Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) ebf3ee5####.bug####.com:443
DNS requests:
- ebf3ee5####.bug####.com
File system changes:
Creates the following files:
- /data/data/####/e64f08a45a76b4eea5d0bb491f9bf1c0.0.tmp
- /data/data/####/e64f08a45a76b4eea5d0bb491f9bf1c0.1.tmp
- /data/data/####/jg_so_upgrade_setting.xml
- /data/data/####/journal.tmp
- /data/data/####/libjiagu.so
- /data/data/####/multidex.version.xml
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- logcat -v time -t 500 2287
- logcat -v time -t 500 2325
- logcat -v time -t 500 2359
- logcat -v time -t 500 2395
- logcat -v time -t 500 2438
- logcat -v time -t 500 2472
- logcat -v time -t 500 2519
- logcat -v time -t 500 2553
- logcat -v time -t 500 2587
- logcat -v time -t 500 2631
- logcat -v time -t 500 2665
- logcat -v time -t 500 2699
- logcat -v time -t 500 2744
- logcat -v time -t 500 2778
- logcat -v time -t 500 2812
- logcat -v time -t 500 2857
- logcat -v time -t 500 2891
- logcat -v time -t 500 2925
- logcat -v time -t 500 2969
- logcat -v time -t 500 3003
- logcat -v time -t 500 3037
- logcat -v time -t 500 3081
- logcat -v time -t 500 3115
- logcat -v time -t 500 3149
- logcat -v time -t 500 3193
- logcat -v time -t 500 3227
- logcat -v time -t 500 3261
- logcat -v time -t 500 3305
- logcat -v time -t 500 3339
- logcat -v time -t 500 3384
- logcat -v time -t 500 3428
- logcat -v time -t 500 3462
- logcat -v time -t 500 3496
- logcat -v time -t 500 3545
- logcat -v time -t 500 3579
- logcat -v time -t 500 3613
- logcat -v time -t 500 3657
- logcat -v time -t 500 3691
- logcat -v time -t 500 3725
- logcat -v time -t 500 3769
- logcat -v time -t 500 3803
- logcat -v time -t 500 3837
- logcat -v time -t 500 3882
- logcat -v time -t 500 3916
- logcat -v time -t 500 3950
- logcat -v time -t 500 3994
- logcat -v time -t 500 4028
- logcat -v time -t 500 4062
- logcat -v time -t 500 4106
Loads the following dynamic libraries:
- Bugtags
- LanSongffmpeg
- libjiagu
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
