Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.173.origin
File system changes:
Creates the following files:
- /data/data/####/AndGame.Sdk.Lib_20121_A79D0053BE1B56EBDF86C897EB06450A.dat
- /data/data/####/appsdk0_.jar
- /data/data/####/c_data_store.dat
- /data/data/####/d_data_store.dat
- /data/data/####/iridver.dat
- /data/data/####/jiagu.lock
- /data/data/####/libjiagu.so
- /data/data/####/libjiagu_art.so
- /data/media/####/deviceId.txt
Miscellaneous:
Executes the following shell scripts:
- /system/bin/sh
- chmod 755 <Package Folder>/files/libjiagu_art.so
- ls -l /sbin/su
- ls -l /system/bin/su
- ls -l /system/sbin/su
- ls -l /system/xbin/su
- ls -l /vendor/bin/su
Loads the following dynamic libraries:
- libjiagu
- libmegbpp_02.02.12_01
- megjb
Uses the following algorithms to encrypt data:
- DES-ECB-PKCS5Padding
Uses the following algorithms to decrypt data:
- RSA-ECB-PKCS1Padding
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
