Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Waps.5.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) ads.w####.cn:80
- TCP(HTTP/1.1) ser####.j####.360.cn:80
- TCP(HTTP/1.1) www.12####.com:80
- TCP(HTTP/1.1) a.appj####.com:80
- TCP(HTTP/1.1) ads.m####.net:80
- TCP(HTTP/1.1) app.w####.cn:80
- TCP(HTTP/1.1) www.beid####.com:80
- TCP(TLS/1.0) www.go####.com:443
DNS requests:
- a.appj####.com
- ads.m####.net
- ads.w####.cn
- app.w####.cn
- au.u####.com
- ser####.j####.360.cn
- www.12####.com
- www.b####.com
- www.beid####.com
- www.dianm####.com
- www.go####.com
HTTP GET requests:
- ads.m####.net/newsdk/update.xml
- ads.w####.cn/action/miniad/ad?app_id=####&udid=####&imsi=####&net=####&b...
- app.w####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=#...
- www.12####.com/
- www.beid####.com/fct/fileDownLoadAction?filePath=####
HTTP POST requests:
- a.appj####.com/ad-service/ad/mark
- ser####.j####.360.cn/jiagu/check/upgrade
Modified file system:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/.jiagu.lock
- /data/data/####/AppSettings.xml
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/CacheTime.dat
- /data/data/####/__pasys_remote_banner.tmp.jar
- /data/data/####/__pasys_remote_offer_wall.tmp.jar
- /data/data/####/bmob_sp.xml
- /data/data/####/com.e4a.runtime.android.mainActivity.xml
- /data/data/####/jg_app_update_settings_random.xml
- /data/data/####/libjiagu.so
- /data/data/####/spname.xml
- /data/data/####/wall_sdk_data.xml
- /data/data/####/wall_sdk_data.xml.bak
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.cuid
- /data/media/####/.nomedia
- /data/media/####/CacheTime.dat
- /data/media/####/ad.dat
- /data/media/####/android
- /data/media/####/ini.dat
- /data/media/####/ls.db
- /data/media/####/ls.db-journal
- /data/media/####/sci.vmb
- /data/media/####/yoh.dat
- /data/media/####/yol.dat
- /data/media/####/yom.dat
Miscellaneous:
Executes next shell scripts:
- chmod 705 <Package Folder>/cache/plugin
Loads the following dynamic libraries:
- bspatch
- libjiagu
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- DES
- DES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gains access to geolocation.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
