Android.Packed.20896

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Xiny.1.origin

Network activity:

Connecting to:

t####.nl
teleg####.nl
1####.####.110
tmgonli####.nl
ce####.####.org
con####.####.nl
w####.####.com
cloudfr####.####.com
a####.####.nl
api-ce####.####.org
b####.####.com
u####.####.com
teleg####.####.nl
google-####.com
p####.####.com
m####.####.com
st####.####.com
pag####.####.com
im####.####.com
c6ba1cd####.####.com
c####.####.org
m####.####.nl
gst####.com
1####.####.110:8012
h####.com
s####.####.net
a####.####.com
t####.####.com
a183522####.####.net
c####.####.net
imgs####.####.nl
c####.####.com
d####.####.com
e####.####.com
au####.####.top
j####.####.net
t####.####.nl
e####.####.com:8088

HTTP GET requests:

tmgonli####.nl/blur/telegraaf.nl.css
b####.####.com/p2?c1=####&c2=####&nb_01=####&nb_02=####&nb_11=####&nb_12...
h####.com/js/bundles/partner-article.js?squizard?bust=####
u####.####.com/sync?prtid=####&id=####&google_gid=####&google_cver=####
t####.####.nl/static/build/site_1489061730.min.css
m####.####.nl/static/img/icon-share.png
con####.####.nl/img/account=Kx1PKc/item=gQBJd8LTqo01/thumbid=6/image.jpg
google-####.com/r/__utm.gif?utmwv=####&utms=####&utmn=####&utmhn=####&ut...
imgs####.####.nl/v1/8Rsr6s12eZoJgPKC09TNaZY_b0E=/80x80/smart/filters:for...
con####.####.nl/img/account=Kx1PKc/item=WyAJTa7D0wUV/thumbid=2/image.jpg
imgs####.####.nl/v1/9ca3zxR9ZmmSg0PYKDi5C0KSM90=/80x80/smart/filters:for...
au####.####.top/api/push/getpushcfg2.json?push_ver=####&commonk####
imgs####.####.nl/v1/AXT89KUEtRpAt4_AdG4p2wjNTEE=/80x80/smart/filters:for...
google-####.com/ga.js
c####.####.org/2017-04-07/06205956992c7c1998f3798b8f329a0e.jpg!240
h####.com/article/58e7098b66f6003903b7e796?view=####
a183522####.####.net/test.png
c####.####.org/2017-04-11/6aa0d4e2b20f98ae7985f8d02edfdab1.jpg
s####.####.net/instream/video/client.js
t####.####.nl/static/img/placeholder.png
ce####.####.org/v3/system/countrys.json
gst####.com/cv/js/sender/v1/cast_sender.js
im####.####.com/js/sdkloader/ima3.js
au####.####.top/api/push/getsilentpushcfg2.json?push_ver=####&commonk####
google-####.com/analytics.js
h####.com/content?url=####
imgs####.####.nl/v1/dZ30vICZ5nI2sbqZ3y3flRTTV8k=/80x80/smart/filters:for...
teleg####.####.nl/graphics/videopage/play.7589f1ea03bd084740cdd5cc00f56e...
con####.####.nl/img/account=Kx1PKc/item=bQJIjIdBkoUx/thumbid=19/image.jpg
h####.com/css/fonts/roboto-v15-latin-regular.ttf
h####.com/js/bundles/cookies.js
u####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=...
w####.####.com/6ed84a8b77cf.js?lv=####
c####.####.net/pixel?google_nid=####&googl####&id=####
con####.####.nl/img/account=Kx1PKc/item=kZQAd47D7Vc1/thumbid=2/image.jpg
au####.####.top/api/push/getswitcher?commonk####
teleg####.####.nl/javascript/analyticsfunctions.7f145f3298ebd5bb16896b24...
c####.####.com/js/2759701342.js
m####.####.nl/hls/account=Kx1PKc/item=kZQAd47D7Vc1/AwZAVotTphwx-EQQAUo_B...
c6ba1cd####.####.com/58e7098b66f6003903b7e796_500x333.jpg
c####.####.org/v2/system/languages.json
tmgonli####.nl/cc1492592633381.js
api-ce####.####.org/v3/commentlist-46765833-ca2f3ad288fe07cc67dbf8deae0f...
teleg####.####.nl/css/main.17568297e1f650be1bb3c7f8d055130e.css
con####.####.nl/embed/account=Kx1PKc/player=QoRMw6uC0x01/item=kZQAd47D7V...
