Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.440.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 47.1####.167.201:8080
- TCP(HTTP/1.1) api.map.b####.com:80
- TCP(HTTP/1.1) 47.1####.140.194:80
- TCP(HTTP/1.1) q####.a####.com:80
DNS requests:
- api.map.b####.com
- x####.bj####.cn
- z####.bj####.cn
HTTP GET requests:
- api.map.b####.com/geocoder?output=####&location=####&key=####
- q####.a####.com/otherdz/otherdzver.txt
- q####.a####.com/otherdz/zxotherdzrhe75
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/DtdzRhe.xml
- /data/data/####/DtdzRhe_config.xml
- /data/data/####/XZFOtherDz.xml
- /data/data/####/XZFOther_conf.xml
- /data/data/####/config.xml
- /data/data/####/dtdzrhesms.db
- /data/data/####/dtdzrhesms.db-journal
- /data/data/####/libjiagu-743716170.so
- /data/data/####/otherdzdx.db
- /data/data/####/otherdzdx.db-journal
- /data/data/####/otherdzzx.apkdata
- /data/media/####/64af2746313769348877fe3652eaee2c
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu-743716170
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.
Parses information from SMS.
Gets information about sent/received SMS.
