Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) ebf3ee5####.bug####.com:443
DNS requests:
- ebf3ee5####.bug####.com
File system changes:
Creates the following files:
- /data/data/####/e64f08a45a76b4eea5d0bb491f9bf1c0.0.tmp
- /data/data/####/e64f08a45a76b4eea5d0bb491f9bf1c0.1.tmp
- /data/data/####/jg_so_upgrade_setting.xml
- /data/data/####/journal.tmp
- /data/data/####/libjiagu.so
- /data/data/####/multidex.version.xml
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- logcat -v time -t 500 2290
- logcat -v time -t 500 2327
- logcat -v time -t 500 2361
- logcat -v time -t 500 2405
- logcat -v time -t 500 2439
- logcat -v time -t 500 2473
- logcat -v time -t 500 2518
- logcat -v time -t 500 2552
- logcat -v time -t 500 2587
- logcat -v time -t 500 2631
- logcat -v time -t 500 2665
- logcat -v time -t 500 2699
- logcat -v time -t 500 2743
- logcat -v time -t 500 2777
- logcat -v time -t 500 2811
- logcat -v time -t 500 2855
- logcat -v time -t 500 2889
- logcat -v time -t 500 2923
- logcat -v time -t 500 2967
- logcat -v time -t 500 3001
- logcat -v time -t 500 3035
- logcat -v time -t 500 3079
- logcat -v time -t 500 3113
- logcat -v time -t 500 3147
- logcat -v time -t 500 3191
- logcat -v time -t 500 3225
- logcat -v time -t 500 3259
- logcat -v time -t 500 3303
- logcat -v time -t 500 3337
- logcat -v time -t 500 3371
- logcat -v time -t 500 3415
- logcat -v time -t 500 3449
- logcat -v time -t 500 3483
- logcat -v time -t 500 3527
- logcat -v time -t 500 3561
- logcat -v time -t 500 3595
- logcat -v time -t 500 3639
- logcat -v time -t 500 3673
- logcat -v time -t 500 3707
- logcat -v time -t 500 3741
- logcat -v time -t 500 3775
- logcat -v time -t 500 3809
- logcat -v time -t 500 3854
- logcat -v time -t 500 3888
- logcat -v time -t 500 3922
- logcat -v time -t 500 3956
- logcat -v time -t 500 3990
- logcat -v time -t 500 4024
- logcat -v time -t 500 4068
- logcat -v time -t 500 4102
- logcat -v time -t 500 4136
- logcat -v time -t 500 4180
- logcat -v time -t 500 4214
- logcat -v time -t 500 4248
- logcat -v time -t 500 4329
Loads the following dynamic libraries:
- Bugtags
- LanSongffmpeg
- libjiagu
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