c####.####.net/ctjs/controltag.js.714934d71ca8a8cd8c474d2f7d4608ec
imgs####.####.nl/v1/BSgql4rBehdLmvl79HYnCh5uhnE=/80x80/smart/filters:for...
c####.####.net/pixel?google_nid=####&google_cm=####&id=####&google_tc=####
cloudfr####.####.com/x.png
im####.####.com/js/core/bridge3.166.0_en.html
h####.com/css/fonts/roboto-v15-latin-500.ttf
c####.####.net/controltag?confid=####
1####.####.110:8012/m/umeng:58f4869476661364f500034f/600/AqK23THlO6H2yG7...
con####.####.nl/player/js/streamone-player-v2.adblock-detect.min.js
m####.####.nl/static/img/whatsapp-share-button.png
con####.####.nl/playlist/account=Kx1PKc/item=kZQAd47D7Vc1/player=QoRMw6u...
u####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&n...
teleg####.####.nl/data/files/css/css_d756fdcc4702a1af90653fabc4386324.css
con####.####.nl/player/plugins/dist/tmg-analytics/tmg-analytics.min.js
teleg####.####.nl/tv/nieuws/buitenland/28038911/__Man_maakt_megaduik_voo...
p####.####.com/sync/img?redir=####
st####.####.com/async/c8ba1b9de1a55b69829e5f72/PLISTA.js
a####.####.nl/dot.gif?item=####&ts=####&progress=####&il=####&event=####...
t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.1.js?utv=####
con####.####.nl/img/account=Kx1PKc/item=1qAIW6pD5k4R/thumbid=2/image.jpg
st####.####.com/c/hotjar-27367.js?sv=####
t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.8.js?utv=####
a####.####.com/2017/03/16/162833859.so
m####.####.nl/static/img/abonnementen.png
a####.####.com/2017/03/16/162908592.dat
u####.####.com/usr?v=####&acc=####&upd=####&new=####&wst=####
tmgonli####.nl/consent/consent/?return=####&clienttime=####&version=####...
h####.com/js/jquery.js
teleg####.####.nl/javascript/jquery-1.11e0a4effa969b585c6a296a6545cf23.8...
c####.####.org/2017-04-07/191d1a00e7dd0de1eaab0bdce8773ee9.jpg!240
c####.####.org/2017-04-07/2829fef9a233d1f82cd9db4a8496dcbc.jpg!240
t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.js
teleg####.####.nl/javascript/jquery/jquery.3291194034b434bb51afaa5aabd23...
1####.####.110/m/umeng:58f4869476661364f500034f/600/AqK23THlO6H2yG70B9Lf...
tmgonli####.nl/consent/img/pressed.png
con####.####.nl/img/account=Kx1PKc/item=wgBJdc7D9VUx/thumbid=2/image.jpg
c####.####.org/v2/content/list-0-0-0-NL-1-0-1.json?1492592####
c####.####.org/2017-04-07/4e6c470b403e19e0b41cc8aa09d273e6.jpg!240
c####.####.org/v2/content/article1-46765833-ca2f3ad288fe07cc67dbf8deae0f...
teleg####.####.nl/static/gerichtonline/bpreview.13ece81274f2222c471795aa...
ce####.####.org/v3/system/initcountrytopic.json
con####.####.nl/img/account=Kx1PKc/item=XpQBRq7D8cUV/thumbid=2/image.jpg
teleg####.####.nl//
imgs####.####.nl/v1/fr90XoBak9br9eV3pfnLybZ22nc=/80x80/smart/filters:for...
t####.####.com/tm42098.js
m####.####.nl/hls/account=Kx1PKc/item=kZQAd47D7Vc1/kZQAd47D7Vc1.m3u8
t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.5.js?utv=####
imgs####.####.nl/v1/YpJ32bgNYGgxTPlXPrYlWSqyBMo=/80x80/smart/filters:for...
teleg####.####.nl/graphics/videopage/play25.474a26e5402cfd0d640965345065...
con####.####.nl/player/js/lang/all-languages.js
imgs####.####.nl/v1/rXa3VYowYibdDptypUw7S1vVsfw=/80x80/smart/filters:for...
imgs####.####.nl/v1/SPNdzvqWRaOh1RCv7AwLcRfsFVk=/80x80/smart/filters:for...
c####.####.org/v2/system/startimg-NL.json
tmgonli####.nl/consent/img/not_pressed.png
t####.####.com/req?v=####&upd=####&new=####&id=####&acc=####&tit=####
