Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.254.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) caiyu####.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) cdn.caiyu####.com:80
- TCP(HTTP/1.1) o####.xf####.com:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) o####.xf####.com:1028
- TCP(HTTP/1.1) scs.opensp####.cn:80
- TCP(HTTP/1.1) m.d####.mob.com:80
- TCP(HTTP/1.1) h####.opensp####.cn:80
- TCP(TLS/1.0) 64.2####.161.94:443
- TCP(TLS/1.0) gmscomp####.google####.com:443
- TCP(TLS/1.0) websock####.dual-a-####.a-ms####.net:443
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) cogniti####.regi####.azure####.net:443
- TCP(TLS/1.2) 64.2####.164.138:443
- TCP(TLS/1.2) 1####.177.14.104:443
- TCP(TLS/1.2) 64.2####.161.94:443
- TCP(TLS/1.2) gmscomp####.google####.com:443
- UDP 1####.194.222.138:443
- UDP p####.google####.com:443
DNS requests:
- a####.exc.mob.com
- a####.u####.com
- api.cogni####.micro####.com
- api.s####.mob.com
- caiyu####.com
- cdn.caiyu####.com
- d####.opensp####.cn
- gmscomp####.google####.com
- h####.opensp####.cn
- h####.opensp####.cn
- m.d####.mob.com
- o####.xf####.com
- p####.google####.com
- rr2---s####.g####.com
- scs.opensp####.cn
- websoc####.plat####.b####.com
- www.s####.net
HTTP GET requests:
- caiyu####.com/favicon.ico
- caiyu####.com/js/jquery.min.js
- caiyu####.com/xiaoyi/assets/arrow-down.png
- caiyu####.com/xiaoyi/assets/arrow-right.png
- caiyu####.com/xiaoyi/assets/faq2.jpg
- caiyu####.com/xiaoyi/assets/faq7.png
- caiyu####.com/xiaoyi/assets/faq8.jpg
- caiyu####.com/xiaoyi/help.css
- caiyu####.com/xiaoyi/help.html?lang=####
- caiyu####.com/xiaoyi/help.js
- cdn.caiyu####.com/etc/android_interperter_config.json
- cdn.caiyu####.com/etc/android_interperterapp_config.json
- h####.opensp####.cn/launchconfig?t=####&p=dml0e####
- h####.opensp####.cn/sip/resolver?srand=####
- m.d####.mob.com/v2/cconf?appkey=####&plat=####&apppkg=####&appver=####&n...
- o####.xf####.com/ipcfg.txt
- o####.xf####.com:1028/Ping.txt
HTTP POST requests:
- a####.exc.mob.com/errconf
- a####.u####.com/app_logs
- api.s####.mob.com/conf5
- api.s####.mob.com/conn
- api.s####.mob.com/log4
- api.s####.mob.com/snsconf
- o####.xf####.com/msp.do
- scs.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
- scs.opensp####.cn/scs?cmd=####&logver=####&ver=####&sid=####
File system changes:
Creates the following files:
- /data/data/####/.hptc_kache_gfhggc.activity
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/.lock
- /data/data/####/.mrecord
- /data/data/####/.mrecord (deleted)
- /data/data/####/.mrlock
- /data/data/####/.statistics
- /data/data/####/42c026aeb3a7c112_0
- /data/data/####/57235ee21ff7fdfe_0
- /data/data/####/861a1da31977a5e1_0
- /data/data/####/861a1da31977a5e1_1
- /data/data/####/Cookies-journal
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/b50bb637ca56e15f_0
- /data/data/####/c0ddaf7491490e2c_0
- /data/data/####/c2647b7a6ea9f31f_0
- /data/data/####/c2647b7a6ea9f31f_1
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/classes.dex
- /data/data/####/classes.oat
- /data/data/####/classes2.dex
- /data/data/####/cloud_configuration.xml
- /data/data/####/com.caiyuninterpreter.dhbylhgfhggc.activity.apk
- /data/data/####/com.caiyuninterpreter.dhbylhgfhggc.activity.dex
- /data/data/####/com.caiyuninterpreter.dhbylhgfhggc.activity.dex...leted)
- /data/data/####/com.caiyuninterpreter.dhbylhgfhggc.activity_pre...es.xml
- /data/data/####/com.iflytek.id.xml
- /data/data/####/db77f845789c5e1a_0
- /data/data/####/e161294cd4c30480_0
- /data/data/####/e8c8bfd41185ab8b_0
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/ff0f1666211838b5_0
- /data/data/####/ifly_launch_lib.xml
- /data/data/####/iflytek_state_com.caiyuninterpreter.dhbylhgfhgg...ty.xml
- /data/data/####/index
- /data/data/####/libjiagu.so
- /data/data/####/metrics_guid
- /data/data/####/mob_commons_1.xml
- /data/data/####/mob_sdk_exception_1.xml
- /data/data/####/org.piwik.sdk.xml
- /data/data/####/proc_auxv
- /data/data/####/share_sdk_1.xml
- /data/data/####/sharesdk.db-journal
- /data/data/####/temp-index
- /data/data/####/the-real-index
- /data/data/####/translate.db-journal
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/media/####/.2F6E2C5B63F0F83B
- /data/media/####/.dic_lock
- /data/media/####/.duid
- /data/media/####/.globalLock
- /data/media/####/.pkg_lock
- /data/media/####/.rc_lock
- /data/media/####/iflyworkdir_test (deleted)
- /data/media/####/urec.data
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- cat /sys/class/net/wlan0/address
- chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- libandroid_platform
- libdctd
- libjiagu
- libmsc
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
Uses the following algorithms to decrypt data:
- AES
- AES-CBC-PKCS7Padding
- AES-ECB-NoPadding
Uses special library to hide executable bytecode.
Accesses audio/video recording interfaces.
Records audio/video.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
Requests the system alert window permission.
