Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.3394
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.s####.net:80
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) 2####.58.212.238:443
- TCP(TLS/1.0) d####.fl####.com:443
- TCP(TLS/1.0) www.ri####.com:443
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) api.t####.co:443
DNS requests:
- api.t####.co
- d####.fl####.com
- downloa####.pan####.net
- g####.face####.com
- sett####.crashly####.com
- www.ri####.com
- www.s####.net
HTTP POST requests:
- www.s####.net/Mini/niouy.action?key=####
File system changes:
Creates the following files:
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_CHCJF96N...33_195
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/.jg.ic
- /data/data/####/.log.lock
- /data/data/####/.log.ls
- /data/data/####/.yflurrydatasenderblock.175b4143-cf7e-455a-a15f...93d5cd
- /data/data/####/.yflurrydatasenderblock.30b835b7-e174-4929-b7a7...f4bd8a
- /data/data/####/.yflurrydatasenderblock.b01e13bc-a32c-4d07-9b29...ce60cb
- /data/data/####/.yflurryreport.152ce5c4e42c3bc2
- /data/data/####/32874c86d93491fa66ac4266fff0702d.0.tmp
- /data/data/####/32874c86d93491fa66ac4266fff0702d.1.tmp
- /data/data/####/5C3F765E0192-0001-08EC-1CC9A2623A61BeginSession.cls_temp
- /data/data/####/5C3F765E0192-0001-08EC-1CC9A2623A61SessionApp.cls_temp
- /data/data/####/5C3F765E0192-0001-08EC-1CC9A2623A61SessionDevice.cls_temp
- /data/data/####/5C3F765E0192-0001-08EC-1CC9A2623A61SessionOS.cls_temp
- /data/data/####/60cf5b21e3eebdddc9d0db7165efba8d.0.tmp
- /data/data/####/60cf5b21e3eebdddc9d0db7165efba8d.1.tmp
- /data/data/####/AppEventsLogger.persistedevents
- /data/data/####/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/TwitterAdvertisingInfoPreferences.xml
- /data/data/####/b170bfde288facd862b75dd83be35775.0.tmp
- /data/data/####/b170bfde288facd862b75dd83be35775.1.tmp
- /data/data/####/c256159f6c0f3d73dbe23dc40b1fd1ff.0.tmp
- /data/data/####/c256159f6c0f3d73dbe23dc40b1fd1ff.1.tmp
- /data/data/####/com.crashlytics.prefs.xml
- /data/data/####/com.crashlytics.sdk.android;answers;com.crashly...rs.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.appid.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/com.riffsy.ydFBMGIFApp_preferences.xml
- /data/data/####/config.riffsy
- /data/data/####/device_preferences.xml
- /data/data/####/google_app_measurement_local.db
- /data/data/####/google_app_measurement_local.db-journal
- /data/data/####/initialization_marker
- /data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.andr...ng.xml
- /data/data/####/journal.tmp
- /data/data/####/libjiagu.so
- /data/data/####/multidex.version.xml
- /data/data/####/pref.report.xml
- /data/data/####/pref.tracking.xml
- /data/data/####/sa_672b6df4-9e39-45ce-9d49-e9fe973983de_1547662945428.tap
- /data/data/####/session_analytics.tap
- /data/data/####/session_analytics.tap.tmp
Miscellaneous:
Executes the following shell scripts:
- app_process /system/bin com.android.commands.pm.Pm list packages
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- pm list packages
Loads the following dynamic libraries:
- libjiagu
- realm-jni
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
