Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) c####.im.qq.com:80
- TCP(HTTP/1.1) t.si####.net:80
- TCP(HTTP/1.1) m.b####.cn:80
- TCP(HTTP/1.1) up.soso####.com:80
- TCP(HTTP/1.1) re####.b####.sc####.com:80
- TCP(HTTP/1.1) cs.bukama####.com:8000
- TCP(HTTP/1.1) f.xingch####.com.####.com:80
- TCP(HTTP/1.1) 2####.243.193.47:80
DNS requests:
- a####.u####.com
- c####.i####.cn
- c####.im.qq.com
- cs.bukama####.com
- f.xingch####.com
- i####.i####.cn
- i####.soso####.cn
- m.b####.cn
- t.si####.net
- up.soso####.com
HTTP GET requests:
- c####.im.qq.com/cgi-bin/cgi_svrtime
- f.xingch####.com.####.com/201801/wet.jar
- m.b####.cn/article/64456?p=####
- re####.b####.sc####.com/article/images/180129/ce8d856efff3a0db3e563fcc4a...
- re####.b####.sc####.com/article/images/thumb/180122/81ddde4ec085f234410f...
- re####.b####.sc####.com/article/images/thumb/180125/8332a6a51393f4e95aeb...
- re####.b####.sc####.com/article/images/thumb/180125/8d31f7c2068f48e77321...
- re####.b####.sc####.com/article/images/thumb/180125/a3da41d00618a8f01cb1...
- re####.b####.sc####.com/article/images/thumb/180128/152f5b70a410dc82d32a...
- re####.b####.sc####.com/article/images/thumb/180128/21e9642453bf2eaae7a0...
- re####.b####.sc####.com/article/images/thumb/180129/1e0e40fb0dca427a281b...
- re####.b####.sc####.com/article/images/thumb/180129/40bc025b9f92c9ab16a7...
- re####.b####.sc####.com/article/images/thumb/180129/470d760eaa2518dc8e2b...
- re####.b####.sc####.com/article/images/thumb/180129/67913d607b574d86b87a...
- re####.b####.sc####.com/article/images/thumb/180129/93c2b1e863fa0b7099fe...
- re####.b####.sc####.com/article/images/thumb/180129/99efa977fd6b7c80a79d...
- re####.b####.sc####.com/article/images/thumb/180129/a1cdcd0f46b30faec412...
- re####.b####.sc####.com/article/images/thumb/180129/ce8d856efff3a0db3e56...
- re####.b####.sc####.com/article/images/thumb/180129/da182de3445b4c767ac1...
- re####.b####.sc####.com/article/images/thumb/180129/f2eb94c9a04140df1a56...
- re####.b####.sc####.com/auto/appRecom/20160622165106_576a517a17eb0.png
- re####.b####.sc####.com/auto/appRecom/20160622165243_576a51db736a8.png
- re####.b####.sc####.com/auto/appRecom/20160622165329_576a52099efd5.png
- re####.b####.sc####.com/auto/appRecom/20160802172129_57a06618e2ea0.png
- re####.b####.sc####.com/auto/appRecom/20161114165137_58297b19bd8c8.jpg
- re####.b####.sc####.com/auto/appRecom/20161125133328_5837cd28a51e5.jpg
- re####.b####.sc####.com/auto/appRecom/20161218194517_585676cd6e0ca.jpg
- re####.b####.sc####.com/auto/appRecom/20161223182900_585cfc6ce06f6.jpg
