m/css/course.css
- i####.233.com/student/lm/m/css/top_footer.css
- i####.233.com/student/lm/m/css/video.css
- i####.233.com/student/lm/m/images/anonymous.png
- i####.233.com/student/lm/m/images/avatar.png
- i####.233.com/student/lm/m/images/course.png
- i####.233.com/student/lm/m/images/head.png
- i####.233.com/student/lm/m/images/vide-bg.png
- i####.233.com/student/wap/v2/img/vido.png
- i####.233.com/wx/artDialog/jquery.artDialog.js?v=####&skin=####
- i####.233.com/wx/artDialog/skins/default.css?4####
- i####.233.com/wx/js/student/Dialog.min.js?v=####
- i####.233.com/wx/study/v3/video/videoplay.v1.js?v=####&v=####
- m.a.2####.com/scripts/jquery-1.11.1.js?v=####
- m.a.2####.com/union/video?videoid=####
- pub.idq####.com.####.com/qconn/wpa/button/button_old_41.gif
- src.r####.com.####.com/kubo/dex/hh_9.0_145.dex
- w####.233.com/attached/image/20151010/20151010135958_5324.jpg
- w####.233.com/student/img/njiaocai/20140924153835.png
- w####.233.com/student/img/njiaocai/20141204/20141204160009_5089.png
- w####.233.com/student/img/njiaocai/20150215/20150215132257_6765.png
- w####.233.com/student/img/njiaocai/20150327/20150327144349_7979.png
- w####.233.com/student/img/njiaocai/20150513/20150513110534_4371.png
- w####.233.com/student/img/njiaocai/20150806/20150806144824_5470.png
- w####.233.com/student/img/njiaocai/20150819/20150819100029_3321.jpg
- w####.233.com/student/img/njiaocai/π老师.jpg
- w####.qq.com/pa?p=####
- web.m####.ab####.com/01xxpic/11lj.gif
- web.m####.ab####.com/01xxpic/1lj.gif
- web.m####.ab####.com/01xxpic/2lj.gif
- web.m####.ab####.com/01xxpic/3lj.gif
- web.m####.ab####.com/01xxpic/4lj.gif
- web.m####.ab####.com/01xxpic/5lj.gif
- web.m####.ab####.com/01xxpic/6lj.gif
- web.m####.ab####.com/01xxpic/hgmst.gif
- web.m####.ab####.com/01xxpic/hgtk.gif
- web.m####.ab####.com/01xxpic/xkzz.gif
- web.m####.ab####.com/233wx/10wt.gif
- web.m####.ab####.com/233wx/hgkt233.gif
- web.m####.ab####.com/233wx/hgktsc.gif
- web.m####.ab####.com/233wx/hgsp2.gif
- web.m####.ab####.com/233wx/hgtk1.gif
- web.m####.ab####.com/233wx/xx287-248.gif
- web.m####.ab####.com/QQkefu/ServiceQQ.js
- web.m####.ab####.com/QQkefu/images/qq.css
- web.m####.ab####.com/QQkefu/images/qq_1.png
- web.m####.ab####.com/QQkefu/images/qq_listbg.gif
- web.m####.ab####.com/cxs.css
- web.m####.ab####.com/hgmxmszt/hg11.jpg
- web.m####.ab####.com/images/1.jpg
- web.m####.ab####.com/images/2016gzsj.jpg
- web.m####.ab####.com/images/blmx.gif
- web.m####.ab####.com/images/dl.jpg
- web.m####.ab####.com/images/dt.jpg
- web.m####.ab####.com/images/hydl.jpg
- web.m####.ab####.com/images/index_10.jpg
- web.m####.ab####.com/images/index_101.jpg
- web.m####.ab####.com/images/index_102.jpg
- web.m####.ab####.com/images/index_103.jpg
- web.m####.ab####.com/images/index_104.jpg
- web.m####.ab####.com/images/index_12.jpg
- web.m####.ab####.com/images/index_122.jpg
- web.m####.ab####.com/images/index_14.jpg
- web.m####.ab####.com/images/index_16.jpg
- web.m####.ab####.com/images/index_45.jpg
- web.m####.ab####.com/images/index_71.jpg
- web.m####.ab####.com/images/index_72.jpg
- web.m####.ab####.com/images/index_95.jpg
- web.m####.ab####.com/images/index_97.jpg
- web.m####.ab####.com/images/index_98.jpg
- web.m####.ab####.com/images/mod1_o_nav.jpg
- web.m####.ab####.com/images/mod2_znav.jpg
- web.m####.ab####.com/images/mod5_znav.jpg
- web.m####.ab####.com/images/mod8_conbg.jpg
- web.m####.ab####.com/images/mod8_db.jpg
- web.m####.ab####.com/images/mod8_nav.jpg
- web.m####.ab####.com/images/mod9_nav.jpg
- web.m####.ab####.com/images/modnavbg.jpg
- web.m####.ab####.com/images/modz_navbg.jpg
- web.m####.ab####.com/images/navz_ss.jpg
- web.m####.ab####.com/indexxx.htm
- web.m####.ab####.com/jdxxw/tytp/ty14359.jpg
- web.m####.ab####.com/jdxxw/tytp/ty14359b.jpg
- web.m####.ab####.com/jdxxw/tytp/ty14359d.jpg
- web.m####.ab####.com/jscss/demoimg/201403/menu_bg.gif
- web.m####.ab####.com/jscss/demoimg/201403/menu_line2.gif
- web.m####.ab####.com/jscss/demoimg/201403/menu_on_left.gif
- web.m####.ab####.com/jscss/demoimg/201403/menu_on_left2.gif
- web.m####.ab####.com/jscss/demoimg/201403/menu_on_right.gif
- web.m####.ab####.com/jscss/demoimg/201403/menu_on_right2.gif
- web.m####.ab####.com/jscss/demoimg/201403/menu_right.gif
- web.m####.ab####.com/xbtp/ad44.gif
- www.bbgus####.com:89/app/chomp/flashplay/flashplay.xml
- xx.h####.net/xiaoxue/M/Video/GetComment/?myClassId=####&page=####&pageSi...
- xx.h####.net/xiaoxue/choose/course/501-7-0-1.html
- xx.h####.net/xiaoxue/m/choose/course/501-7-0-1.html
- xx.h####.net/xiaoxue/m/course/15972
- xx.h####.net/xiaoxue/m/course/15972/124175/?teacherid=####
Запросы HTTP POST:
- sdk.c####.com/getsiteapi.php
- sdk.c####.com/sdkallapi.php
- sdk.c####.com/versiontapi.php?v=####&type=####
- xx.h####.net/xiaoxue/M/AjaxChooseCourse
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.jg.ic
- /data/data/####/ax_c.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/gg.dex
- /data/data/####/index
- /data/data/####/libjiagu2009411296.so
- /data/data/####/mc145.dex
- /data/data/####/mc_cache.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu2009411296.so
Загружает динамические библиотеки:
- libjiagu2009411296
Использует следующие алгоритмы для шифрования данных:
- AES-ECB-PKCS5Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
