Adware.Waps.1006

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Waps.5.origin

Network activity:

Connects to:

TCP(/uploads/allimg/1) www.zbj####.com:80
UDP(DNS) <Google DNS>
TCP(HTTP/1.1) oc.u####.com:80
TCP(HTTP/1.1) im####.w####.cn.####.com:80
TCP(HTTP/1.1) app.w####.cn:80
TCP(HTTP/1.1) www.zbj####.com:80
TCP(HTTP/1.1) p####.win####.com:80
TCP(HTTP/1.1) o####.b####.cn:80
TCP(TLS/1.0) api.vu####.com.####.net:443
TCP(TLS/1.0) www.zbj####.com:443

DNS requests:

ads.w####.cn
api.vu####.com
app.w####.cn
im####.w####.cn
o####.b####.cn
oc.u####.com
p####.win####.com
www.zbj####.com

HTTP GET requests:

app.w####.cn/action/account/getinfo?app_id=####&udid=####&imsi=####&net=...
app.w####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=#...
app.w####.cn/action/miniad/ad?app_id=####&udid=####&imsi=####&net=####&b...
app.w####.cn/action/pop_ad/ad?app_id=####&udid=####&imsi=####&net=####&b...
im####.w####.cn.####.com/appfile/adsfile/11bff27be6c574cfb5bc785f38f92df...
im####.w####.cn.####.com/appfile/stuff/065e0b6314905c2d15141eb4dc80ac69/...
im####.w####.cn.####.com/appfile/stuff/45f86318583b6457b9a42cfe8c91f6fe/...
im####.w####.cn.####.com/appfile/stuff/79ff82580dc59a8748724faa3b792542/...
im####.w####.cn.####.com/appfile/stuff/9670bc39e861607fb796e6afed6e4498/...
im####.w####.cn.####.com/appfile/stuff/9ba31bb7edd0cbe16b2bc6f39b7797e9/...
im####.w####.cn.####.com/appfile/stuff/9edaaccbe2248f70efe06e7ca266742b/...
im####.w####.cn.####.com/appfile/stuff/a5c07a14c10dc674037a9141d6f70ff3/...
im####.w####.cn.####.com/appfile/stuff/c3fd339716aca8f600e6ee34f8390492/...
im####.w####.cn.####.com/appfile/stuff/dd7e9672f70d47d8ad31f1ae05120798/...
p####.win####.com/mobile/b/555ad5109292a_200_300.jpg
p####.win####.com/mobile/f/58413b7984dd6.jpg
p####.win####.com/mobile/f/58413b7ae56ee.jpg
p####.win####.com/mobile/f/58413b7ae56ee_200_300.jpg
p####.win####.com/mobile/f/58413b7c58dbf.jpg
www.zbj####.com/
www.zbj####.com/uploads/allimg/1508/2_0P42324301924.jpg
www.zbj####.com/uploads/allimg/160102/202U53412-0-lp.jpg
www.zbj####.com/uploads/allimg/161013/2-1610131PJ80-L.jpg
www.zbj####.com/uploads/allimg/161020/2-1610201139100-L.jpg
www.zbj####.com/uploads/allimg/161020/2-161020113Z30-L.jpg
www.zbj####.com/uploads/allimg/161025/2-1610251H0210-L.jpg
www.zbj####.com/uploads/allimg/161025/2-1610251H4180-L.jpg
www.zbj####.com/uploads/allimg/161026/2-1610261456470-L.jpg
www.zbj####.com/uploads/allimg/161029/2-161029134Q50-L.jpg
www.zbj####.com/uploads/allimg/161031/1H2541515-0.jpg
www.zbj####.com/uploads/allimg/161031/2-1610311I0460-L.jpg
www.zbj####.com/uploads/allimg/161101/144A9C01-0.jpg
www.zbj####.com/uploads/allimg/161101/2-1611011455270-L.jpg
www.zbj####.com/uploads/allimg/161102/163A94241-0.jpg
www.zbj####.com/uploads/allimg/161102/163A94241-0.jpg|
www.zbj####.com/uploads/allimg/161104/1451395593-0.jpg
www.zbj####.com/uploads/allimg/161104/2-1611041H2450-L.jpg
www.zbj####.com/uploads/allimg/161107/1610454605-0.jpg

HTTP POST requests:

app.w####.cn/action/user_info
o####.b####.cn/8/find
o####.b####.cn/8/init
o####.b####.cn/8/secret
o####.b####.cn/8/update
oc.u####.com/v2/check_config_update
oc.u####.com/v2/get_update_time

