Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.41.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) c####.x####.com:443
- TCP(TLS/1.0) av1.x####.com:443
DNS requests:
- av1.x####.com
- c####.x####.com
Modified file system:
Creates the following files:
- /data/anr/traces.txt
- /data/data/####/.jg.ic
- /data/data/####/1541603077484_2279
- /data/data/####/1541603077649_2279
- /data/data/####/1541603077829_2279
- /data/data/####/1541603078415_2323
- /data/data/####/1541603079029_2323
- /data/data/####/1541603079692_2365
- /data/data/####/1541603080775_2365
- /data/data/####/1541603080985_2365
- /data/data/####/1541603081152_2365
- /data/data/####/1541603082965_2419
- /data/data/####/1541603084153_2419
- /data/data/####/1541603084958_2458
- /data/data/####/1541603086605_2458
- /data/data/####/1541603087193_2497
- /data/data/####/1541603089395_2497
- /data/data/####/1541603092678_2547
- /data/data/####/1541603094814_2547
- /data/data/####/1541603095369_2586
- /data/data/####/1541603097927_2586
- /data/data/####/1541603098510_2625
- /data/data/####/1541603101271_2625
- /data/data/####/1541603108718_2679
- /data/data/####/1541603112270_2679
- /data/data/####/1541603112834_2718
- /data/data/####/1541603114686_2754
- /data/data/####/1541603119247_2754
- /data/data/####/1541603132306_2811
- /data/data/####/1541603136578_2811
- /data/data/####/1541603137224_2850
- /data/data/####/1541603137398_2850
- /data/data/####/1541603138016_2888
- /data/data/####/Archimedes_p1
- /data/data/####/Archimedes_p2
- /data/data/####/Archimedes_p3
- /data/data/####/Archimedes_p4
- /data/data/####/Archimedes_p5
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/TDpref_cloudcontrol1.xml
- /data/data/####/TDpref_longtime.xml
- /data/data/####/TDpref_longtime0.xml
- /data/data/####/TDpref_shorttime0.xml
- /data/data/####/com.qxin.android.clean_preferences.xml
- /data/data/####/iv
- /data/data/####/libjiagu1116384877.so
- /data/data/####/qihoo_jiagu_crash_report.xml
- /data/data/####/salt
- /data/data/####/tdid.xml
- /data/media/####/.tcookieid
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu1116384877.so
- getprop
Loads the following dynamic libraries:
- libjiagu1116384877
Uses the following algorithms to encrypt data:
- AES
Uses the following algorithms to decrypt data:
- AES
Uses special library to hide executable bytecode.
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, IMEI, etc.).