- re####.b####.sc####.com/auto/appRecom/20161223182912_585cfc784c047.jpg
- re####.b####.sc####.com/auto/appRecom/20161223182928_585cfc88de3e2.jpg
- re####.b####.sc####.com/auto/appRecom/20171024141511_59eeda6f52311.jpg
- re####.b####.sc####.com/auto/appRecom/20171226170320_5a4210582db34.jpg
- re####.b####.sc####.com/auto/appRecom/20171226172155_5a4214b353003.jpg
- re####.b####.sc####.com/auto/appRecom/20180123140356_5a66d04c09fe0.jpg
- re####.b####.sc####.com/logo/goods/20171107153358_5a0161e5efd5f.jpg
- re####.b####.sc####.com/logo/goods/20180109181524_5a54963cb198d.jpg
- re####.b####.sc####.com/logo/goods/20180126191824_5a6b0e8067b39.jpg
- re####.b####.sc####.com/logo/goods/20180126191829_5a6b0e84ef401.jpg
- re####.b####.sc####.com/logo/goods/sds.jpg
- re####.b####.sc####.com/logo/group/20151013151320_561caf1078614.jpg
- re####.b####.sc####.com/logo/group/20151120172131_564ee61b425c6.jpg
- re####.b####.sc####.com/logo/group/20160314180045_56e68bcdc7193.jpg
- re####.b####.sc####.com/logo/group/20160825145944_57be976063e36.png
- re####.b####.sc####.com/logo/group/20160825145948_57be9764d0c6e.png
- re####.b####.sc####.com/logo/group/20161012160943_57fdefc702307.png
- re####.b####.sc####.com/logo/group/20161013164354_57ff494a432b3.png
- re####.b####.sc####.com/logo/group/20170103144735_586b49070de22.png
- re####.b####.sc####.com/logo/group/20170424145626_58fda19accdd9.jpg
- re####.b####.sc####.com/logo/logo5/215841/201601181850/32m.jpg
- re####.b####.sc####.com/logo/logo5/218933/201608111710/32m.jpg
- re####.b####.sc####.com/logo/logo5/219001/201608241650/32m.jpg
- re####.b####.sc####.com/logo/logo5/219250/201610121456/32m.jpg
- re####.b####.sc####.com/logo/logo5/219904/201702241949/32m.jpg
- re####.b####.sc####.com/logo/logo5/220014/201703221435/32m.jpg
- re####.b####.sc####.com/logo/user/head/20141226/2747997-123418_100100.jpg
- re####.b####.sc####.com/logo/user/head/20170823/10472411-182715_260260.jpg
- re####.b####.sc####.com/logo/user/head/20171126/11929182-204716_260260.jpg
- re####.b####.sc####.com/logo/user/head/20171230/8848244-153139_260260.jpg
- re####.b####.sc####.com/logo/user/head/20180114/10528208-094729_260260.jpg
- re####.b####.sc####.com/logo/user/head/20180120/7184502-134324_260260.jpg
- re####.b####.sc####.com/logo/user/head/20180123/10021209-120549_260260.jpg
- re####.b####.sc####.com/logo/user/head/20180128/6612013-203643_260260.jpg
- re####.b####.sc####.com/static/article/css/base.css?v=####
- re####.b####.sc####.com/static/article/js/jquery.min.js
- up.soso####.com/android/ver.php?chn=####&model=####&manu=####&ver=####&h...
