Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Internet:
- Android.Xiny.20
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) img.cool####.cn:80
- TCP(HTTP/1.1) www.a####.cn:8010
- TCP(HTTP/1.1) c.appj####.com:80
- TCP(HTTP/1.1) r.eli####.cn:80
- TCP(TLS/1.0) 1####.217.17.110:443
DNS requests:
- c.appj####.com
- img.cool####.cn
- r.eli####.cn
- www.a####.cn
HTTP GET requests:
- img.cool####.cn/2011/gou.jar
- www.a####.cn:8010/bookmng/m/book/getImage?id=####
- www.a####.cn:8010/bookmng/m/book/list?s=####&c=####&bkCat=####
- www.a####.cn:8010/resource/1461317319906669.mp3
HTTP POST requests:
- c.appj####.com/ad/splash/stats.html
- r.eli####.cn/k1?requestId=####&g=####&ua=####
- r.eli####.cn/k2?protocol=####&version=####&cid=####
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/FairyTales.xml
- /data/data/####/W_Key.xml
- /data/data/####/a.xml
- /data/data/####/ad_show_time.xml
- /data/data/####/com.zb.kids.pig.story_preferences.xml
- /data/data/####/downloadswc
- /data/data/####/downloadswc-journal
- /data/data/####/jg_app_update_settings_random.xml
- /data/data/####/libjiagu.so
- /data/data/####/st.xml
- /data/data/####/webview.db-journal
- /data/media/####/19f78faf1cda7c78cbb7a9990a9403b8.0
- /data/media/####/2e8a5f83432ada2b90e381f57a2c36b0.0
- /data/media/####/34e26a90fc04a27eed8ac61018461782.0
- /data/media/####/4.8_gou.jar.tmp
- /data/media/####/51a55329d95b368c5acf0b7aa5be94a8.0
- /data/media/####/6e42c33a0446f2ca90bbf75cd4d8f4a1.0
- /data/media/####/a5364873d5bb2f25055da608548e0f7c.0
- /data/media/####/c1d053af8e5418156a88f7578b90e1b9.0
- /data/media/####/c4f9023b421d279225b6e82306c5b89f.0
- /data/media/####/c724d8b4260eb7ba5d2430dc0ce711fc.0
- /data/media/####/e923d44212ce7a63709084201ebd09d5.0
- /data/media/####/journal.tmp
- /data/media/####/restime.dat
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- libjiagu
Uses the following algorithms to encrypt data:
- RSA
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
