Техническая информация
Вредоносные функции:
Загружает из Интернета следующие детектируемые угрозы:
- Adware.ModAd.5
Сетевая активность:
Подключается к:
- UDP(???) pla####.google####.com:443
- UDP(???) and####.google####.com:443
- UDP(???) devicei####.google####.com:443
- UDP(???) rr5---s####.g####.com:443
- UDP(???) and####.a####.go####.com:443
- UDP(???) rr8---s####.g####.com:443
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) apps####.fey####.top:80
- TCP(HTTP/1.1) hez####.goto####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) ftp####.goto####.com:80
- TCP(HTTP/1.1) bbb-x-p####.img.add####.cn:80
- TCP(TLS/1.0) connect####.gst####.com:443
- TCP(TLS/1.0) devicei####.google####.com:443
- TCP(TLS/1.0) rr8---s####.g####.com:443
- TCP(TLS/1.0) lz.q####.top:443
- TCP(TLS/1.0) pla####.google####.com:443
- TCP(TLS/1.0) rr6---s####.g####.com:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) c####.lan####.com:443
- TCP(TLS/1.2) 1####.250.150.106:443
- TCP(TLS/1.2) devicei####.google####.com:443
- TCP(TLS/1.2) and####.google####.com:443
- TCP(TLS/1.2) 1####.177.14.138:443
Запросы DNS:
- a####.u####.com
- and####.a####.go####.com
- and####.google####.com
- android####.go####.com
- apps####.fey####.top
- bbb-x-p####.img.add####.cn
- c####.lan####.com
- connect####.gst####.com
- devicei####.google####.com
- firebas####.google####.com
- ftp####.goto####.com
- hez####.goto####.com
- lz.q####.top
- p####.google####.com
- pla####.google####.com
- rr5---s####.g####.com
- rr6---s####.g####.com
- rr8---s####.g####.com
- www.google####.com
Запросы HTTP GET:
- apps####.fey####.top/flsc/config.php
- apps####.fey####.top/flsc/feylen.php?ge####
- apps####.fey####.top/flsc/feylen.php?id=####
- apps####.fey####.top/flsc/feylen.php?tag=####
- bbb-x-p####.img.add####.cn/bbbssl/db/2025/kaixinyingshiTV.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/2025/kuluomiyingshi.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/2025/wangfeimao.png
- bbb-x-p####.img.add####.cn/bbbssl/db/2025/yiqikanTV.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/2025/yueguangbaoheBox.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/2026/GITV.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/2026/chengziTV.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/2026/dsywTV.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/2026/fmys.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/2026/jumiTV.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/2026/liunianyingshi.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/2026/shandianyingshi.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/2026/shanheTV.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/2026/yunhuTV.jpg
- bbb-x-p####.img.add####.cn/bbbssl/db/img/yingshicang.png
- bbb-x-p####.img.add####.cn/bbbssl/zb/2024/HDTV.png
- bbb-x-p####.img.add####.cn/bbbssl/zb/2025/qx.jpg
- bbb-x-p####.img.add####.cn/bbbssl/zb/2025/xindianshijia.jpg
- bbb-x-p####.img.add####.cn/bbbssl/zb/2026/changxiangTV.jpg
- bbb-x-p####.img.add####.cn/bbbssl/zb/2026/jdiptv.jpg
- bbb-x-p####.img.add####.cn/bbbssl/zb/2026/jiandandianshi.jpg
- bbb-x-p####.img.add####.cn/bbbssl/zb/2026/jst.jpg
- bbb-x-p####.img.add####.cn/bbbssl/zb/2026/xiangcunDS.jpg
- bbb-x-p####.img.add####.cn/bbbssl/zb/2026/yuanbao.jpg
- c####.lan####.com:443/2b664f51e91c5218f036580f2f4731c1/6a0d0189/2025/09/...
- c####.lan####.com:443/84a0334b64b1df8642bcd14ce590b8db/6a0d0193/2025/11/...
- ftp####.goto####.com/download/down_lzy_new.php?url=####&type=####&pwd=####
- ftp####.goto####.com/lanzou/lanzou-api-new2024/?url=####&type=####&pwd=#...
- hez####.goto####.com/bbbssl/db/2025/kaixinyingshiTV.jpg
- hez####.goto####.com/bbbssl/db/2025/kuluomiyingshi.jpg
- hez####.goto####.com/bbbssl/db/2025/wangfeimao.png
- hez####.goto####.com/bbbssl/db/2025/yiqikanTV.jpg
- hez####.goto####.com/bbbssl/db/2025/yueguangbaoheBox.jpg
- hez####.goto####.com/bbbssl/db/2026/GITV.jpg
- hez####.goto####.com/bbbssl/db/2026/chengziTV.jpg
- hez####.goto####.com/bbbssl/db/2026/dsywTV.jpg
- hez####.goto####.com/bbbssl/db/2026/fmys.jpg
- hez####.goto####.com/bbbssl/db/2026/jumiTV.jpg
- hez####.goto####.com/bbbssl/db/2026/liunianyingshi.jpg
- hez####.goto####.com/bbbssl/db/2026/shandianyingshi.jpg
- hez####.goto####.com/bbbssl/db/2026/shanheTV.jpg
- hez####.goto####.com/bbbssl/db/2026/yunhuTV.jpg
- hez####.goto####.com/bbbssl/db/img/yingshicang.png
- hez####.goto####.com/bbbssl/zb/2024/HDTV.png
- hez####.goto####.com/bbbssl/zb/2025/qx.jpg
- hez####.goto####.com/bbbssl/zb/2025/xindianshijia.jpg
- hez####.goto####.com/bbbssl/zb/2026/changxiangTV.jpg
- hez####.goto####.com/bbbssl/zb/2026/jdiptv.jpg
- hez####.goto####.com/bbbssl/zb/2026/jiandandianshi.jpg
- hez####.goto####.com/bbbssl/zb/2026/jst.jpg
- hez####.goto####.com/bbbssl/zb/2026/xiangcunDS.jpg
- hez####.goto####.com/bbbssl/zb/2026/yuanbao.jpg
- lz.q####.top:443/parser?url=####&type=####&pwd=####
Запросы HTTP POST:
- a####.u####.com/app_logs
Изменения в файловой системе:
Создает следующие файлы:
- /data/app/####/.x86_64
- /data/app/####/com.android.vending.apk
- /data/app/####/config.en
- /data/app/####/config.x86_64
- /data/app/####/libandroidx.graphics.path.so
- /data/app/####/libapkanalysis.so
- /data/app/####/libbrotli.so
- /data/app/####/libcronet.148.0.7778.120.so
- /data/app/####/libmappedcountercacheversionjni.so
- /data/app/####/libtensorflowlite_jni.so
- /data/app/####/libzucchini.so
- /data/app/####/libzwrapper.so
- /data/data/####/.imprint
- /data/data/####/.jg.ac
- /data/data/####/.jg.store.report_cf
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.oat
- /data/data/####/jgobfppppp (deleted)
- /data/data/####/libjiagu.so
- /data/data/####/libjiagu_64.so
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/xUtils.db-journal
- /data/media/####/.nomedia
- /data/media/####/12wkiebm8oc1waiw305sgkbeh
- /data/media/####/1ex17n7tvunrjttrereukv7hg
- /data/media/####/20260520_030410.apk
- /data/media/####/20260520_030428.apk
- /data/media/####/25dk0x43vzwtyzc2by1plv0bo
- /data/media/####/26pr19sufb1d013j18j6xkqy3
- /data/media/####/2b5k7gaa4x3jv0pmv2q8b3bzi
- /data/media/####/2dyvu944kc52yi99qsf1fsvyk
- /data/media/####/2feookwxbyqopp389witg6unz
- /data/media/####/2gbn048kp6htdbainsiktw4wb
- /data/media/####/2q2uql8gj7b6c9nzetz6swlfn
- /data/media/####/2yxftce12zuqas22akii4q5b6
- /data/media/####/3bvjum2758apibx7z6sfxpurp
- /data/media/####/3ekmktcw2ji1651oppvbbwra1
- /data/media/####/3fom3wjh0si0fw7o32f4v9h7s
- /data/media/####/3uctu042l0e1sjvkdp4qyb6bz
- /data/media/####/455tuj9566szxto26f00qhykt
- /data/media/####/48y6zhv03cr0gk4a3ee78u7v5
- /data/media/####/4bytg9j2p8wogaxwpi09o2a9c
- /data/media/####/5gb9w5h13tcfddddb10fynodf
- /data/media/####/64ofgla1in9kz2slj1lf7qgx5
- /data/media/####/79xr9cl8t6vxd2lmcnzpaecnu
- /data/media/####/7kevka7kk07uy9t1saeqa8kke
- /data/media/####/7lvx4e6v1ocym4xtqbpknukp
- /data/media/####/9ixoyuiunb9oy8xgnva046ha
- /data/media/####/gilkwogwzdbqkjwb7ihb3aaz
- /data/misc/####/primary.prof
Другие:
Загружает динамические библиотеки:
- libjiagu_64
Использует следующие алгоритмы для расшифровки данных:
- AES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Отрисовывает собственные окна поверх других приложений.
Запрашивает разрешение на отображение системных уведомлений.
