Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.670.origin
File system changes:
Creates the following files:
- /data/anr/traces.txt
- /data/data/####/20180808
- /data/data/####/20180816.lock
- /data/data/####/bmob_provider.db
- /data/data/####/bmob_provider.db-journal
- /data/data/####/libjiagu-1227414294.so
- /data/data/####/p2d.lock
- /data/data/####/qihoo_jiagu_crash_report.xml
- /data/data/####/tray.db-journal
Miscellaneous:
Executes the following shell scripts:
- su
Loads the following dynamic libraries:
- bmob
- libjiagu-1227414294
Uses elevated priveleges.
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
