Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.2083
- Android.DownLoader.546.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) api.running####.cn:80
- TCP(HTTP/1.1) wild####.q####.cn.####.net:80
- TCP(HTTP/1.1) a.appj####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(TLS/1.0) mp.we####.qq.com:443
- TCP(TLS/1.0) s####.tc.qq.com:443
DNS requests:
- 7x####.c####.z0.####.com
- a.appj####.com
- api.running####.cn
- m####.q####.cn
- mp.we####.qq.com
- r####.wx.qq.com
HTTP GET requests:
- api.running####.cn/app/activities
- api.running####.cn/playlist_group/featured
- api.running####.cn/playlist_group/running
- api.running####.cn/user/favorites_music
- t####.c####.q####.####.com/0.png
- t####.c####.q####.####.com/10.png
- t####.c####.q####.####.com/12.png
- t####.c####.q####.####.com/13.png
- t####.c####.q####.####.com/14.png
- t####.c####.q####.####.com/15.png
- t####.c####.q####.####.com/16.png
- t####.c####.q####.####.com/17.png
- t####.c####.q####.####.com/18.png
- t####.c####.q####.####.com/19.png
- t####.c####.q####.####.com/2.png
- t####.c####.q####.####.com/20.png
- t####.c####.q####.####.com/21@2x.png
- t####.c####.q####.####.com/22@2x.png
- t####.c####.q####.####.com/3.png
- t####.c####.q####.####.com/6.png
- t####.c####.q####.####.com/o_1ao0hal4c8d7oeb1lnarrj14497.jpg
- t####.c####.q####.####.com/o_1ao0lqu5i1gk61cst15r81c0q1s6i7.jpg
- t####.c####.q####.####.com/o_1ao14ncs1h2518s21o5412ri16pm7.jpg
- t####.c####.q####.####.com/o_1ao17llm51ud51ii1e8atfg18pv7.jpg
- t####.c####.q####.####.com/o_1ao3l2r1d1qks1q9s1o2jlej5mf7.jpg
- t####.c####.q####.####.com/o_1ao3mok7ffm93jr1r0vedrcag7.jpg
- t####.c####.q####.####.com/o_1ao3qmdpn1akq123810gd158t91s7.jpg
- t####.c####.q####.####.com/o_1ao5qvci6qse14va1rkhk7u1i9j7.jpg
- t####.c####.q####.####.com/o_1ao5rj2rlofr1oob1sgr1rjtc5v7.jpg
- t####.c####.q####.####.com/o_1ao890cnbqgglba1j5p1qra18ic7.jpg
- t####.c####.q####.####.com/o_1aol3lq641svh4c81usc1ab7vv37.jpg
- t####.c####.q####.####.com/o_1aol46lfujjnjgg3m131d1jv37.jpg
- t####.c####.q####.####.com/o_1aol4p3ok5sbi23pa4boobkp7.jpg
- t####.c####.q####.####.com/o_1aood53bk1g4l13gg1kl31avr68b7.jpg
- t####.c####.q####.####.com/o_1aoof0o8p1ul119695qk1ct11e7r7.jpg
- t####.c####.q####.####.com/o_1aoof10t8ii218dhc9t11dr13a07.jpg
- t####.c####.q####.####.com/o_1aoofa9qlljo1sl217go6i6ikb7.jpg
- wild####.q####.cn.####.net/mmbiz/ygIWaGtyxXPhFBpWxrrSQ4icxCmZEia1KSAMmV5...
- wild####.q####.cn.####.net/mmbiz/ygIWaGtyxXPhFBpWxrrSQ4icxCmZEia1KSdonHD...
- wild####.q####.cn.####.net/mmbiz/ygIWaGtyxXPhFBpWxrrSQ4icxCmZEia1KSefPic...
- wild####.q####.cn.####.net/mmbiz/ygIWaGtyxXPhFBpWxrrSQ4icxCmZEia1KSv43kN...
HTTP POST requests:
- a.appj####.com/ad-service/ad/mark
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/app_tlbu/<Package>.odex
- <Package Folder>/app_tlbu/<Package>.zip
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/index
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/db_public-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/mobclick_agent_cached_<Package>9
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- libjiagu
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
