Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.420.origin
Network activity:
Connecting to:
- s####.####.com
- k####.####.cn
- imgc####.####.com
- c####.####.com
- m####.####.com
- a####.####.com
- qzones####.####.cn
HTTP GET requests:
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/banner.html
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/imgs/close03.png
- imgc####.####.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his...
- c####.####.com/code.cgi?domain=mi.gdt.qq.com&time=860&rate=100&code=0&ty...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/imgs/bannerbg02.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/imgs/banner_down_confirm.gif
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/js/lib/require.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/imgs/loading.gif
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/imgs/banner_close_btn.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/imgs/bannerbg03.jpg
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/js/common/bridge.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/gdtmob.appcache
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/js/banner/banner.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/js/common/util.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/imgs/gdt_logo.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/imgs/sdk_bg.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/js/lib/zepto.js
- m####.####.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&datat...
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/imgs/tc-gdt-sdk-open.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/imgs/close02.png
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/imgs/download_icon.gif
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/js/lib/slider.js
- qzones####.####.cn/qzone/biz/gdt/mob/sdk/v2/js/banner/bannerapkpop.js
HTTP POST requests:
- s####.####.com/activate?queueSize=####
- a####.####.com/app_logs
- k####.####.cn/ts/image/sec
- k####.####.cn/ts/list_icons/sec
- a####.####.com/ad-service/ad/mark
Modified file system:
Creates the following files:
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.sig
- <Package Folder>/app_e_qq_com_setting/sdkCloudSetting.cfg
- <Package Folder>/files/v.jar
- <Package Folder>/files/.imprint
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar.sig
- <Package Folder>/shared_prefs/shareFile.xml.bak
- <Package Folder>/databases/t_u.db-journal
- <Package Folder>/cache/webviewCacheChromium/index
- <Package Folder>/files/.jglogs/.jg.ic
- <Package Folder>/cache/webviewCacheChromium/f_000001
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.tmp
- <Package Folder>/app_e_qq_com_setting/gdt_suid
- <Package Folder>/shared_prefs/shareFile.xml
- <Package Folder>/files/libjiagu.so
- <Package Folder>/app_e_qq_com_plugin/gdt_plugin.jar
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/databases/GDTSDK.db-journal
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.cfg
- <Package Folder>/databases/GDTSDK.db
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/app_e_qq_com_setting/devCloudSetting.sig
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/cache/webviewCacheChromium/data_3
- <Package Folder>/cache/webviewCacheChromium/data_2
- <Package Folder>/cache/webviewCacheChromium/data_1
- <Package Folder>/cache/webviewCacheChromium/data_0
Miscellaneous:
Executes next shell scripts:
- chmod 755 /data/data/####/files/libjiagu.so
- chmod 755 <Package Folder>/files/libjiagu.so
- <dexopt>
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
