Техническая информация
Вредоносные функции:
Загружает на исполнение код следующих детектируемых угроз:
- Android.DownLoader.589.origin
Осуществляет доступ к приватному интерфейсу телефонии (ITelephony).
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) 52.52.2####.56:80
- TCP(HTTP/1.1) statson####.pu####.b####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) cha####.api.d####.com:80
- TCP(HTTP/1.1) cdnappl####.b0.a####.com:80
- TCP(HTTP/1.1) cdnimgl####.b0.a####.com:80
- TCP(HTTP/1.1) chuangc####.down####.ks####.com:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) pwe.3####.top:80
- TCP(HTTP/1.1) cdnyxzf####.b0.a####.com:80
- TCP(HTTP/1.1) h####.b####.com:80
- TCP(HTTP/1.1) cdn.game####.org:80
- TCP agentch####.api.d####.com:5287
Запросы DNS:
- a####.u####.com
- agentch####.api.d####.com
- cdn.app.kac####.cn
- cdn.app.qqy####.cn
- cdn.game####.org
- cdn.img.qqy####.cn
- cha####.api.d####.com
- h####.b####.com
- pwe.3####.top
- statson####.pu####.b####.com
- v2.api.d####.com
Запросы HTTP GET:
- cdn.game####.org/strategy/UnknownDev
- cdn.game####.org/strategy/base
- cdn.game####.org/strategy/dev_root
- cdn.game####.org/strategy/dev_root2
- cdn.game####.org/strategy/larger4.3
- cdn.game####.org/strategy/loss_4.3
- cdn.game####.org/strategy/sul18
- cdn.game####.org/strategy/symlink-adbd
Запросы HTTP POST:
- cha####.api.d####.com/rest/2.0/channel/4136480188581416213
- cha####.api.d####.com/rest/2.0/channel/channel
- h####.b####.com/app.gif
- pwe.3####.top/hadat/nhap/o
- pwe.3####.top/hadat/sj/vafl
- pwe.3####.top/hadat/wpjyn/x
- pwe.3####.top/jzbdt/gk/iczr
- pwe.3####.top/jzbdt/huasy/xdgm
- pwe.3####.top/jzbdt/kjmc/xlwhf/c
- pwe.3####.top/sdf/rwqiz
- statson####.pu####.b####.com/pushlog
Изменения в файловой системе:
Создает следующие файлы:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_118fda64-d414-4839-ac69-08c9c69d0e56/Matrix
- <Package Folder>/app_118fda64-d414-4839-ac69-08c9c69d0e56/ddexe
- <Package Folder>/app_118fda64-d414-4839-ac69-08c9c69d0e56/debuggerd
- <Package Folder>/app_118fda64-d414-4839-ac69-08c9c69d0e56/fileWork
- <Package Folder>/app_118fda64-d414-4839-ac69-08c9c69d0e56/insta...ery.sh
- <Package Folder>/app_118fda64-d414-4839-ac69-08c9c69d0e56/pidof
- <Package Folder>/app_118fda64-d414-4839-ac69-08c9c69d0e56/su
- <Package Folder>/app_118fda64-d414-4839-ac69-08c9c69d0e56/supolicy
- <Package Folder>/app_118fda64-d414-4839-ac69-08c9c69d0e56/toolbox
- <Package Folder>/app_118fda64-d414-4839-ac69-08c9c69d0e56/wsroot.sh
- <Package Folder>/app_15db4b49-968d-434b-b54c-2ec1bbdf33bc/checker.jar
- <Package Folder>/app_260a2f61-b871-4ae2-bdeb-a78090984398/Matrix
- <Package Folder>/app_260a2f61-b871-4ae2-bdeb-a78090984398/ddexe
- <Package Folder>/app_260a2f61-b871-4ae2-bdeb-a78090984398/debuggerd
- <Package Folder>/app_260a2f61-b871-4ae2-bdeb-a78090984398/fileWork
- <Package Folder>/app_260a2f61-b871-4ae2-bdeb-a78090984398/insta...ery.sh
- <Package Folder>/app_260a2f61-b871-4ae2-bdeb-a78090984398/pidof
- <Package Folder>/app_260a2f61-b871-4ae2-bdeb-a78090984398/su
- <Package Folder>/app_260a2f61-b871-4ae2-bdeb-a78090984398/supolicy
- <Package Folder>/app_260a2f61-b871-4ae2-bdeb-a78090984398/toolbox
- <Package Folder>/app_260a2f61-b871-4ae2-bdeb-a78090984398/wsroot.sh
- <Package Folder>/app_2f4f7bb3-888c-48fc-81fd-3128dce18502/Matrix
