Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Kyview.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) co####.ad####.cn:443
- TCP(TLS/1.0) re####.ad####.cn:443
- TCP(TLS/1.0) 1####.217.168.238:443
- TCP(TLS/1.0) bid.ad####.cn:443
- TCP(TLS/1.0) ad####.ad####.cn:443
DNS requests:
- ad####.ad####.cn
- bid.ad####.cn
- co####.ad####.cn
- re####.ad####.cn
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/.log.lock
- /data/data/####/.log.ls
- /data/data/####/SDK20171705050133rrvq9f3ra2etcm7_banner.xml
- /data/data/####/SDK20171705050133rrvq9f3ra2etcm7_instl.xml
- /data/data/####/SDK20171705050133rrvq9f3ra2etcm7_video.xml
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/libjiagu.so
- /data/data/####/mobclick_agent_cached_com.player.ciliplayer12
- /data/data/####/sp_dev_info.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/webview.db-journal
Miscellaneous:
Executes the following shell scripts:
- cat /sys/class/net/wlan0/address
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- libjiagu
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
