Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- d####.####.cn
- m####.####.com
- a####.####.com
- m####.####.com:8757
- e####.####.cn
HTTP GET requests:
- d####.####.cn/jarFile/SDKAutoUpdate/lvs.jar
- m####.####.com/sdk.html
HTTP POST requests:
- a####.####.com/ad-service/ad/mark
- e####.####.cn/cw/interface!u2.action?protocol=####&version=####&cid=####
- m####.####.com:8757/sdk.html
Modified file system:
Creates the following files:
- /data/data/####/.jiagu/libjiagu.so
- /data/data/####/databases/downloadswc-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/a.xml.bak
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
- /data/data/####/databases/google_analytics_v4.db-journal
- /data/data/####/shared_prefs/jg_app_update_settings_random.xml
- /sdcard/dt/restime.dat
- /data/data/####/files/.yflurryreport.73340df1a7647a39
- /data/data/####/no_backup/com.google.android.gms.appid-no-backup
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml.bak
- /data/data/####/shared_prefs/a.xml
- /data/data/####/shared_prefs/com.google.android.gms.analytics.prefs.xml
- /data/data/####/databases/google_app_measurement_local.db-journal
- /data/data/####/shared_prefs/W_Key.xml
- /data/data/####/files/persisted_config
- /data/data/####/files/.yflurrydatasenderblock.8574c404-a422-4db8-aed9-b980d6ee0f26
- /data/data/####/app_jgls/.log.lock
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/st.xml
- /data/data/####/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml
- /data/data/####/files/gaClientId
- /data/data/####/databases/downloadswc
- /data/data/####/app_jgls/.log.ls
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/files/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/files/.YFlurrySenderIndex.info.AnalyticsData_ST7RRPTZXJN5NWVX6PRH_216
- /data/data/####/databases/google_app_measurement_local.db
- /sdcard/Download/hou/4.6_lvs.jar.tmp
- /data/data/####/shared_prefs/com.google.android.gms.appid.xml
Miscellaneous:
Executes next shell scripts:
- chmod 755 /data/data/####/.jiagu/libjiagu.so
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
