Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.190.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) ssl.google-####.com:443
- TCP(TLS/1.0) sdk.hocke####.net:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
DNS requests:
- a.appj####.com
- googl####.g.doublec####.net
- s.un####.com
- sdk.hocke####.net
- ssl.google-####.com
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/index
- <Package Folder>/cache/ApplicationCache.db-journal
- <Package Folder>/cache/ads2017263207.jar
- <Package Folder>/databases/####/https_googleads.g.doubleclick.n...ournal
- <Package Folder>/databases/google_analytics_v4.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/databases/yazio-db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/gaClientId
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/com.google.android.gms.analytics.prefs.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- libjiagu
- mh
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
