Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.3394
- Android.DownLoader.635.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) b####.shoujid####.com.####.cn:80
- TCP(HTTP/1.1) pl####.y####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.net:80
- TCP(HTTP/1.1) c.appj####.com:80
- TCP(HTTP/1.1) cdnb####.shoujid####.com.####.com:80
- TCP(HTTP/1.1) www.s####.net:80
- TCP(TLS/1.0) 1####.217.17.78:443
Запросы DNS:
- 7x####.c####.z0.####.com
- a####.u####.com
- b####.shoujid####.com
- c.appj####.com
- cdnb####.shoujid####.com
- mt####.go####.com
- pl####.y####.com
- www.s####.net
Запросы HTTP GET:
- b####.shoujid####.com.####.cn/bb/video/130182201/139352400.mp4
- cdnb####.shoujid####.com.####.com/bb/video/pic/139088400.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139097400.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139098500.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139127200.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139128500.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139216400.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139217700.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139219000.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139230200.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139232300.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139323200.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139323600.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139352400.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139352600.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139353400.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139353700.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139354000.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139354400.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139354500.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139359400.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139359800.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139361400.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139361800.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/139364900.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000373.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000378.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000379.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000380.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000388.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000389.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000391.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000396.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000401.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000402.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000418.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000419.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000421.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000427.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000435.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000439.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000441.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000442.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000458.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000459.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000460.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000463.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000473.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000479.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000944.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000945.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000946.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000947.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000948.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000949.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000950.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000951.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000952.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000955.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000959.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000960.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000961.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000962.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000965.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000967.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000968.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000969.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000970.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000972.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/20000973.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/203368900.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/288504200.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/329210700.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/329212700.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/329218300.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/329228600.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/329230900.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/329231800.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/329232900.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/329236500.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/329251000.jpg
- cdnb####.shoujid####.com.####.com/bb/video/pic/334437100.jpg
- pl####.y####.com/m/sdkver.json?ver=####&dev=####&pn=####
- t####.c####.q####.####.net/adset.txt
Запросы HTTP POST:
- a####.u####.com/app_logs
- c.appj####.com/ad/splash/stats.html
- www.s####.net/Mini/niouy.action?key=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/1409069906-1000325008
- /data/data/####/1409069906-1001248529
- /data/data/####/1409069906-1005866134
- /data/data/####/1409069906-1043267868
- /data/data/####/1409069906-112821327
- /data/data/####/1409069906-118362453
- /data/data/####/1409069906-1347416083
- /data/data/####/1409069906-146991604
- /data/data/####/1409069906-1471533166
- /data/data/####/1409069906-149762167
- /data/data/####/1409069906-1562254771
- /data/data/####/1409069906-170079629
- /data/data/####/1409069906-171003150
- /data/data/####/1409069906-1719069029
- /data/data/####/1409069906-1766066746
- /data/data/####/1409069906-2033235086
- /data/data/####/1409069906-205173427
- /data/data/####/1409069906-206096948
- /data/data/####/1409069906-2092368655
- /data/data/####/1409069906-2111392141
- /data/data/####/1409069906-227337931
- /data/data/####/1409069906-231032015
- /data/data/####/1409069906-253065482
- /data/data/####/1409069906-257814124
- /data/data/####/1409069906-2593453
- /data/data/####/1409069906-263355250
- /data/data/####/1409069906-27528520
- /data/data/####/1409069906-284596233
- /data/data/####/1409069906-285519754
- /data/data/####/1409069906-311940046
- /data/data/####/1409069906-31222604
- /data/data/####/1409069906-319690031
- /data/data/####/1409069906-320613552
- /data/data/####/1409069906-33993167
- /data/data/####/1409069906-34916688
- /data/data/####/1409069906-35840209
- /data/data/####/1409069906-5364016
- /data/data/####/1409069906-54415749
- /data/data/####/1409069906-551832458
- /data/data/####/1409069906-56157671
- /data/data/####/1409069906-57081192
- /data/data/####/1409069906-58004713
- /data/data/####/1409069906-584029485
- /data/data/####/1409069906-58928234
- /data/data/####/1409069906-59851755
- /data/data/####/1409069906-60775276
- /data/data/####/1409069906-6287537
- /data/data/####/1409069906-662186540
- /data/data/####/1409069906-662436614
- /data/data/####/1409069906-682299634
- /data/data/####/1409069906-707198191
- /data/data/####/1409069906-7211058
- /data/data/####/1409069906-726580594
- /data/data/####/1409069906-746411
- /data/data/####/1409069906-792653716
- /data/data/####/1409069906-909722403
- /data/data/####/1409069906-945837269
- /data/data/####/1409069906-950454874
- /data/data/####/1409069906-971695857
- /data/data/####/1409069906-972619378
- /data/data/####/1409069906-980007546
- /data/data/####/14090699061050959922
- /data/data/####/14090699061080623795
- /data/data/####/14090699061100631
- /data/data/####/14090699061112820822
- /data/data/####/14090699061158530776
- /data/data/####/1409069906120832535
- /data/data/####/14090699061411587798
- /data/data/####/14090699061702157587
- /data/data/####/1409069906177110
- /data/data/####/14090699062115547765
- /data/data/####/140906990621418093
- /data/data/####/140906990623265135
- /data/data/####/140906990624188656
- /data/data/####/140906990625831110
- /data/data/####/1409069906433012526
- /data/data/####/1409069906666885300
- /data/data/####/140906990682515958
- /data/data/####/1409069906850484269
- /data/data/####/1409069906930179161
- /data/data/####/1409069906960838351
- /data/data/####/ad_show_time.xml
- /data/data/####/com.v.qn.bj.fablestory.apk
- /data/data/####/exchangeIdentity.json
- /data/data/####/jg_app_update_settings_random.xml
- /data/data/####/libjiagu.so
- /data/data/####/libutil.so
- /data/data/####/quit.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- libjiagu
- libstlport_shared
- libvplayer
Использует следующие алгоритмы для шифрования данных:
- RSA
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Отрисовывает собственные окна поверх других приложений.