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/1554435514801.RequestCommand.find.3.3316060e27b...509b98
/data/data/####/1554435514835.RequestCommand.find.3.081b33f0b19...653264
/data/data/####/1554435515223.RequestCommand.find.3.23bcc6358c5...434f0e
/data/data/####/1554435515383.RequestCommand.find.3.18ca4c7a926...95b67e
/data/data/####/1554435515878.RequestCommand.find.3.99858ca00fe...e95c0c
/data/data/####/1554435515906.RequestCommand.find.3.76456aa9f05...242469
/data/data/####/1554435515908.RequestCommand.find.3.c83fdf15603...3b6004
/data/data/####/1554435515919.RequestCommand.find.3.b141096d1f4...929c37
/data/data/####/1554435515949.RequestCommand.find.3.830c24aa529...b307be
/data/data/####/1554435516997.RequestCommand.find.3.62f4e1e6c8f...4660f7
/data/data/####/1554435517052.RequestCommand.find.3.006b511df33...121926
/data/data/####/1554435517455.RequestCommand.find.3.74c4d90784d...ebd96a
/data/data/####/160679992358.049
/data/data/####/160679992358.049 (deleted)
/data/data/####/160679992370.337
/data/data/####/160679992370.337 (deleted)
/data/data/####/160679992491.102
/data/data/####/160679992491.102 (deleted)
/data/data/####/160679992710.472
/data/data/####/160679992710.472 (deleted)
/data/data/####/160679992868.195
/data/data/####/160679992868.195 (deleted)
/data/data/####/160679993225.539
/data/data/####/160679993225.539 (deleted)
/data/data/####/160679993253.622
/data/data/####/160679993253.622 (deleted)
/data/data/####/160679993322.447
/data/data/####/160679993322.447 (deleted)
/data/data/####/160679993430.554
/data/data/####/160679993430.554 (deleted)
/data/data/####/160679993451.014
/data/data/####/160679993451.014 (deleted)
/data/data/####/160679993890.333
/data/data/####/160679993890.333 (deleted)
/data/data/####/160679994154.373
/data/data/####/160679994154.373 (deleted)
/data/data/####/160679994181.827
/data/data/####/160679994181.827 (deleted)
/data/data/####/160679994218.049
/data/data/####/160679994218.049 (deleted)
/data/data/####/160679994230.552
/data/data/####/160679994230.552 (deleted)
/data/data/####/160679994563.548
/data/data/####/160679994563.548 (deleted)
/data/data/####/160679994638.485
/data/data/####/160679994638.485 (deleted)
/data/data/####/160679994813.735
/data/data/####/160679994813.735 (deleted)
/data/data/####/160679995071.727
/data/data/####/160679995071.727 (deleted)
/data/data/####/160679995112.414
/data/data/####/160679995112.414 (deleted)
/data/data/####/160679995266.237
/data/data/####/160679995266.237 (deleted)
/data/data/####/160679995462.501
/data/data/####/160679995462.501 (deleted)
/data/data/####/261205422521.032
/data/data/####/261205422521.032 (deleted)
/data/data/####/261205422593.037
/data/data/####/261205422593.037 (deleted)
/data/data/####/261205423016.895
/data/data/####/261205423016.895 (deleted)
/data/data/####/261205423377.622
/data/data/####/261205423377.622 (deleted)
/data/data/####/261205423410.8
/data/data/####/261205423410.8 (deleted)
/data/data/####/541393112250.673
/data/data/####/541393112250.673 (deleted)
/data/data/####/541393112292.075
/data/data/####/541393112292.075 (deleted)
/data/data/####/541393112698.979
/data/data/####/541393112698.979 (deleted)
/data/data/####/541393113438.123
/data/data/####/541393113438.123 (deleted)
/data/data/####/541393113969.552
/data/data/####/541393113969.552 (deleted)
/data/data/####/541393115173.581
/data/data/####/541393115173.581 (deleted)
/data/data/####/541393115268.206
/data/data/####/541393115268.206 (deleted)
/data/data/####/541393115500.104
/data/data/####/541393115500.104 (deleted)
/data/data/####/541393115864.359
/data/data/####/541393115864.359 (deleted)
/data/data/####/541393115933.294
/data/data/####/541393115933.294 (deleted)
/data/data/####/541393117413.53
/data/data/####/541393117413.53 (deleted)
/data/data/####/541393118303.184
/data/data/####/541393118303.184 (deleted)
/data/data/####/541393118395.688
/data/data/####/541393118395.688 (deleted)
/data/data/####/541393118517.734
/data/data/####/541393118517.734 (deleted)
/data/data/####/541393118559.862
/data/data/####/541393118559.862 (deleted)
/data/data/####/541393119681.853
/data/data/####/541393119681.853 (deleted)
/data/data/####/541393119934.346
/data/data/####/541393119934.346 (deleted)
/data/data/####/541393120524.829
/data/data/####/541393120524.829 (deleted)
/data/data/####/541393121394.105
/data/data/####/541393121394.105 (deleted)
/data/data/####/541393121531.193
/data/data/####/541393121531.193 (deleted)
/data/data/####/541393122049.484
/data/data/####/541393122049.484 (deleted)
/data/data/####/541393122710.775
/data/data/####/541393122710.775 (deleted)
/data/data/####/60802447766.1135
/data/data/####/60802447766.1135 (deleted)
/data/data/####/60802447959.1563
/data/data/####/60802447959.1563 (deleted)
/data/data/####/60802448171.9571
/data/data/####/60802448171.9571 (deleted)
/data/data/####/60802448445.8552
/data/data/####/60802448445.8552 (deleted)
/data/data/####/60802448866.5924
/data/data/####/60802448866.5924 (deleted)
/data/data/####/690276244395.139
/data/data/####/690276244395.139 (deleted)
/data/data/####/690276244585.423
/data/data/####/690276244585.423 (deleted)
/data/data/####/690276245705.535
/data/data/####/690276245705.535 (deleted)
/data/data/####/690276246658.812
/data/data/####/690276246658.812 (deleted)
/data/data/####/690276246746.491
/data/data/####/690276246746.491 (deleted)
/data/data/####/AppSettings.xml
/data/data/####/CacheTime.dat
/data/data/####/DZTPreferences.xml
/data/data/####/ShowAdFlag.xml
/data/data/####/VUNGLE_PUB_APP_INFO.xml
/data/data/####/bmob_sp.xml
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/libjiagu.so
/data/data/####/mobclick_agent_cached_com.wzj.dztplayer3
/data/data/####/multidex.version.xml
/data/data/####/onlineconfig_agent_online_setting_com.wzj.dztplayer.xml
/data/data/####/umeng_general_config.xml
/data/data/####/vungle-journal
/data/data/####/webview.db-journal
/data/data/####/xUtils_http_cache.db
/data/data/####/xUtils_http_cache.db-journal
/data/data/####/xUtils_http_cookie.db
/data/data/####/xUtils_http_cookie.db-journal
/data/media/####/07d96cffac1cd3efc30a716a70e5a26c
/data/media/####/0ff8c5cd4b87c778185c8d2b2ef66c1b
/data/media/####/11bff27be6c574cfb5bc785f38f92dfc
/data/media/####/13f6bb8c059e6ec8d878f5536aeeef44
/data/media/####/346fd26bf5391a351ec85ce1eee1bb17
/data/media/####/3b37129a52c58d2d7252a1fc2ca1bb19
/data/media/####/485ef411a95f1e49202ffcca255e7e7d
/data/media/####/485ef411a95f1e49202ffcca255e7e7d.tmp
/data/media/####/647b7d170f3f9f12c98ce981999e8804
/data/media/####/861983859069b52ff24efb8d6dcbd9a5
/data/media/####/861983859069b52ff24efb8d6dcbd9a5.tmp
/data/media/####/938e790af8936191d01351bc9eec7fd0
/data/media/####/97634e7441ef7be93f0f1b5271dfeeb1
/data/media/####/97634e7441ef7be93f0f1b5271dfeeb1.tmp
/data/media/####/AppPackage.dat
/data/media/####/CacheTime.dat
/data/media/####/UnPackage.dat
/data/media/####/a9588662c4e7d159d3c6bbb35264d0d9
/data/media/####/afa7d36b75edbbfec7e813ee33769a78
/data/media/####/android
/data/media/####/b825759888aee085eca2677fb654efe4
/data/media/####/d0367cb1f9c4b3d2ff783885a03dbebc
/data/media/####/d0367cb1f9c4b3d2ff783885a03dbebc.tmp
/data/media/####/d6d54c66df00359ee738bc0a90f2a782
/data/media/####/e4a5d6530cad87e56b6fec9c0dc33c8f
/data/media/####/e76c772944b2f6bfde13008faf80d1ca
/data/media/####/ea3deb53a2b8f3554bf250d25de5e72f
/data/media/####/ecb633c302ad12895aba36113b7d9ac1
/data/media/####/ecb633c302ad12895aba36113b7d9ac1.tmp

Miscellaneous:

Executes the following shell scripts:

chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

bmob
libjiagu
libstlport_shared
libvplayer
webpbackport

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
DES-CBC-PKCS5Padding

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial