Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.859.origin
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) wa####.b0.a####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) ad####.fohg####.com:80
- TCP(HTTP/1.1) res.wx.qq.####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) ei.c####.com:80
- TCP(HTTP/1.1) pco####.ta####.com:80
- TCP(HTTP/1.1) hungjia####.com:80
- TCP(HTTP/1.1) 1####.75.143.115:80
- TCP(TLS/1.0) fund####.com:443
Запросы DNS:
- ad####.fohg####.com
- c####.mm####.com
- c.c####.com
- ei.c####.com
- fund####.com
- hungjia####.com
- i####.c####.com
- pco####.c####.com
- r####.wx.qq.com
- s4.c####.com
- wa####.6####.com
- z3.c####.com
Запросы HTTP GET:
- ad####.fohg####.com/mh/kaiping1.png
- c.c####.com/core.php?web_id=####&show=####&t=####
- c.c####.com/img/pic.gif
- c.c####.com/z_stat.php?id=####&show=####
- ei.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sh...
- gm.mm####.com/9.gif?abc=####&rnd=####
- hungjia####.com/
- hungjia####.com/Public/home/mhcss/style.min.css?v=####
- hungjia####.com/Public/home/mhimages/home-banner-bottom.png
- hungjia####.com/Public/home/mhimages/svg/tabbar_book_n.svg
- hungjia####.com/Public/home/mhimages/svg/tabbar_home_s.svg
- hungjia####.com/Public/home/mhimages/svg/tabbar_me_n.svg
- hungjia####.com/Public/home/mhjs/fundebug.0.1.7.min.js?v=####
- hungjia####.com/Public/home/mhjs/jquery.js?v=####
- hungjia####.com/Public/home/mhjs/jquery.lazyload.js?v=####
- hungjia####.com/Public/jquery-jbox/dist/jBox.all.css
- hungjia####.com/Public/jquery-jbox/dist/jBox.all.js
- hungjia####.com/Public/upload/images/1804/06/195359392107007275.png
- hungjia####.com/Public/upload/images/1804/06/195404752307004408.png
- hungjia####.com/Public/upload/images/1804/06/195408767294004497.png
- hungjia####.com/Public/upload/images/1804/06/195413423720005649.png
- hungjia####.com/Public/upload/images/1909/10/150943978299009143.png
- hungjia####.com/Public/upload/images/1909/10/154430750998008918.png
- hungjia####.com/Public/upload/images/1909/10/154436422998006537.png
- hungjia####.com/favicon.ico
- pco####.ta####.com/app.gif?&cna=####
- res.wx.qq.####.com/open/js/jweixin-1.0.0.js
- wa####.b0.a####.com/book/1694/cover_1694.jpg
- wa####.b0.a####.com/book/1725/cover_1725.jpg
- wa####.b0.a####.com/book/1737/cover_1737.jpg
- wa####.b0.a####.com/book/2184/cover_2184.jpg
- wa####.b0.a####.com/book/2458/cover_2458.jpg
- wa####.b0.a####.com/book/2506/cover_2506.jpg
- wa####.b0.a####.com/book/2509/cover_2509.jpg
- wa####.b0.a####.com/book/253/cover_253.jpg
- wa####.b0.a####.com/book/3615/cover_3615.jpg
- wa####.b0.a####.com/book/4539/cover_4539.jpg
- wa####.b0.a####.com/book/4544/cover_4544.jpg
- wa####.b0.a####.com/book/4550/cover_4550.jpg
- wa####.b0.a####.com/book/4589/cover_4589.jpg
- wa####.b0.a####.com/book/4597/cover_4597.jpg
- wa####.b0.a####.com/book/4603/cover_4603.jpg
- wa####.b0.a####.com/book/4644/cover_4644.jpg
- wa####.b0.a####.com/book/4657/cover_4657.jpg
- wa####.b0.a####.com/book/4671/cover_4671.jpg
- wa####.b0.a####.com/book/4679/cover_4679.jpg
- wa####.b0.a####.com/book/4698/cover_4698.jpg
- wa####.b0.a####.com/book/4737/cover_4737.jpg
- wa####.b0.a####.com/book/4760/cover_4760.jpg
- wa####.b0.a####.com/book/4850/cover_4850.jpg
- wa####.b0.a####.com/book/4864/cover_4864.jpg
- wa####.b0.a####.com/book/4999/cover_4999.jpg
- wa####.b0.a####.com/book/5018/cover_5018.jpg
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
Запросы HTTP HEAD:
- wa####.b0.a####.com/book/1694/cover_1694.jpg
- wa####.b0.a####.com/book/1725/cover_1725.jpg
- wa####.b0.a####.com/book/1737/cover_1737.jpg
- wa####.b0.a####.com/book/2184/cover_2184.jpg
- wa####.b0.a####.com/book/2458/cover_2458.jpg
- wa####.b0.a####.com/book/2506/cover_2506.jpg
- wa####.b0.a####.com/book/2509/cover_2509.jpg
- wa####.b0.a####.com/book/253/cover_253.jpg
- wa####.b0.a####.com/book/3615/cover_3615.jpg
- wa####.b0.a####.com/book/4539/cover_4539.jpg
- wa####.b0.a####.com/book/4544/cover_4544.jpg
- wa####.b0.a####.com/book/4550/cover_4550.jpg
- wa####.b0.a####.com/book/4589/cover_4589.jpg
- wa####.b0.a####.com/book/4597/cover_4597.jpg
- wa####.b0.a####.com/book/4603/cover_4603.jpg
- wa####.b0.a####.com/book/4644/cover_4644.jpg
- wa####.b0.a####.com/book/4657/cover_4657.jpg
- wa####.b0.a####.com/book/4671/cover_4671.jpg
- wa####.b0.a####.com/book/4679/cover_4679.jpg
- wa####.b0.a####.com/book/4698/cover_4698.jpg
- wa####.b0.a####.com/book/4737/cover_4737.jpg
- wa####.b0.a####.com/book/4760/cover_4760.jpg
- wa####.b0.a####.com/book/4850/cover_4850.jpg
- wa####.b0.a####.com/book/4864/cover_4864.jpg
- wa####.b0.a####.com/book/4999/cover_4999.jpg
- wa####.b0.a####.com/book/5018/cover_5018.jpg
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.jg.ic
- /data/data/####/5baebe8ed4eaf57a6e3533e11850dc7077c363cd39b1672....0.tmp
- /data/data/####/CoCoin_Database.db-journal
- /data/data/####/Values.xml
- /data/data/####/bmob_sp.xml
- /data/data/####/com.dxl.es.ttzb_preferences.xml
- /data/data/####/journal.tmp
- /data/data/####/libjiagu-1173222341.so
- /data/data/####/online_params_file_text.xml
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu-1173222341.so
Загружает динамические библиотеки:
- libjiagu-1173222341
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS7Padding
- DES
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о телефоне (номер, IMEI и т. д.).
Отрисовывает собственные окна поверх других приложений.
