Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.127.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) aserver####.m.ta####.com:443
DNS requests:
- api.leanc####.cn
- api.y####.com
Modified file system:
Creates the following files:
- <Package Folder>/app_btyq/classes.jar
- <Package Folder>/app_plugin/PlayerUIApk.apk
- <Package Folder>/cache/####/16c408d4b3386c6ee713da0d87069f93
- <Package Folder>/cache/####/3deddbca6455c65db741f46c0efb718d
- <Package Folder>/cache/####/40dcb35bb9d2cf888b2d33d33e4d949e
- <Package Folder>/cache/####/4b477bb3dd4739d727b71193b14ed112
- <Package Folder>/cache/####/5c582096c68051ea277c861ae52d9623
- <Package Folder>/cache/####/682701252cc25cba154f2ef3f50aa13c
- <Package Folder>/cache/####/6f6eb8c518889dfc115110e07c5579be
- <Package Folder>/cache/####/79a82c07dc87525cbc5d0539cba86c94
- <Package Folder>/cache/####/805805b21187d2fb8962f57a2bda7c80
- <Package Folder>/cache/####/824e38533ff135e2d212810ab06b5875
- <Package Folder>/cache/####/9ceac6fed5a62d3a4b476ad26208b984
- <Package Folder>/cache/####/a512d2ea9b67217f0d98131709c54463
- <Package Folder>/cache/####/avoscloud-analysis
- <Package Folder>/cache/####/b0a816009ce2a2a86f54efd08a7ea9b1
- <Package Folder>/cache/####/b4b06569f3a0148d1e5037b59639c14c
- <Package Folder>/cache/####/be4f5362e47f6ca3eb2326b2dee390eb
- <Package Folder>/cache/####/c7b06cfd5496a1903d6e64036a8cf179
- <Package Folder>/databases/dbgdbkm-journal
- <Package Folder>/files/installation
- <Package Folder>/files/libjiagu.so
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/AVOSCloud-SDK.xml
- <Package Folder>/shared_prefs/AV_CLOUD_API_VERSION_KEY_ZONE.xml
- <Package Folder>/shared_prefs/AV_PUSH_SERVICE_APP_DATA.xml
- <Package Folder>/shared_prefs/analytics_agent_header_.xml
- <Package Folder>/shared_prefs/com.avos.avoscloud.analysis.xml
- <SD-Card>/Android/####/.nomedia
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/files/libjiagu.so
- dumpsys meminfo 2085
- dumpsys meminfo 2133
- dumpsys meminfo 2178
- dumpsys meminfo 2230
- dumpsys meminfo 2280
- dumpsys meminfo 2325
- dumpsys meminfo 2370
- dumpsys meminfo 2418
- dumpsys meminfo 2465
- dumpsys meminfo 2514
- dumpsys meminfo 2562
- dumpsys meminfo 2610
- dumpsys meminfo 2655
- dumpsys meminfo 2700
- dumpsys meminfo 2801
Loads the following dynamic libraries:
- libjiagu
- luajava
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