HTTP POST requests:
- a####.u####.com/app_logs
- cs.bukama####.com:8000/request.php?t=####&u=####
- t.si####.net/t1?requestId=####&g=####
- t.si####.net/t2
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_buka_manga/cache_request_main_recom.tmp
- <Package Folder>/app_buka_manga/cache_request_manga_categories.tmp
- <Package Folder>/app_buka_manga/discovery_cache_one.tmp
- <Package Folder>/app_buka_manga/discovery_cache_three.tmp
- <Package Folder>/app_buka_manga/discovery_cache_two.tmp
- <Package Folder>/app_buka_manga/manga_purchase_records.txt
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/index
- <Package Folder>/databases/article.db-journal
- <Package Folder>/databases/buka.db-journal
- <Package Folder>/databases/downloadinfo.db-journal
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/history.db-journal
- <Package Folder>/databases/statcache.db-journal
- <Package Folder>/databases/ticket.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/.imprint
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/jg_so_upgrade_setting.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/xx.xml
- <SD-Card>/Download/####/5.0wet.jar.t
- <SD-Card>/dt/restime.dat
- <SD-Card>/ibuka/####/-aZnG9ow8nWsmNxd2VpOxaMBrvI.1252907968.tmp
- <SD-Card>/ibuka/####/0DbYYuJ7IVQw1G1EMSSyBMGa4l8.-1128437809.tmp
- <SD-Card>/ibuka/####/0OnH9zbws2ymW8t0iz5pMpZbWNk.1463818838.tmp
- <SD-Card>/ibuka/####/2m14IeXSxSN5fdYxk4N2xNIN9f4.-499750337.tmp
- <SD-Card>/ibuka/####/3G0yS8hbEvtVROnhF9BPz2XFYWA.-1707489269.tmp
- <SD-Card>/ibuka/####/44ED5D46FB23B18C53709513C8CC9C68.jpg.tmp
- <SD-Card>/ibuka/####/4vv7f-Cj4nb0THcgsX9M8UpFdtY.887955289.tmp
- <SD-Card>/ibuka/####/5iHLiNFQgJo2_c8ozJX5ehZDfT0.1633213880.tmp
- <SD-Card>/ibuka/####/5jPZosflJI4_UdUWRqhnLM93ey4.-941782399.tmp
- <SD-Card>/ibuka/####/7-J_qp1YlmzJ68Ft4yCErzOJKJ4.-1826417983.tmp
- <SD-Card>/ibuka/####/9OzeIK-B8VDiK0Vr8aJ-6Y91o24.-1541225739.tmp
- <SD-Card>/ibuka/####/BuAxWSKZML-gVyImLwaz8l3B23I.-434975401.tmp
- <SD-Card>/ibuka/####/HtfAflGU6Tx1brWnATUOeraMJ3Y.-376929100.tmp
- <SD-Card>/ibuka/####/IrS_H3lKtdQQR9ngT-q4FSyfMq8.1539416963.tmp
- <SD-Card>/ibuka/####/Jcy5j2pLZbI-ddx3gLPrksKASQQ.640859121.tmp
- <SD-Card>/ibuka/####/JxJTFiDZS-LuDKyMibD6-omxKRs.-1398855055.tmp
- <SD-Card>/ibuka/####/KB5jKJP65z4V12tfOU6Nb3wSJwM.1119786722.tmp
- <SD-Card>/ibuka/####/KExEybe3chitf0SpZe0edhwi9nU.2095706111.tmp
- <SD-Card>/ibuka/####/KZQuvFl_Re0n7zEImbsUr2H4_tk.-1809409340.tmp
- <SD-Card>/ibuka/####/LAUILyCG7AQLnq4oJ31TdLXjf08.-744706187.tmp
- <SD-Card>/ibuka/####/Li2JAeypzkZLXBZEST7dfnvTpJ0.1185262357.tmp
- <SD-Card>/ibuka/####/MRlIYdFGRtiDMpOGLcJArr80cDI.-890710478.tmp
