Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.543.origin
Network activity:
Connecting to:
- s####.####.com
- p####.####.com
- e####.####.top
- p####.####.cn
- c####.####.cn
- a####.####.com
HTTP GET requests:
- p####.####.cn/20170509/cd0b1a9709ecba0d053cd86c2ce376eb.jpg?imageVi####
- p####.####.cn/20170509/30dc301ab62079e22095fcc93d52b454.jpg?imageVi####
- p####.####.cn/20170309/9e392af3eafe666b55a267b50641a5b9.jpg?imageVi####
- a####.####.com/api/v7/social/hotlist?count=####&page=####
- p####.####.cn/20170509/d17c6535401042fe2cfacad43489a6cd.jpg?imageVi####
- a####.####.com/api/v1/c/p?p=####
- p####.####.cn/20170509/c534403a00f73f11a5e3eca8c26c6b38.jpg?imageVi####
- a####.####.com/api/v7/social/newlist?count=####&max_id=####
- c####.####.cn/sfile/201705/02/all/cp_V2.7.6.txt
- a####.####.com/api/v7/social/topandnoticelist
- p####.####.cn/20170509/538c3e6b980fe85c146eceffe21f61ce.jpg?imageVi####
- a####.####.com/api/v6/lotterynums/latest/all
- a####.####.com/api/v5/server/timestamp
- p####.####.cn/20170411/d251fb08637956a400da1e08f9f76c30.jpg?imageVi####
- p####.####.cn/20170225/9cb84c90359c87447e2921660255e2a9.jpg?imageVi####
- a####.####.com/api/v7/social/hitlist?count=####&max_id=####
- a####.####.com/api/v2/rank/landing?lottery_key=####
HTTP POST requests:
- e####.####.top/jzbdt/pjz/yp/in
- a####.####.com/api/v5/server/activate
- s####.####.com/pkl16.html
- a####.####.com/jiagu/t/infos
- e####.####.top/jzbdt/sx/vqjbb
- a####.####.com/api/v5/server/config
- p####.####.com/jiagu/msgs
- e####.####.top/jzbdt/ys/xq/otybh
- a####.####.com/ad-service/ad/mark
- e####.####.top/sdf/rmysf
- e####.####.top/jzbdt/ygs/ch/fypv
- e####.####.top/jzbdt/yz/w
- e####.####.top/jzbdt/hct/ywibt/vbs
- a####.####.com/app_logs
- e####.####.top/jzbdt/baxvs/z/cqr
- a####.####.com/jiagu/mark/upgrade
Modified file system:
Creates the following files:
- /data/data/####/files/a/e/66118404403612.0
- /data/data/####/files/.jiagu.lock
- /data/data/####/cache/volley/36321483127994478
- /data/data/####/files/kx.jar
- /data/data/####/shared_prefs/cache.xml
- /data/data/####/shared_prefs/Alvin2.xml
- /data/data/####/databases/cc.db
- /data/data/####/cache/glide_cache/93c9d190b47faf956416bcb3994c8d385e0cb6a1ab34364f1314f848807a7c19.0.tmp
- /data/data/####/cache/volley/-331095702120880179
- /data/data/####/databases/cc.db-journal
- /data/data/####/cache/volley/-9161834431848542199
- /data/data/####/cache/volley/-2088209206-285004863
- /data/data/####/files/a/e/journal.tmp
- /data/data/####/shared_prefs/jg_app_update_settings_random.xml
- /data/data/####/files/a/e/49118409650811.0
- /sdcard/Android/data/####/cache/2htxx2uxydy3f37wdxirb65f0
- /data/data/####/cache/volley/456287806-642105320
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/cache/volley/21090119561046727059
- /data/data/####/cache/volley/-1341685048-14584619
- /data/data/####/databases/ua.db
- /data/data/####/shared_prefs/multidex.version.xml
- /data/data/####/cache/glide_cache/6f133fd0fdfce5b91a6ca12f682aef61d7d65d28332915443d6f566ac00d4fa2.0.tmp
- /data/data/####/databases/t_u.db-journal
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/cache/glide_cache/0aa8022424594b5006d77e880c83e6d35e6953c5ecb5ab5e786bfe62b496e2c4.0.tmp
- /data/data/####/files/exid.dat
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/cache/glide_cache/adc8fc0eb45a03879bb6c902597f79eeb11126f0459e0859256b09a26d86d372.0.tmp
- /data/data/####/cache/volley/-149325294475075523
- /data/data/####/app_jgls/.log.ls
- /data/data/####/shared_prefs/wv.xml
- /data/data/####/shared_prefs/ContextData.xml
- /data/data/####/cache/volley/42304487321394978
- /data/data/####/shared_prefs/cache_int.xml
- /data/data/####/cache/volley/-1882776194-2091074092
- /data/data/####/cache/volley/-658855800-1842165428
