Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.DownLoader.3394
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.131.10.81:80
- TCP(HTTP/1.1) wx.q####.cn:80
- TCP(HTTP/1.1) www.leleke####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) 1####.199.113.167:80
- TCP(HTTP/1.1) 60.2####.13.58:80
- TCP(HTTP/1.1) thi####.q####.cn:80
- TCP(HTTP/1.1) r.leleke####.com.####.com:80
Запросы DNS:
- a####.u####.com
- downloa####.pan####.net
- hm.b####.com
- mt####.go####.com
- q.q####.cn
- r.leleke####.com
- thi####.q####.cn
- www.leleke####.com
- wx.q####.cn
Запросы HTTP GET:
- 1####.131.10.81/dat/space/avatar/022/23/26/71_middle.png?t=####
- 1####.131.10.81/login/image/anony2.png
- 1####.131.10.81/min/11FZjQ.js?t=####
- 1####.131.10.81/min/B09od.js?t=####
- 1####.131.10.81/min/CAOT8.js?t=####
- 1####.131.10.81/min/MiRpQ-bevOj-Tjf9O-oEc5R-J6gFN-16Oyrm-guFIe-pO3zO.css...
- 1####.131.10.81/min/iry05.css?t=####
- 1####.131.10.81/min/m4H1W-dlEyR-14G2Ek-yc6Ph-fKuEZ.js?t=####
- 1####.131.10.81/min/ml9JF-9GZFD-11SV4k-oDORT-guFIe-pO3zO.css?t=####
- 1####.131.10.81/min/t1pz7-tIPuo-oEc5R-KHTj1-18nvLO-8GTde-guFIe-lqqVP-pO3...
- 1####.131.10.81/uc/image/watermark.png?t=####
- 1####.131.10.81/zuowen/1924.shtml
- 1####.131.10.81/zuowen/clist0-0-0-1-1.shtml
- 1####.131.10.81/zuowen/image/zuowen.png?t=####
- 1####.131.10.81/zuowen/index.php?track_id=####
- 1####.131.10.81/zuowen/service/get_my_profile.php
- 1####.131.10.81/zuowen/uc/image/21.png?t=####
- 1####.131.10.81/zuowen/uc/image/22.png?t=####
- 1####.131.10.81/zuowen/uc/image/23.png?t=####
- 1####.131.10.81/zuowen/uc/image/41.png?t=####
- 1####.131.10.81/zuowen/uc/image/high.png?t=####
- 1####.131.10.81/zuowen/uc/image/hot.png?t=####
- 1####.131.10.81/zuowen/uc/image/middle.png?t=####
- 1####.131.10.81/zuowen/uc/image/primary.png?t=####
- 1####.131.10.81/zuowen/uc/image/wave.png?t=####
- 1####.131.10.81/zuowen/uc/image/xiyou2.png
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?8296a32####
- r.leleke####.com.####.com/dat/zuowen/category/m/1.png
- r.leleke####.com.####.com/dat/zuowen/category/m/10.png
- r.leleke####.com.####.com/dat/zuowen/category/m/11.png
- r.leleke####.com.####.com/dat/zuowen/category/m/12.png
- r.leleke####.com.####.com/dat/zuowen/category/m/13.png
- r.leleke####.com.####.com/dat/zuowen/category/m/14.png
- r.leleke####.com.####.com/dat/zuowen/category/m/15.png
- r.leleke####.com.####.com/dat/zuowen/category/m/16.png
- r.leleke####.com.####.com/dat/zuowen/category/m/2.png
- r.leleke####.com.####.com/dat/zuowen/category/m/3.png
- r.leleke####.com.####.com/dat/zuowen/category/m/4.png
- r.leleke####.com.####.com/dat/zuowen/category/m/5.png
- r.leleke####.com.####.com/dat/zuowen/category/m/6.png
- r.leleke####.com.####.com/dat/zuowen/category/m/7.png
- r.leleke####.com.####.com/dat/zuowen/category/m/8.png
- r.leleke####.com.####.com/dat/zuowen/category/m/9.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/chongyangjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/chunjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/chuxi.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/duanwujie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/ertongjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/funvjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/fuqinjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/guoqingjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/jianjunjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/jiaoshijie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/laba.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/laodongjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/muqinjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/qingmingjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/qingnianjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/qixi.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/shengdanjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/wanshengjie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/yuandan.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/yuanxiaojie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/zhishujie.png
- r.leleke####.com.####.com/dat/zuowen/festival/m/zhongqiujie.png
- thi####.q####.cn/qqapp/101036803/049ECFCEEBA749911527982D5232D208/100
- thi####.q####.cn/qqapp/101036803/0AC976E2AF57D679935E0F10DDF77C84/100
- thi####.q####.cn/qqapp/101036803/0FBF933BB69F473EC49B98D2CE1996A3/100
- thi####.q####.cn/qqapp/101036803/1C2862136C6D8B2A146F2BB7A4F0BC4D/100
- thi####.q####.cn/qqapp/101036803/23BBE23871EB1C50A631A7A7F62A3E7D/100
- thi####.q####.cn/qqapp/101036803/3EC9160EF532F442479A05B96BD622F3/100
- thi####.q####.cn/qqapp/101036803/5AEF53483F42EA55AE4FDCCDFE06DA7B/100
- thi####.q####.cn/qqapp/101036803/6132A778DCAB48A8DA9305CF9C29C36E/100
- thi####.q####.cn/qqapp/101036803/62F40A2C234814779D38919227928AD5/100
- thi####.q####.cn/qqapp/101036803/7E5792D1AFFCB5D52DB5DAA98400F902/100
- thi####.q####.cn/qqapp/101036803/83E0BE912FBEA2D1D6212DD5DA206129/100
- thi####.q####.cn/qqapp/101036803/884F43F77B03007FD2FE90C12A010909/100
- thi####.q####.cn/qqapp/101036803/8BE9DA9230F294084F6FF01053231C64/100
- thi####.q####.cn/qqapp/101036803/918C106BFF232E7C612E84E6B0D93027/100
- thi####.q####.cn/qqapp/101036803/AB5B370F70BD91618B442D464C1C9EBF/100
- thi####.q####.cn/qqapp/101036803/D350734F9E5FF2D4DEDC1FC67B66A8B1/100
- thi####.q####.cn/qqapp/101036803/EEFCC6A1409330860690669DEE8444D3/100
- www.leleke####.com/comments/c.php?app=####&id=####&mode=####
- www.leleke####.com/comments/em/fuyun_thumb.gif
- www.leleke####.com/comments/em/geili_thumb.gif
- www.leleke####.com/comments/em/good_thumb.gif
- www.leleke####.com/comments/em/hearta_thumb.gif
- www.leleke####.com/comments/em/horse2_thumb.gif
- www.leleke####.com/comments/em/hufen_thumb.gif
- www.leleke####.com/comments/em/kl_thumb.gif
- www.leleke####.com/comments/em/m_thumb.gif
- www.leleke####.com/comments/em/qq_thumb.gif
- www.leleke####.com/comments/em/shenshou_thumb.gif
- www.leleke####.com/comments/em/sweata_thumb.gif
- www.leleke####.com/comments/em/wg_thumb.gif
- www.leleke####.com/comments/em/z2_thumb.gif
- www.leleke####.com/comments/image/avatar.png
- www.leleke####.com/comments/image/lele.png
- www.leleke####.com/comments/image/login_qq_m.png
- www.leleke####.com/comments/image/login_weibo_m.png
- www.leleke####.com/comments/image/m.png
- www.leleke####.com/comments/image/m_c.png
- www.leleke####.com/comments/image/qzone.png
- www.leleke####.com/comments/image/weixin.png
- www.leleke####.com/comments/js/m.min.js
- wx.q####.cn/mmopen/vi_32/Q0j4TwGTfTKicfcWKibttNSXrCJIvpZYq9ibA3RxnExYibE...
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.jg.ic
- /data/data/####/.log.lock
- /data/data/####/.log.ls
- /data/data/####/cache.db
- /data/data/####/cache.db-journal
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/f_000015
- /data/data/####/f_000016
- /data/data/####/f_000017
- /data/data/####/f_000018
- /data/data/####/f_000019
- /data/data/####/f_00001a
- /data/data/####/f_00001b
- /data/data/####/f_00001c
- /data/data/####/f_00001d
- /data/data/####/f_00001e
- /data/data/####/f_00001f
- /data/data/####/f_000020
- /data/data/####/index
- /data/data/####/jg_app_update_settings_random.xml
- /data/data/####/libjiagu.so
- /data/data/####/mFile_history.xml
- /data/data/####/umeng_feedback_conversations.xml
- /data/data/####/umeng_feedback_user_info.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Загружает динамические библиотеки:
- libjiagu
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS5Padding
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Отрисовывает собственные окна поверх других приложений.