teleg####.####.nl/javascript/new/sticky-widget.486e830c26a47dda60094744a...
a####.####.com/ajax/libs/jquery/1.8.2/jquery.min.js
teleg####.####.nl/javascript/consentWrapper.473cf9b5cbf5671e57fa7a424723...
t####.####.nl/static/build/app.2fc85aff6ebb99a0ac57c2bc7d8b89e5.js
pag####.####.com/pagead/js/adsbygoogle.js
d####.####.com/deploy/js_visitor_settings.php?v=####&a=####&url=####&ran...
au####.####.top/i?app_key=####&timestamp=####&sdk_version=####&begin_ses...
c####.####.org/2017-04-07/753c1913748d9757d9dc0ed576919836.jpg!240
tmgonli####.nl/consent/script/consent.js
c####.####.org/2017-04-07/1cb71f9632d61311e32d0e3eadb56699.jpg!240
teleg####.####.nl/javascript/tg-search.370200d6eb28e931de24c8f22da433a.js
tmgonli####.nl/blur/telegraaf.nl.js
a####.####.com/2017/03/16/16291628.dex
tmgonli####.nl/blur/telegraaf.nl.logo.png
c####.####.org/2017-04-07/e22bf6793c5a89c7185a93ee5d1688b6.jpg!240
t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.sync.js
p####.####.com/sync/img?redir=####&mm####&mm####
teleg####.####.nl/css/siteColors.5c46a3e419ee4eb7ccf8a00dd7aa9652.css
a####.####.com/2017/03/16/162928889.so
j####.####.net/gateway/gw.js?csid=####&auto=####
ce####.####.org/v2/content/recommend-ca2f3ad288fe07cc67dbf8deae0f1ac2-NL...
api-ce####.####.org/v2/content/getItemDetails-46765833.json
teleg####.####.nl/data/files/js/js_68deeb279453631cef643d2060c701ae.js
c####.####.org/v2/system/models-113.json
con####.####.nl/img/account=Kx1PKc/item=iRYAXMPBiRQ1/thumbid=2/image.jpg
c####.####.org/v2/system/version-1-113.json
teleg####.####.nl/javascript/ads/showads.75977793993735b23353a9c8fa0a76e...
d####.####.com/v.gif?a=####&d=####&u=####&h=####&r=####
st####.####.com/async.js
t####.####.nl/static/build/site_article_87251f30adaf.min.js
teleg####.####.nl/javascript/all-scripts.7c05874763404c80cde78fa37fbc375...
con####.####.nl/img/account=Kx1PKc/item=UqIAUqLTsoUR/thumbid=2/image.jpg
t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.20.js?utv=####
t####.####.com/utag/tmggroup/telegraaf-web/prod/utag.sync.js
con####.####.nl/img/account=Kx1PKc/item=ZABJq8JR0kc1/thumbid=19/image.jpg
t####.####.nl/static/build/site_759acf5a9278.min.js
t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.14.js?utv=####
teleg####.####.nl/javascript/store.522208ff3eab3e86c018e7e9956887bc.min.js
con####.####.nl/img/account=Kx1PKc/item=YgJImKpT9kcx/thumbid=2/image.jpg
tmgonli####.nl/blur/telegraaf.nl.jpg
c####.####.org/2017-04-07/4382b60753a80f6d3fb25f14ab04de59.jpg!240
imgs####.####.nl/v1/7YTQhBflgWEwX_VFfz2ITlLQH1I=/80x80/smart/filters:for...
h####.com/css/partner-article.css?bust=####
a####.####.com/2017/03/16/162846737.so
teleg####.####.nl/javascript/new/common.23176cb1df0ca0bc60b460083c9ceb2.js
m####.####.nl/tv/nieuws/buitenland/article/28038911/man-maakt-megaduik-v...
j####.####.net/gateway/gw.js?csid=####
con####.####.nl/img/account=Kx1PKc/item=h5BJfIrBxV0V/thumbid=21/image.jpg
m####.####.nl/static/img/nixel.gif
con####.####.nl/img/account=Kx1PKc/item=1zAAZaZD89QV/thumbid=2/image.jpg
t####.nl/nl/privacy
con####.####.nl/player/skin/default/streamone.css
b####.####.com/p?c1=####&c2=####&nb_01=####&nb_02=####&nb_11=####&nb_12=...
t####.####.com/utag/tiqapp/utag.v.js?a=####&cb=####
teleg####.nl//
t####.####.com/utag/tmggroup/telegraaf-mobile/prod/utag.26.js?utv=####