- /data/data/####/cache/glide_cache/89c945d66d64c31196f716f3eaabff8d6e69c675146ac71a4966201b4237a13e.0.tmp
- /data/data/####/cache/volley/363214831-101004511
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/shared_prefs/dsi.xml
- /data/data/####/cache/glide_cache/5bbac11b92ac867d065e631bcc9e2425e95222d745eefc8f64c492c46ac14219.0.tmp
- /data/data/####/files/.jglogs/.jg.ac
- /data/data/####/databases/logdb.db
- /data/data/####/shared_prefs/sfe.xml.bak
- /data/data/####/cache/glide_cache/ee952e061be790018362f5b8aeca9f157e36a2c98bc99ebf74bf83b626682fd8.0.tmp
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/cache/volley/253193064-2039568853
- /sdcard/Android/data/####/cache/1ugitk6q9v1r6fpw5pgrlagv
- /data/data/####/cache/glide_cache/40fd7320ab226a68fb5a9d01aec481a73bedd178b799bc68a35ea18b2b6fdfe9.0.tmp
- /data/data/####/files/iq.jar
- /data/data/####/.jiagu/libjiagu.so
- /data/data/####/cache/volley/253193064-1619705854
- /data/data/####/databases/hmdb
- /data/data/####/cache/glide_cache/7522cdd2e9e262bcd8a942e1f50fde0178f2bc47b2c8143249e4677a197563f1.0.tmp
- /data/data/####/cache/glide_cache/1a31f2bcf633bb4df0c5b827e3f07b33d293adc9f377bdcc10d2d540a1230817.0.tmp
- /sdcard/Android/data/####/cache/5vgspxpwsz6c1i7yf31m7kfrl
- /data/data/####/shared_prefs/jg_core_setting.xml.bak
- /data/data/####/shared_prefs/umeng_general_config.xml
- /sdcard/Android/data/.nomedia
- /data/data/####/shared_prefs/kr.xml
- /data/data/####/cache/glide_cache/dda9781dc4298a896b502f6f83b7c959a172a0a2e8c8c29c7ec8d66506170487.0.tmp
- /data/data/####/shared_prefs/sfe.xml
- /sdcard/Android/data/####/files/Download/V2.7.6.txt
- /data/data/####/cache/volley/1785704582-119718588
- /data/data/####/files/a/e/journal
- /data/data/####/app_jgls/.log.lock
- /data/data/####/cache/volley/-1069057063-636594839
- /data/data/####/cache/volley/-17893987121944668222
- /data/data/####/shared_prefs/jg_core_setting.xml
- /data/data/####/cache/glide_cache/fe639821e851ba4d2ab978246efc409201498fd18038debe36509191e0140bd9.0.tmp
- /data/data/####/cache/volley/2024679795-1241141481
- /data/data/####/cache/volley/20849858541962875580
- /sdcard/Android/data/####/cache/2k21vfy2cvwj5p3cgh90dewr1
- /data/data/####/files/__cfg_lk_1312
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/files/.jglogs/.log3
- /data/data/####/cache/glide_cache/15dd90ea1f90e7d1a478ef103b96b647a2f7c3619c7ba853c7fb70f94644f31c.0.tmp
- /data/data/####/databases/ua.db-journal
- /data/data/####/cache/volley/-810449098-1965652546
- /data/data/####/cache/volley/-1812565009-1422289283
- /data/data/####/shared_prefs/kr.xml.bak
- /data/data/####/cache/glide_cache/b2e61393b995689c10bcd80814864beaf626cf417998a388ec93d20f284dc478.0.tmp
- /data/data/####/databases/hmdb-journal
- /data/data/####/files/.imprint
- /data/data/####/files/.jglogs/.jg.ri
- /data/data/####/cache/volley/-2019272085-1328730694
- /data/data/####/cache/volley/367472543943249124
- /sdcard/Android/data/####/cache/kyhzd4i0r0lz38wookmp7mgi
- /data/data/####/databases/logdb.db-journal
- /data/data/####/databases/webview.db-journal
- /data/data/####/cache/volley/-14932529442085446822
- /data/data/####/cache/volley/-175780388-803840943
- /data/data/####/cache/volley/-20807850218468090
- /data/data/####/cache/glide_cache/journal.tmp
Sets the 'executable' attribute to the following files:
- /data/data/####/.jiagu/libjiagu.so
Miscellaneous:
Executes next shell scripts:
- ps
- /system/bin/dexopt --dex 27 78 40 215416 /data/data/####/files/iq.jar 1251568852 -965164759 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/frame
- chmod 755 /data/data/####/.jiagu/libjiagu.so
- /system/bin/dexopt --dex 27 46 40 215416 /data/data/####/files/kx.jar 1251568852 -965164759 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/frame
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
