Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(GCM) <Google Host>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) s.wagbr####.alibaba####.com:80
- TCP(HTTP/1.1) c####.im.qq.com:80
- TCP(HTTP/1.1) go.1mi####.cn:80
- TCP(HTTP/1.1) www.ty####.cn:80
- TCP(HTTP/1.1) wap.iq####.com:80
- TCP(HTTP/1.1) d.xiongj####.com.####.com:80
- TCP(HTTP/1.1) wap.cm####.com:80
- TCP(HTTP/1.1) sdk.boe####.cn:80
DNS requests:
- a####.u####.com
- au.u####.com
- c####.im.qq.com
- d.xiongj####.com.cn
- go.1mi####.cn
- sdk.boe####.cn
- wap.cm####.com
- wap.iq####.com
- www.ty####.cn
HTTP GET requests:
- d.xiongj####.com.####.com/jfile/ter.jar
- sdk.boe####.cn/Uploads/2015-07-02/1435829644.jpg
- sdk.boe####.cn/Uploads/2015-07-02/1435829650.jpg
- sdk.boe####.cn/Uploads/2015-07-02/1435829667.jpg
- sdk.boe####.cn/api/Notice/index/qdid/freereadbar_1
- sdk.boe####.cn/api/Tuijian/bookTuijianNums?channel=####&limit=####&type=...
- wap.cm####.com/r/401178945/401178947/index.htm?vt=####&cm=####
- wap.cm####.com/r/401178945/401178948/index.htm?vt=####&cm=####
- wap.cm####.com/r/401178945/401178949/index.htm?vt=####&cm=####
- wap.cm####.com/r/401178945/401178950/index.htm?vt=####&cm=####
- wap.cm####.com/r/401178945/401178951/index.htm?vt=####&cm=####
- wap.cm####.com/r/401178945/401178952/index.htm?vt=####&cm=####
- wap.cm####.com/r/;jsessionid=70516991A175773BF913F570793A5F37.8ngFwo0jO....
- wap.cm####.com/r/;jsessionid=966424DE4E27CA6C67BCE7C0FC62FE94.8ngFwnvWo....
- wap.cm####.com/r/;jsessionid=FB70A70883D61DE83A5F6CAB1BBFBF80.8ngFwnIVS....
- wap.cm####.com/r/cover_file/1050/800091050/20160803161003/cover180240.jpg
- wap.cm####.com/r/cover_file/1193/405121193/20150313101922/cover180240.jpg
- wap.cm####.com/r/cover_file/1504/410531504/20150923145720/cover180240.jpg
- wap.cm####.com/r/cover_file/8225/405458225/20150324132301/cover180240.jpg
- wap.cm####.com/r/cover_file/9311/380929311/20140704102447/cover180240.jpg
- wap.cm####.com/r/p/catalogdata.jsp?orderType=####&vt=####&page=####&page...
- wap.iq####.com/ebook/clients/get_cm_channel_by_name/boetech
HTTP POST requests:
- c####.im.qq.com/cgi-bin/cgi_svrtime
- s.wagbr####.alibaba####.com/api/check_app_update
- sdk.boe####.cn/api/Book/chapterList
- sdk.boe####.cn/api/Book/content
- sdk.boe####.cn/api/BoyiSdk/readChapter
- sdk.boe####.cn/api/BoyiSdk/userRegister
- sdk.boe####.cn/api/Channel/mappingTable
- sdk.boe####.cn/api/config/config/qdid/freereadbar_1/uid/0/version/3.1
- www.ty####.cn/n
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/cache/####/-2023999713-1343181243
- <Package Folder>/cache/####/-2023999713-1378275041
- <Package Folder>/cache/####/-2023999713-1403210108
- <Package Folder>/cache/####/282144521-2041279167
- <Package Folder>/databases/boe_data_0.db
- <Package Folder>/databases/boe_data_0.db-journal
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/.imprint
- <Package Folder>/files/20140704102447cover180240.jpg
- <Package Folder>/files/2015-07-021435829644.jpg
- <Package Folder>/files/2015-07-021435829650.jpg
- <Package Folder>/files/2015-07-021435829667.jpg
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/config.xml
- <Package Folder>/shared_prefs/config.xml.bak
- <Package Folder>/shared_prefs/everyTuijian.xml
- <Package Folder>/shared_prefs/everytime.xml
- <Package Folder>/shared_prefs/everytime.xml.bak
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/tuijian.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/user_config_0.xml
- <Package Folder>/shared_prefs/z.xml
- <SD-Card>/Android/####/0.BCP
- <SD-Card>/Android/####/1.BCP
- <SD-Card>/Android/####/2.BCP
- <SD-Card>/Android/####/3.BCP
- <SD-Card>/Android/####/4.BCP
- <SD-Card>/Android/####/5.BCP
- <SD-Card>/Android/####/contents_401178945.db-journal
- <SD-Card>/Download/####/5.0ter.jar
- <SD-Card>/dt/restime.dat
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- bspatch
- libjiagu
Uses the following algorithms to encrypt data:
- AES-CBC-NoPadding
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