HTTP POST requests:

au####.####.top/android_md_log/req?commonk####
e####.####.com/ping
a####.####.com/ad-service/ad/mark
e####.####.com:8088/sdk/api/ad/hull
ce####.####.org/auth/gather
au####.####.top/android/check_version?commonk####
au####.####.top/api/push/getsilentpush.json?push_ver=####&time=####&comm...
au####.####.top/api/push/getpush?id=####&push_ver=####&time=####&commonk...
e####.####.com/sdk/api/log/record
a####.####.com/app_logs
e####.####.com/sdk/api/regclient
m####.####.com/v2/register

Modified file system:

Creates the following files:

/data/data/####/cache/webviewCacheChromium/f_00002d
/data/data/####/cache/webviewCacheChromium/f_00002c
/data/data/####/cache/webviewCacheChromium/f_00002b
/data/data/####/cache/webviewCacheChromium/f_00002a
/sdcard/Android/data/####/files/logdata/delay_20170419090341482_ca2f3ad288fe07cc67dbf8deae0f1ac2_b.dat
/data/data/####/shared_prefs/AGOO_HOST.xml
/sdcard/AuthP/push_stat.dat
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/databases/MsgLogStore.db-journal
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/sdcard/Android/data/####/cache/uil-images/2yusinm2rkywdc11qxg0n4lup.0.tmp
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/files/AppEventsLogger.persistedevents
/data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml.bak
/sdcard/Android/data/####/cache/uil-images/7bm49evedwkg5wrg69xpl4qsi.0.tmp
/data/data/####/shared_prefs/jg_app_update_settings_random.xml
/data/data/####/shared_prefs/umeng_general_config.xml
/sdcard/Android/data/####/cache/uil-images/71kwxwrfi7100dwjfthap1597.0
/data/data/####/files/.umeng/exchangeIdentity.json
/data/data/####/cache/webviewCacheChromium/f_000029
/data/data/####/files/lookDL/dlLookCore1770078170.tmp
/data/data/####/shared_prefs/AppStore.xml.bak
/data/data/####/shared_prefs/configLookPath.xml
/data/data/####/shared_prefs/multidex.version.xml
/data/data/####/databases/google_app_measurement_local.db-journal
/data/data/####/shared_prefs/CurArticleInfo.xml
/sdcard/.DataStorage/ContextData.xml
/data/data/####/databases/webview.db-journal
/data/data/####/cache/webviewCacheChromium/f_000026
/sdcard/AuthPush/hstype.txt
/data/data/####/cache/webviewCacheChromium/f_000024
/data/data/####/files/lookDL/dlLookCore417665194.tmp
/data/data/####/cache/webviewCacheChromium/f_000022
/data/data/####/cache/webviewCacheChromium/f_000021
/data/data/####/cache/webviewCacheChromium/f_000020
/data/data/####/shared_prefs/PhoneUtil.xml
/data/data/####/cache/webviewCacheChromium/f_000028
/data/data/####/app_jgls/.log.ls
/data/data/####/shared_prefs/Alvin2.xml
/data/data/####/shared_prefs/ContextData.xml
/data/data/####/shared_prefs/COUNTLY_STORE.xml
/data/data/####/shared_prefs/com.google.android.gms.appid.xml
/data/data/####/shared_prefs/com.facebook.sdk.attributionTracking.xml
/data/data/####/cache/webviewCacheChromium/index
/sdcard/####/WelcomeImg/6aa0d4e2b20f98ae7985f8d02edfdab1.jpg
/data/data/####/shared_prefs/AGOO_CONNECT.xml
/data/data/####/files/lookDL/com.look.dlplugin.apk941372805.tmp
/data/data/####/cache/webviewCacheChromium/f_00000c
/data/data/####/cache/webviewCacheChromium/f_00000b
/data/data/####/cache/webviewCacheChromium/f_00000e
/data/data/####/cache/webviewCacheChromium/f_00000d
/data/data/####/cache/webviewCacheChromium/f_00000f
/data/data/####/files/lookDL/dlLookPlugin.dat-737537985.tmp
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/shared_prefs/com.facebook.internal.preferences.APP_SETTINGS.xml
/sdcard/AuthP/push_look.lck
/data/data/####/files/.yflurryfreqcap.-7e7d107f3f6099fc
/data/data/####/databases/snowfoxad_msg.db-journal
/sdcard/AuthP/push_config.dat
/data/data/####/shared_prefs/Prophet.xml
/data/data/####/dex_cache/MultiDex.lock
/data/data/####/files/lookDL/dlLookPlugin.dat-2119561148.tmp
/data/data/####/shared_prefs/umeng_message_state.xml
/sdcard/Android/data/####/.snowfoxmsg/imei.txt
/data/data/####/shared_prefs/Game_recommend.xml.bak
/data/data/####/no_backup/com.google.android.gms.appid-no-backup
/data/data/####/databases/Zuoyoo_db
/sdcard/.UTSystemConfig/Global/Alvin2.xml
/data/data/####/files/.yflurrydatasenderblock.89786b30-df74-4436-8f84-609634d82ab4
/data/data/####/cache/webviewCacheChromium/f_000009
/data/data/####/cache/webviewCacheChromium/f_000008
/data/data/####/files/.yflurryadlog.-7e7d107f3f6099fc
/sdcard/Android/data/####/.snowfoxmsg/dev_c1335652.txt
/data/data/####/cache/webviewCacheChromium/f_000001
/data/data/####/cache/webviewCacheChromium/f_000003
/data/data/####/cache/webviewCacheChromium/f_000002
/data/data/####/cache/webviewCacheChromium/f_000005
/data/data/####/cache/webviewCacheChromium/f_000004
/data/data/####/cache/webviewCacheChromium/f_000007
/data/data/####/cache/webviewCacheChromium/f_000006
/data/data/####/files/umeng_it.cache
/sdcard/Android/data/####/cache/.nomedia
/data/data/####/files/.jglogs/.jg.ic
/data/data/####/databases/push_look.db
/data/data/####/databases/google_app_measurement_local.db
/data/data/####/databases/snowfoxad_msg.db
/data/data/####/shared_prefs/v2_local_login.xml
/data/data/####/shared_prefs/openudid_prefs.xml
/data/data/####/shared_prefs/BSModelForPlaced.xml
/data/data/####/databases/db_snowfox.db
/data/data/####/.jiagu/libjiagu.so
/data/data/####/shared_prefs/MASTER_DATA.xml
/data/data/####/cache/webviewCacheChromium/f_000027
/sdcard/Android/data/####/cache/uil-images/37way6sghmg4qdb8n1u9aeax2.0.tmp
/data/data/####/databases/db_snowfox.db-journal
/data/data/####/databases/UmengLocalNotificationStore.db-journal
/data/data/####/cache/webviewCacheChromium/f_000018
/data/data/####/cache/webviewCacheChromium/f_000019
/data/data/####/cache/webviewCacheChromium/f_000016
/data/data/####/cache/webviewCacheChromium/f_000017
/data/data/####/cache/webviewCacheChromium/f_000014
/data/data/####/cache/webviewCacheChromium/f_000015
/data/data/####/cache/webviewCacheChromium/f_000012
/data/data/####/cache/webviewCacheChromium/f_000013
/data/data/####/cache/webviewCacheChromium/f_000010
/data/data/####/cache/webviewCacheChromium/f_000011
/sdcard/Android/data/.nomedia
/data/data/####/files/lookDL/base21770078170.tmp
/data/data/####/shared_prefs/WebViewSettings.xml
/data/data/####/shared_prefs/AppStore.xml
/data/data/####/cache/webviewCacheChromium/f_00000a
/data/data/####/shared_prefs/coolook.minisite.xml
/data/data/####/databases/Zuoyoo_db-journal
/data/data/####/files/.yflurryreport.-7e7d107f3f6099fc
