Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.20275
Downloads the following detected threats from the Web:
- Android.SmsSend.20275
Network activity:
Connecting to:
- 1####.####.139
- a####.####.com
- afftrac####.com
- ap####.mobi
- bestpho####.mobi
- c####.####.com
- c####.####.net
- cleando####.com
- feedbu####.####.com
- fl####.####.com
- g####.####.com
- gas####.####.com
- gl####.####.com:9090
- m####.####.com
- mobilem####.me
- namet####.com
- pag####.####.com
- rc####.####.com
- t####.####.com
- technol####.org
- u####.com
- u####.com:7079
HTTP GET requests:
- 1####.####.139/dlv/c.php?campid=####&cca=####&ccz=####&pid=####&r=####&s...
- a####.####.com/ajax/libs/jqueryui/1.11.2/jquery-ui.min.js
- afftrac####.com/mnz/v1?placement=####&source=####
- ap####.mobi/red/ed64b776-98df-11e5-91ef-0cc47a44dbaa/?alg=####&clickid=#...
- bestpho####.mobi/?sl=####&data1=####&data2=####&data3=####&data4=####&tr...
- c####.####.com/?a=####&c=####&s1=####&s2=####&s3=####&campid=####&pid=####
- c####.####.com/jquery-1.11.1.min.js
- c####.####.net/iclk/redirect.php?id=####&trafficsourceid=####&trackid=##...
- cleando####.com/
- feedbu####.####.com/javascript/lib/scripts/effects.js
- fl####.####.com/1/associates-ads/1/OP/?cb=####&p=####
- g####.####.com/?utm_term=####&clickverify=####&utm_content=####
- gas####.####.com/track?url=####&attempt=####
- gl####.####.com:9090/app?IsOnlyCp=####&phone=####&offerid=####&affid=###...
- m####.####.com/c/69c5e7f9210e673c?tid=####&trafficsource_id=####&token2=...
- mobilem####.me/r/a591d0ba-6b1b-11e7-a15c-11402b86d5d4/0/
- namet####.com/d/34558576bb5b034b07?sub=####&source=####
- pag####.####.com/pagead/js/r20170712/r20170110/show_ads_impl.js
- rc####.####.com/e/cm?o=####&p=####&l=####&category=####&f=####&linkID=##...
- t####.####.com/ck.php?line_item_id=####&cid=####&site=####&trafficsource...
- technol####.org/wp-content/plugins/theme-junkie-shortcodes/assets/js/jun...
HTTP POST requests:
- u####.com/jsdk/sd.action?b=####&ca=####&ica=####&re=####
- u####.com:7079/jsdk/sd.action?b=####
Modified file system:
Creates the following files:
- <Package Folder>/app_jiagu/####/libwapCore.so
- <Package Folder>/app_jiagu/####/tmp.Pz2101
- <Package Folder>/app_jiagu/a.q.n.201707171942.bin
- <Package Folder>/app_jiagu/x.apk
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/f_000013
- <Package Folder>/cache/####/f_000014
- <Package Folder>/cache/####/f_000015
- <Package Folder>/cache/####/f_000016
- <Package Folder>/cache/####/f_000017
- <Package Folder>/cache/####/f_000018
- <Package Folder>/cache/####/f_000019
- <Package Folder>/cache/####/f_00001a
- <Package Folder>/cache/####/f_00001b
- <Package Folder>/cache/####/f_00001c
- <Package Folder>/cache/####/f_00001d
- <Package Folder>/cache/####/f_00001e
- <Package Folder>/cache/####/f_00001f
- <Package Folder>/cache/####/f_000020
- <Package Folder>/cache/####/f_000021
- <Package Folder>/cache/####/f_000022
- <Package Folder>/cache/####/f_000023
- <Package Folder>/cache/####/f_000024
- <Package Folder>/cache/####/f_000025
- <Package Folder>/cache/####/f_000026
- <Package Folder>/cache/####/f_000027
- <Package Folder>/cache/####/f_000028
- <Package Folder>/cache/####/f_000029
- <Package Folder>/cache/####/f_00002a
- <Package Folder>/cache/####/f_00002b
- <Package Folder>/cache/####/f_00002c
- <Package Folder>/cache/####/f_00002d
- <Package Folder>/cache/####/f_00002e
- <Package Folder>/cache/####/f_00002f
- <Package Folder>/cache/####/f_000030
- <Package Folder>/cache/####/f_000031
- <Package Folder>/cache/####/f_000032
- <Package Folder>/cache/####/f_000033
- <Package Folder>/cache/####/f_000034
- <Package Folder>/cache/####/f_000035
- <Package Folder>/cache/####/f_000036
- <Package Folder>/cache/####/f_000037
- <Package Folder>/cache/####/f_000038
- <Package Folder>/cache/####/f_000039
- <Package Folder>/cache/####/f_00003a
- <Package Folder>/cache/####/f_00003b
- <Package Folder>/cache/####/f_00003c
- <Package Folder>/cache/####/f_00003d
- <Package Folder>/cache/####/f_00003e
- <Package Folder>/cache/####/f_00003f
- <Package Folder>/cache/####/f_000040
- <Package Folder>/cache/####/f_000041
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/shared_prefs/.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
Miscellaneous:
Executes next shell scripts:
- <dexopt>
