Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.3394
- Android.DownLoader.635.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.a####.cn:8010
- TCP(HTTP/1.1) a.appj####.com:80
- TCP(HTTP/1.1) downloa####.pan####.net.####.com:80
- TCP(HTTP/1.1) www.s####.net:80
DNS requests:
- a.appj####.com
- downloa####.pan####.net
- www.a####.cn
- www.s####.net
HTTP GET requests:
- downloa####.pan####.net.####.com/resource/tempapp/softTest.apk
- www.a####.cn:8010/bookmng/m/book/getImage?id=####
- www.a####.cn:8010/bookmng/m/book/list?s=####&c=####
- www.a####.cn:8010/resource/1427943809999328.mp3
- www.a####.cn:8010/resource/1427944873186101.mp3
- www.a####.cn:8010/resource/1428373297415989.mp3
HTTP POST requests:
- a.appj####.com/ad-service/ad/mark
- www.s####.net/Mini/niouy.action?key=####
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_ix/<Package>.apk
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/shared_prefs/FairyTales.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/qihoo_jiagu_crash_report.xml
- <SD-Card>/Android/####/06bc33f3f18caba7b1052e8c452cc872.0
- <SD-Card>/Android/####/3ef02f97c9a8b1a557e1df6a2935bd37.0
- <SD-Card>/Android/####/4733cf31ef7a6b7f081f90a90c099f99.0
- <SD-Card>/Android/####/611cbd09d87ddb24cca6d5db54a67052.0
- <SD-Card>/Android/####/8e4a0b530d526f512e347688ac36d29a.0
- <SD-Card>/Android/####/c2b8a3a7b68660701bc56b29397df314.0
- <SD-Card>/Android/####/c31be815ef3b4a6e8104cf166f8809e9.0
- <SD-Card>/Android/####/d91912c50ee4ac33c6b2b2c98895da93.0
- <SD-Card>/Android/####/f9dc1cf62eb735868a2ec82025cf4e34.0
- <SD-Card>/Android/####/fcd43b5144bc622d84f94e2f1f7e0f84.0
- <SD-Card>/Android/####/journal
- <SD-Card>/Android/####/journal.tmp
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- libjiagu
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