/data/data/####/dex_cache/base2-226268746.zip
/data/data/####/files/mesosphere.so
/sdcard/Android/data/####/files/logdata/delay_20170419090348217_ca2f3ad288fe07cc67dbf8deae0f1ac2_s.dat
/data/data/####/cache/webviewCacheChromium/f_00001f
/data/data/####/cache/webviewCacheChromium/f_00001d
/data/data/####/cache/webviewCacheChromium/f_00001e
/data/data/####/cache/webviewCacheChromium/f_00001b
/data/data/####/cache/webviewCacheChromium/f_00001c
/data/data/####/app_jgls/.log.lock
/data/data/####/cache/webviewCacheChromium/f_00001a
/data/data/####/shared_prefs/updateVer.xml
/data/data/####/databases/push_look.db-journal
/data/data/####/shared_prefs/Module_Switch_DATA.xml.bak
/data/data/####/shared_prefs/test.xml
/data/data/####/shared_prefs/com.facebook.sdk.appEventPreferences.xml
/sdcard/Android/data/####/cache/uil-images/5lxhyicy8khrucm0n4s3z5fn9.0.tmp
/data/data/####/shared_prefs/sp_cache.xml
/data/data/####/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
/data/data/####/files/.YFlurrySenderIndex.info.AnalyticsMain
/data/data/####/files/DaemonServer
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/shared_prefs/CountryRelevant.xml
/data/data/####/files/lib.dat
/sdcard/AuthP/push_silentcfg.dat
/data/data/####/shared_prefs/snowfoxprf.xml
/data/data/####/shared_prefs/Module_Switch_DATA.xml
/data/data/####/files/####.dat
/data/data/####/shared_prefs/GATHER.xml.bak
/data/data/####/shared_prefs/pushdatas.xml
/data/data/####/files/.imprint
/sdcard/Android/data/####/files/logdata/delay_20170419090344156_ca2f3ad288fe07cc67dbf8deae0f1ac2_s.dat
/data/data/####/files/####.so
/sdcard/AuthP/silence.dat
/sdcard/Android/data/####/cache/uil-images/6iesspr5711axr89uipkspnu1.0.tmp
/data/data/####/files/mesosphere.jar
/data/data/####/files/snowfox_v18.jar
/sdcard/Android/data/####/files/logdata/delay_20170419090339270_ca2f3ad288fe07cc67dbf8deae0f1ac2_s.dat
/data/data/####/files/agoo.pid
/data/data/####/shared_prefs/Game_recommend.xml
/data/data/####/shared_prefs/com.google.android.gms.measurement.prefs.xml
/data/data/####/files/.YFlurrySenderIndex.info.AnalyticsData_GT2ZQM5CR69QZ4TXHSY4_216
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/data/data/####/files/snowfox_v18.so
/data/data/####/cache/webviewCacheChromium/f_000025
/data/data/####/files/####.dex
/data/data/####/app_cache/ApplicationCache.db-journal
/sdcard/Android/data/####/cache/uil-images/journal.tmp
/sdcard/Android/data/####/cache/uil-images/3w1nciday7eocv14qexy2zcqf.0.tmp
/data/data/####/files/lookDL/dlLookCore.dat-669513770.tmp
/data/data/####/shared_prefs/GATHER.xml
/data/data/####/cache/webviewCacheChromium/f_000023
/sdcard/Android/data/####/files/logdata/delay_20170419090348431_ca2f3ad288fe07cc67dbf8deae0f1ac2_s.dat
/sdcard/Android/data/####/cache/uil-images/7e2r4c4cilxkb58gnecubo2ml.0.tmp

Sets the 'executable' attribute to the following files:

/data/data/####/files/DaemonServer

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
sh
chmod 755 /data/data/####/.jiagu/libjiagu.so

Uses special library to hide executable bytecode.

Contains functionality to send SMS messages automatically.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial