Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Moplus.1
Downloads the following detected threats from the Web:
- Android.Moplus.1
Network activity:
Connecting to:
- 7j####.####.com
- LB-IM-1####.####.com
- a####.####.com
- c-h####.####.com
- o####.####.com
- o####.####.com:8080
- ope####.####.cn
- p####.####.com
- reso####.####.net
- s####.####.com
- sh####.####.com
HTTP GET requests:
- 7j####.####.com/tdata_CgN316
- LB-IM-1####.####.com/gslb/?ver=####&type=####&uuid=####&list=####&key=####
- a####.####.com/qbmapp/api/getAppUrl.html
- ope####.####.cn/index/upgrade?package=####&version=####&apk_version=####...
- p####.####.com/t01793163f68a77f8b6.png
- reso####.####.net/gslb/?ver=####&type=####&uuid=####&list=####&key=####
- s####.####.com/config/hz-hzv3.conf
- sh####.####.com/160422/57b92647917cce029e2634ba82d77e69/libpatch.so
HTTP POST requests:
- a####.####.com/app_logs
- c-h####.####.com/api.php?format=####&t=####
- o####.####.com/analytics/upload?rid=####&sid=####
- o####.####.com/analytics/upload?sid=####
- o####.####.com/v2/get_update_time
- o####.####.com:8080/analytics/upload
- o####.####.com:8080/analytics/upload?rid=####&sid=####
- p####.####.com/api/q/a/315432f0c34a6005ff1c18a57a27f742e
- s####.####.com/api.php?format=####&t=####
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/####/-1159405120-1693058923
- <Package Folder>/cache/####/-1317398305665725031
- <Package Folder>/cache/####/-3294776501944538941
- <Package Folder>/cache/####/1022105319-983249359
- <Package Folder>/cache/####/206FF0C0FD7237E1C5F12C246CF067DA.png
- <Package Folder>/cache/####/2891723802065644570
- <Package Folder>/cache/####/854823973938940963
- <Package Folder>/cache/####/libpatch.so
- <Package Folder>/cache/####/libpatch1.so
- <Package Folder>/cache/####/temp.tmp~ (deleted)
- <Package Folder>/databases/beacon_db-journal
- <Package Folder>/databases/increment.db-journal
- <Package Folder>/databases/mpush_app.db-journal
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/.imprint
- <Package Folder>/files/<Package>;pushservice
- <Package Folder>/files/Beacon_sig_1.lock
- <Package Folder>/files/TDtcagent.db
- <Package Folder>/files/TDtcagent.db-journal
- <Package Folder>/files/init.pid
- <Package Folder>/files/init_c.pid
- <Package Folder>/files/mobclick_agent_cached_<Package>55
- <Package Folder>/files/mpush_gateway_preferences_file
- <Package Folder>/files/mpush_version_preferences_file
- <Package Folder>/files/push.pid
- <Package Folder>/files/run.pid
- <Package Folder>/files/td.lock
- <Package Folder>/files/tdlock.txt
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/libs/####/libpatch
- <Package Folder>/libs/####/libpatch1
- <Package Folder>/mobilepaysdk.zip
- <Package Folder>/mobilepaysdk/####/back_holo_dark.png
- <Package Folder>/mobilepaysdk/####/back_holo_light.png
- <Package Folder>/mobilepaysdk/####/chkbtn.png
- <Package Folder>/mobilepaysdk/####/chkbtn_cur.png
- <Package Folder>/mobilepaysdk/####/common.css
- <Package Folder>/mobilepaysdk/####/common.js
- <Package Folder>/mobilepaysdk/####/cordova.js
- <Package Folder>/mobilepaysdk/####/httpRequest.js
- <Package Folder>/mobilepaysdk/####/jquery-2.1.1.min.js
- <Package Folder>/mobilepaysdk/####/jquery.mobile-1.4.2.min.css
- <Package Folder>/mobilepaysdk/####/jquery.mobile-1.4.2.min.js
- <Package Folder>/mobilepaysdk/####/jquery.touchSwipe.min.js
- <Package Folder>/mobilepaysdk/####/localData.js
- <Package Folder>/mobilepaysdk/####/logo.png
- <Package Folder>/mobilepaysdk/####/md5.js
- <Package Folder>/mobilepaysdk/####/mobiscroll.core.js
- <Package Folder>/mobilepaysdk/####/mobiscroll.datetime.js
- <Package Folder>/mobilepaysdk/####/mobiscroll.scroller.css
- <Package Folder>/mobilepaysdk/####/mobiscroll.scroller.js
- <Package Folder>/mobilepaysdk/####/mustache.js
- <Package Folder>/mobilepaysdk/####/pay.js
- <Package Folder>/mobilepaysdk/####/reset.css
- <Package Folder>/mobilepaysdk/####/spin.min.js
- <Package Folder>/mobilepaysdk/####/style.css
- <Package Folder>/mobilepaysdk/####/xml2json.js
- <Package Folder>/mobilepaysdk/agreement_book.html
- <Package Folder>/mobilepaysdk/agreement_book_fast.html
- <Package Folder>/mobilepaysdk/bank_list.html
- <Package Folder>/mobilepaysdk/card_manager.html
- <Package Folder>/mobilepaysdk/card_setup.html
- <Package Folder>/mobilepaysdk/card_setup_credit.html
- <Package Folder>/mobilepaysdk/card_setup_debit.html
- <Package Folder>/mobilepaysdk/card_setup_fucard.html
- <Package Folder>/mobilepaysdk/card_setup_two.html
- <Package Folder>/mobilepaysdk/index.html
- <Package Folder>/mobilepaysdk/pay_pwd_setup.html
- <Package Folder>/mobilepaysdk/payment.html
- <Package Folder>/mobilepaysdk/result.html
- <Package Folder>/mobilepaysdk/version.json
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/DENGTA_META.xml
- <Package Folder>/shared_prefs/DENGTA_META.xml.bak
- <Package Folder>/shared_prefs/TDCloudSettingsConfig0C8662BE5E88719737C444AED18493D8.xml
- <Package Folder>/shared_prefs/TDCloudSettingsConfig0C8662BE5E88719737C444AED18493D8.xml.bak
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
- <Package Folder>/shared_prefs/TD_app_pefercen_profile.xml.bak
- <Package Folder>/shared_prefs/TDpref_longtime.xml
- <Package Folder>/shared_prefs/TDpref_longtime.xml.bak
- <Package Folder>/shared_prefs/TDpref_shorttime.xml
- <Package Folder>/shared_prefs/TDpref_shorttime.xml.bak
- <Package Folder>/shared_prefs/first_pref.xml
- <Package Folder>/shared_prefs/fm_shared.xml
- <Package Folder>/shared_prefs/mipush.xml
- <Package Folder>/shared_prefs/mipush.xml.bak
- <Package Folder>/shared_prefs/mipush_account.xml
- <Package Folder>/shared_prefs/mipush_extra.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml.bak
- <Package Folder>/shared_prefs/pref_registered_pkg_names.xml
- <Package Folder>/shared_prefs/qianbaomu.xml
- <Package Folder>/shared_prefs/session.xml
- <Package Folder>/shared_prefs/share_data_updatesdk.xml
- <Package Folder>/shared_prefs/sharedpref.xml
- <Package Folder>/shared_prefs/sharedpref.xml.bak
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/update.qh
- <SD-Card>/.fraudmetrixid
- <SD-Card>/.tcookieid
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1mfyt0bt2iulzmixfpobvwmaf.tmp
- <SD-Card>/Android/####/3e513htwl1xxhrf4hph3fv4dx.tmp
- <SD-Card>/Android/####/4vcnm8hmie2uhj5lsz9rhuibh.tmp
- <SD-Card>/Android/####/5prnbvj1h0es33co8soi7c2zk.tmp
- <SD-Card>/Android/####/69r9lvxf3k10j6l8fmk02kccx.tmp
- <SD-Card>/Android/####/6ztuky0padjjwlrn3cogt4kei.tmp
- <SD-Card>/Android/####/q7knir3z1bjddjzi6vase7bw.tmp
- <SD-Card>/libs/<Package>.db
- <SD-Card>/libs/app.db
- <SD-Card>/libs/com.igexin.sdk.deviceId.db
- <SD-Card>/qianbaomu/####/6ff2784b6424571d62a343255869884d
- <SD-Card>/qianbaomu/####/ed38aba7d6e0de7c89ab4849938dfa5b
Miscellaneous:
Executes next shell scripts:
- chmod 755 /data/data/com.qianbaomu.view/.jiagu/libjiagu.so
- chmod 755 /data/data/com.qianbaomu.view/cache/360Download
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/cache/360Download
- getprop net.dns1
- getprop ro.product.device
- getprop ro.product.model
- getprop ro.product.name
- getprop ro.serialno
- ls -l /system/bin/su
- ls -l /system/xbin/su
Uses special library to hide executable bytecode.