- <Package Folder>/app_2f4f7bb3-888c-48fc-81fd-3128dce18502/ddexe
- <Package Folder>/app_2f4f7bb3-888c-48fc-81fd-3128dce18502/debuggerd
- <Package Folder>/app_2f4f7bb3-888c-48fc-81fd-3128dce18502/fileWork
- <Package Folder>/app_2f4f7bb3-888c-48fc-81fd-3128dce18502/insta...ery.sh
- <Package Folder>/app_2f4f7bb3-888c-48fc-81fd-3128dce18502/pidof
- <Package Folder>/app_2f4f7bb3-888c-48fc-81fd-3128dce18502/su
- <Package Folder>/app_2f4f7bb3-888c-48fc-81fd-3128dce18502/supolicy
- <Package Folder>/app_2f4f7bb3-888c-48fc-81fd-3128dce18502/toolbox
- <Package Folder>/app_2f4f7bb3-888c-48fc-81fd-3128dce18502/wsroot.sh
- <Package Folder>/app_8b1cf027-7098-4a24-a26b-5f7273e95166/Matrix
- <Package Folder>/app_8b1cf027-7098-4a24-a26b-5f7273e95166/ddexe
- <Package Folder>/app_8b1cf027-7098-4a24-a26b-5f7273e95166/debuggerd
- <Package Folder>/app_8b1cf027-7098-4a24-a26b-5f7273e95166/fileWork
- <Package Folder>/app_8b1cf027-7098-4a24-a26b-5f7273e95166/insta...ery.sh
- <Package Folder>/app_8b1cf027-7098-4a24-a26b-5f7273e95166/pidof
- <Package Folder>/app_8b1cf027-7098-4a24-a26b-5f7273e95166/su
- <Package Folder>/app_8b1cf027-7098-4a24-a26b-5f7273e95166/supolicy
- <Package Folder>/app_8b1cf027-7098-4a24-a26b-5f7273e95166/toolbox
- <Package Folder>/app_8b1cf027-7098-4a24-a26b-5f7273e95166/wsroot.sh
- <Package Folder>/app_d4ced694-8aee-45de-aa8a-78a5ad38b932/Matrix
- <Package Folder>/app_d4ced694-8aee-45de-aa8a-78a5ad38b932/ddexe
- <Package Folder>/app_d4ced694-8aee-45de-aa8a-78a5ad38b932/debuggerd
- <Package Folder>/app_d4ced694-8aee-45de-aa8a-78a5ad38b932/fileWork
- <Package Folder>/app_d4ced694-8aee-45de-aa8a-78a5ad38b932/insta...ery.sh
- <Package Folder>/app_d4ced694-8aee-45de-aa8a-78a5ad38b932/pidof
- <Package Folder>/app_d4ced694-8aee-45de-aa8a-78a5ad38b932/su
- <Package Folder>/app_d4ced694-8aee-45de-aa8a-78a5ad38b932/supolicy
- <Package Folder>/app_d4ced694-8aee-45de-aa8a-78a5ad38b932/toolbox
- <Package Folder>/app_d4ced694-8aee-45de-aa8a-78a5ad38b932/wsroot.sh
- <Package Folder>/app_d9483d84-23c7-407e-b3ff-3e9a94365a2c/Matrix
- <Package Folder>/app_d9483d84-23c7-407e-b3ff-3e9a94365a2c/ddexe
- <Package Folder>/app_d9483d84-23c7-407e-b3ff-3e9a94365a2c/debuggerd
- <Package Folder>/app_d9483d84-23c7-407e-b3ff-3e9a94365a2c/device.db
- <Package Folder>/app_d9483d84-23c7-407e-b3ff-3e9a94365a2c/fileWork
- <Package Folder>/app_d9483d84-23c7-407e-b3ff-3e9a94365a2c/insta...ery.sh
- <Package Folder>/app_d9483d84-23c7-407e-b3ff-3e9a94365a2c/pidof
- <Package Folder>/app_d9483d84-23c7-407e-b3ff-3e9a94365a2c/root3
- <Package Folder>/app_d9483d84-23c7-407e-b3ff-3e9a94365a2c/su
- <Package Folder>/app_d9483d84-23c7-407e-b3ff-3e9a94365a2c/supolicy
- <Package Folder>/app_d9483d84-23c7-407e-b3ff-3e9a94365a2c/toolbox
- <Package Folder>/app_d9483d84-23c7-407e-b3ff-3e9a94365a2c/wsroot.sh
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/app_plugin_download/25a91a20-9cdf-4fb2-82d7-7f6f3e014cec
- <Package Folder>/app_plugin_download/7f83c0ea-926b-4ff3-99fe-6bc278ce1080
- <Package Folder>/app_push_lib/plugin-deploy.jar
- <Package Folder>/app_push_lib/plugin-deploy.key
- <Package Folder>/app_subox/1740c449fc10be62df60ba0f18696c9f
- <Package Folder>/app_subox/32edd79a240b5f1e461d069caab1ec3e
- <Package Folder>/app_subox/8b6f263391259b7a8e5f58ee71852ca8