- <SD-Card>/ibuka/####/OQOqk19F_D6alK8qQxackO7OiOc.-1969633489.tmp
- <SD-Card>/ibuka/####/Okv5KLRauftcUgtHarhaafReRZM.-1841594590.tmp
- <SD-Card>/ibuka/####/P0KDGwhk3yYEq2gOBYJ-DWMAy9A.125280744.tmp
- <SD-Card>/ibuka/####/PZwwD0M31Y76Cnk__sheKhKxpcI.-1277465200.tmp
- <SD-Card>/ibuka/####/PhmxyZCJAlYpuut3ssjaBITPRDk.1794473443.tmp
- <SD-Card>/ibuka/####/Pv_404hMkF-tEHKscjXKzpGzDmg.1233674353.tmp
- <SD-Card>/ibuka/####/SEv4R083CgfA1djYxuPdSBaS6Yc.-1428367183.tmp
- <SD-Card>/ibuka/####/SySKaN5WIYKWKRlqEbdetVuhZys.-2077126237.tmp
- <SD-Card>/ibuka/####/W0m7e-4A6WBQ6L8BQOlQz2gIi04.802699850.tmp
- <SD-Card>/ibuka/####/XYzZEiUflezlE8RffXHMFyYjl-g.-1325650252.tmp
- <SD-Card>/ibuka/####/XaEKix_ExAB9ZoESui7Yu3yTxoQ.-134397807.tmp
- <SD-Card>/ibuka/####/YiTHpSI1dqE7fFTJ_3LLSYJRIes.1114768660.tmp
- <SD-Card>/ibuka/####/aMuZWwrDH2X5MsIpVNBU_q5g_iM.213314328.tmp
- <SD-Card>/ibuka/####/dKmZ5AmVSWuTDEseDp4zpubUzbc.-625977604.tmp
- <SD-Card>/ibuka/####/dNQOf62neLNhoiBzRFvXllfdqIQ.-1568415055.tmp
- <SD-Card>/ibuka/####/dmxjkhKkdpCvtSxRln3v_rVhXuc.-1237204908.tmp
- <SD-Card>/ibuka/####/evwckRTOUnU5chiRRuRTKRt0a0I.-1361505731.tmp
- <SD-Card>/ibuka/####/i8eV3zvS6sfuITwyK_stuxVAijE.1037976250.tmp
- <SD-Card>/ibuka/####/jFY2277sVFiTlGn2775xwNlZvxE.-1475223461.tmp
- <SD-Card>/ibuka/####/jZGoLG3X4K99KwvZsXKciqyPGDw.-1612360523.tmp
- <SD-Card>/ibuka/####/jeRfx7nMnYDFpnn34B8TeE0QJ5k.43183300.tmp
- <SD-Card>/ibuka/####/k9iPDJVO3C0Qy6TLkBQUSLF2HDM.-1773876492.tmp
- <SD-Card>/ibuka/####/kvi33FGxUBbxuKZdCusqXwLz3IU.-441823389.tmp
- <SD-Card>/ibuka/####/l5Z0O2MINf3k81C62s70deNVXys.-1141370277.tmp
- <SD-Card>/ibuka/####/lM_GxImpqVpQ1P94KkfvsWf_-90.-1631597736.tmp
- <SD-Card>/ibuka/####/ljbsXebYzavO5mpD2STczJmvvHU.-728905279.tmp
- <SD-Card>/ibuka/####/noY-znXjkq2VX78OlS7FL6YKySw.1123531960.tmp
- <SD-Card>/ibuka/####/orUsO1H6voEi51vzSlR6vQtYPAY.-1335617964.tmp
- <SD-Card>/ibuka/####/pN0HimjEb1ylxJ9exg8qlVsVIt8.-1151105731.tmp
- <SD-Card>/ibuka/####/sOcvl7Q44toxC9xvW-y5TUADbPI.-273269198.tmp
- <SD-Card>/ibuka/####/slWNwbyK2uFmAPvpva6Zjc42Ie8.-1353829254.tmp
- <SD-Card>/ibuka/####/sq_8wVzSvye4u_HKTWv8rKfog7A.1335188020.tmp
- <SD-Card>/ibuka/####/tGThWmOtY8akBELd0AnSUYDWqUU.-297916296.tmp
- <SD-Card>/ibuka/####/v2m0DGFZHG-Hs28Ox4yckiXgsWY.1842331962.tmp
- <SD-Card>/ibuka/####/vnaTzkx-M9oolIftIJqKjtNMhb8.-1482123541.tmp
- <SD-Card>/ibuka/####/xsPRASc7kPPVFOCcTA5gMSwla8M.-607559509.tmp
- <SD-Card>/ibuka/.asset
- <SD-Card>/ibuka/.nomedia
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- bitmaps
- libjiagu
- memchunk
- pl_droidsonroids_gif
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
