Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.Gexin.1
Сетевая активность:
Подключается к:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) app.luobosh####.com:80
- TCP(HTTP/1.1) d####.c####.l####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) thi####.q####.cn:80
- TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
- TCP(HTTP/1.1) rsv.eas####.com:80
- TCP(HTTP/1.1) a####.eas####.com:80
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) v####.a####.com:443
- TCP(TLS/1.0) i####.doub####.com.####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) thi####.q####.cn:443
- TCP(TLS/1.0) i####.doub####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.0) fcd2####.cdn.uc####.####.cn:443
- TCP(TLS/1.0) 1####.250.179.202:443
- TCP(TLS/1.0) www.google####.com:443
- TCP(TLS/1.2) 1####.250.179.195:443
- TCP(TLS/1.2) instant####.google####.com:443
- TCP(TLS/1.2) 1####.250.179.174:443
- TCP(TLS/1.2) 1####.250.179.202:443
- TCP cm-1####.g####.com:5226
- TCP sdk.o####.t####.####.com:5224
Запросы DNS:
- 7j####.c####.z0.####.com
- a####.eas####.com
- android####.go####.com
- app.luobosh####.com
- c-h####.g####.com
- cdn-sdk####.g####.com
- cm-1####.g####.com
- i####.doub####.com
- i####.doub####.com
- i####.doub####.com
- i####.doub####.com
- i####.luobosh####.com
- instant####.google####.com
- md####.google####.com
- p####.google####.com
- rs.eas####.com
- sdk-ope####.g####.com
- sdk.c####.g####.com
- sdk.o####.i####.####.8
- sdk.o####.i####.####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- thi####.q####.cn
- thi####.q####.cn
- www.google####.com
- wx.q####.cn
Запросы HTTP GET:
- cdn-sdk####.g####.com.####.com/tdata_EDB102
- cdn-sdk####.g####.com.####.com/tdata_EvJ733
- cdn-sdk####.g####.com.####.com/tdata_XwJ757
- d####.c####.l####.####.com/599d7a00e4b03f37f0c916c6/160805717277530.jpg
- d####.c####.l####.####.com/5f32d6aee4b068536d9d2685/159880294451265.jpg
- d####.c####.l####.####.com/5f7aa043e4b080dec0a0d035/160187244194036.jpg
- d####.c####.l####.####.com/6016a299e4b0a0569f5eb111/161426374528620.jpg
- d####.c####.l####.####.com/config/hzv9.conf
- d####.c####.l####.####.com/excerptBG/CPUrl/1017/hdpi
- d####.c####.l####.####.com/excerptBG/CPUrl/1081/hdpi
- d####.c####.l####.####.com/excerptBG/NSPUrl/1017/hdpi
- d####.c####.l####.####.com/excerptBG/NSPUrl/1081/hdpi
- d####.c####.l####.####.com/excerptBG/PSDUrl/1017/hdpi
- d####.c####.l####.####.com/excerptBG/PSDUrl/1081/hdpi
- d####.c####.l####.####.com/excerptBG/PSUUrl/1017/hdpi
- d####.c####.l####.####.com/excerptBG/PSUUrl/1081/hdpi
- d####.c####.l####.####.com/excerptBG/firstTitleBG/1017/hdpi
- d####.c####.l####.####.com/excerptBG/perceptionBG/1017/hdpi
- d####.c####.l####.####.com/excerptBG/perceptionBG/1081/hdpi
- d####.c####.l####.####.com/excerptBG/secondTitleBG/1017/hdpi
- d####.c####.l####.####.com/excerptBG/tiledBG/1017/hdpi
- d####.c####.l####.####.com/excerptBG/tiledBG/1081/hdpi
- d####.c####.l####.####.com/excerptBG/upperBG/1081/hdpi
- rsv.eas####.com/easemob/server.json?sdk_version=####&app_key=####&file_v...
- sdk.o####.p####.####.com/api/addr.htm
- thi####.q####.cn/g?b=####&k=####&s=####&t=####
- thi####.q####.cn/mmopen/a9soDuZsxlHrsiaj1GXZ9joFrgq6J4aSADKBfb5TJCkypWMY...
- thi####.q####.cn/mmopen/vi_32/63CbeSL3Jlxw60o9DpWZHFj6c3w435YZWYC4J47vD1...
- ti####.c####.l####.####.com/tdata_eoG063
Запросы HTTP POST:
- a####.eas####.com/bloomlife/luobo/devices
- app.luobosh####.com/luoboserver/excerpt/bgBlockList
- app.luobosh####.com/luoboserver/excerpt/layout
- app.luobosh####.com/luoboserver/excerpt/list
- app.luobosh####.com/luoboserver/excerpt/select
- app.luobosh####.com/luoboserver/excerpt/unlockBG
- app.luobosh####.com/luoboserver/parameter/list
- app.luobosh####.com/luoboserver/recommend/bookSet
- app.luobosh####.com/luoboserver/user/activate
- c-h####.g####.com/api.php?format=####&t=####
- sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-1320281931-1811689454
- /data/data/####/-1320281931-2015390144
- /data/data/####/-1320281931-98659828
- /data/data/####/-1775581806-1633248941
- /data/data/####/-873873736-2127069849
- /data/data/####/-873873736120169756
- /data/data/####/.jg.ic
- /data/data/####/12d5kigxq0i73nc7gbrao98hn.tmp
- /data/data/####/179nryhs7orq73362x07m4gsn.tmp
- /data/data/####/17jm6g5h29prm5nz371ocgzha.tmp
- /data/data/####/1b2u7ur24x5kkrqitdu7d2wcg.tmp
- /data/data/####/1ftqyhw8l2vhtpmcuifwag1iq.tmp
- /data/data/####/1kxbov9rw3o61sb4ymipnxnel.tmp
- /data/data/####/1uz4x2ou87wld1s4htj9tp69a.tmp
- /data/data/####/1vh0e21u3x294fo1xrz3y2klq.tmp
- /data/data/####/2020933146-1045148563
- /data/data/####/2020933146-1190371216
- /data/data/####/2101wxhzf9mdn4zm664n1ibm9.tmp
- /data/data/####/22jd0uh0vny72jldqq1093gl5.tmp
- /data/data/####/27y7zmraqcojsd82ljxqicvax.tmp
- /data/data/####/2aqmhpo522pshddghbj765ny1.tmp
- /data/data/####/2pzx5iqbx4dw1sbfsvmw0lo0o.tmp
- /data/data/####/2ujf5kna6kl7aqc2utvctkg5u.tmp
- /data/data/####/30te9281qcvqms8oyn4k3qmth
- /data/data/####/34lu5ijljjdop4hjlanuui1po.tmp
- /data/data/####/34m63krgl9xshhjmuef092bk5.tmp
- /data/data/####/36mu5w7knvtnzj7jh2b2c8zyj.tmp
- /data/data/####/385qd411vqp1gew3jhhtw9e2r.tmp
- /data/data/####/3dr7sezpvplxohj4tyeke5o1m.tmp
- /data/data/####/3xmzobgrl3k11skwdwpx86j81.tmp
- /data/data/####/40f7g4yv3flf47a7dxi0ncikp.tmp
- /data/data/####/4g4t9kg9msgooyq15v1egh5yz.tmp
- /data/data/####/4pbxs56bth4plvbue33bzfsan.tmp
- /data/data/####/4si5plipwtg1ainoofy6yyli8.tmp
- /data/data/####/59raxa2i40m9b70sxzq525pj2.tmp
- /data/data/####/5qqhywc5i5hiq4gmjz62rlujb.tmp
- /data/data/####/5rdw17t35eswbcco05na0i78n
- /data/data/####/68wptvfsgnl1sn2juxjqy5wx1.tmp
- /data/data/####/6fdpc6r6zlb521558h7ea4e6r.tmp
- /data/data/####/6fx78zd0whsa8n77jwkbnim2p.tmp
- /data/data/####/6rbl33hnrtg6jzr7erjqttzd0.tmp
- /data/data/####/773tpkb0bl6ysqp3wuz95xpqq.tmp
- /data/data/####/78af617c8170
- /data/data/####/79012d3k757gzkirkqqlen5z0.tmp
- /data/data/####/79u6sood6ww5bw601uq974eoj
- /data/data/####/APP_GAOSHOU_KEY.xml
- /data/data/####/BLOOMLIFE.xml
- /data/data/####/classes.dex
- /data/data/####/classes.oat
- /data/data/####/classes2.dex
- /data/data/####/classes3.dex
- /data/data/####/com.bloomlife.luobo_preferences.xml
- /data/data/####/config.json
- /data/data/####/device_id.xml.xml
- /data/data/####/gkt-journal
- /data/data/####/increment.db-journal
- /data/data/####/init.pid
- /data/data/####/kn7gmziwpu07gtk818agj0aa
- /data/data/####/libjiagu.so
- /data/data/####/luobo-journal
- /data/data/####/proc_auxv
- /data/data/####/push.pid
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/server.json
- /data/data/####/smc56wxyj9a7ecfk6makzuhl.tmp
- /data/data/####/tdata_EvJ733.dex
- /data/data/####/tdata_EvJ733.dex.flock (deleted)
- /data/data/####/tdata_EvJ733.jar
- /data/data/####/tdata_EvJ733.tmp
- /data/data/####/tdata_XwJ757
- /data/data/####/tdata_XwJ757.dex
- /data/data/####/tdata_XwJ757.dex.flock (deleted)
- /data/data/####/tdata_XwJ757.jar
- /data/data/####/umeng_general_config.xml
- /data/misc/####/primary.prof
Другие:
Запускает следующие shell-скрипты:
- /system/bin/cat /proc/cpuinfo
- /system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes2.dex --dex-file=<Package Folder>/.jiagu/classes3.dex --oat-file=<Package Folder>/.jiagu/classes.oat
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_EvJ733.jar --oat-fd=54 --oat-location=/data/user/0/<Package>/files/tdata_EvJ733.dex --compiler-filter=speed
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_XwJ757.jar --oat-fd=54 --oat-location=/data/user/0/<Package>/files/tdata_XwJ757.dex --compiler-filter=speed
- cat /proc/uid_stat/10065/tcp_rcv
- cat /proc/uid_stat/10065/tcp_snd
- cat /sys/class/net/wlan0/address
- chmod 755 /data/user/0/<Package>/files/libjiagu.so
- mount
- sh
Использует следующие алгоритмы для шифрования данных:
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию о настроках APN.
Получает информацию об установленных приложениях.
Отрисовывает собственные окна поверх других приложений.