- <Package Folder>/app_subox/b0141e478b25af7c40a8cca8de6c4708
- <Package Folder>/app_subox/b18a021d11a3004d25017230b681476b
- <Package Folder>/app_subox/c61913b615fb6224701377a119081f36
- <Package Folder>/app_subox_download/1db2ea7a-2cdb-431c-b127-9f5509e8d93d
- <Package Folder>/app_subox_download/309c1f4a-8a6b-4aa4-8e8a-2b887d04bba6
- <Package Folder>/app_subox_download/5e3c0bd1-d609-4054-8d03-a41a69b860d6
- <Package Folder>/app_subox_download/678ccb87-a181-47b1-9c60-81e092b87ad2
- <Package Folder>/app_subox_download/c24f0992-6183-4a1e-bd47-e0d86d1ca400
- <Package Folder>/app_subox_download/d1047555-8d46-47e4-8830-f834cd27ceb3
- <Package Folder>/app_subox_download/d309837e-68c1-40fb-a67c-dda4f91674d5
- <Package Folder>/app_subox_download/f4256bc0-59d7-4223-ac49-d3a21c50cfb4
- <Package Folder>/databases/cartoon-journal
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/.imprint
- <Package Folder>/files/SUBOXLOG_
- <Package Folder>/files/__local_ap_info_cache.json
- <Package Folder>/files/__local_last_session.json
- <Package Folder>/files/__local_stat_cache.json
- <Package Folder>/files/cz.jar
- <Package Folder>/files/qp.jar
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/shared_prefs/<Package>.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- <Package Folder>/shared_prefs/__Baidu_Stat_SDK_SendRem.xml.bak
- <Package Folder>/shared_prefs/app_config.xml
- <Package Folder>/shared_prefs/app_config.xml.bak
- <Package Folder>/shared_prefs/dsi.xml
- <Package Folder>/shared_prefs/kr.xml
- <Package Folder>/shared_prefs/kr.xml.bak
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/shared_prefs/sfe.xml
- <Package Folder>/shared_prefs/sfe.xml.bak
- <Package Folder>/shared_prefs/subox.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/user_info.xml
- <Package Folder>/shared_prefs/user_info.xml.bak
- <Package Folder>/shared_prefs/wv.xml
- <Package Folder>/shared_prefs/wv.xml.bak
- <SD-Card>/.com.baidu.frontia/frontia.db
- <SD-Card>/.com.baidu.frontia/frontia.db-journal
- <SD-Card>/Android/####/85d5aafce64db4e51c625b70b16c2f86.apk
- <SD-Card>/Android/####/V2.7.8.txt
- <SD-Card>/Android/####/b.tmp
- <SD-Card>/Android/####/cd250330e9ab8
- <SD-Card>/baidu/####/apps
- <SD-Card>/baidu/####/pushstat_3.1.db
- <SD-Card>/baidu/####/pushstat_3.1.db-journal
- <SD-Card>/baidu/.cuid
- <SD-Card>/dmzj/####/.nomedia
Другие:
Запускает следующие shell-скрипты:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/85d5aafce64db4e51c625b70b16c2f86.apk
- chmod 777 Matrix ddexe debuggerd device.db fileWork install-recovery.sh pidof root3 su supolicy toolbox wsroot.sh
- chmod 777 Matrix ddexe debuggerd fileWork install-recovery.sh pidof su supolicy toolbox wsroot.sh
- sh
Загружает динамические библиотеки:
- _irqi821
- bdpush_V1_0
- libjiagu
- push-socket
Использует следующие алгоритмы для шифрования данных:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES
- DES
- RSA-ECB-PKCS1Padding
Использует специальную библиотеку для скрытия исполняемого байткода.
Осуществляет доступ к информации о геолокации.
Осуществляет доступ к информации о сети.
Осуществляет доступ к информации о телефоне (номер, imei и тд.).
Осуществляет доступ к информации об установленных приложениях.
Осуществляет доступ к информации о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
