Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.1513
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) i.s####.ne####.####.cn:10018
- TCP(HTTP/1.1) i####.cn.com:80
- TCP(HTTP/1.1) commu####.7####.com:80
- TCP(HTTP/1.1) s####.g####.oppomo####.com:80
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) i####.oppomo####.com:443
- TCP(TLS/1.0) api.cdo.oppomo####.com:443
DNS requests:
- api.cdo.oppomo####.com
- b####.bj####.com
- commu####.7####.com
- i####.cn.com
- i####.oppomo####.com
- i.s####.ne####.####.cn
- pg.x####.com
- s####.g####.oppomo####.com
- www.go####.com
HTTP GET requests:
- commu####.7####.com/index.php/sdk/AbortSMS/getBingFG?game_id=####&platfo...
- commu####.7####.com/index.php/sdk/AbortSMS/getThirdPayType?game_id=####&...
- i####.cn.com/a/3c1e0985093cceca4f16f5f8da551f103
HTTP POST requests:
- i.s####.ne####.####.cn:10018/statistics/ClientStartUpload
- s####.g####.oppomo####.com/soporcollect/appevent/event
Modified file system:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/2171315a24ff5b0edb2c6c8a0f5551c0
- /data/data/####/2E31B1E1A3A83FBF527B39DE9E598F57|account_file.xml
- /data/data/####/NearMeSTAT.db-journal
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/app.min.js
- /data/data/####/arrow.png
- /data/data/####/book_header_mask.png
- /data/data/####/book_icon_list.png
- /data/data/####/book_icon_more.png
- /data/data/####/btn_go.png
- /data/data/####/com.nearme.gamecenter.open.xml
- /data/data/####/default-banner.png
- /data/data/####/default-game.png
- /data/data/####/detail_icon_4.png
- /data/data/####/empty.png
- /data/data/####/error_sorry.png
- /data/data/####/error_wifi.png
- /data/data/####/game_comment_bg.png
- /data/data/####/game_comment_icon_1.png
- /data/data/####/game_comment_icon_2.png
- /data/data/####/game_comment_icon_3.png
- /data/data/####/icon-close.png
- /data/data/####/icon_detail_nomessage.png
- /data/data/####/icon_evaluation.png
- /data/data/####/icon_list.png
- /data/data/####/icon_more.png
- /data/data/####/icon_pointer_right.png
- /data/data/####/icon_strategy.png
- /data/data/####/icon_title.png
- /data/data/####/icon_video.png
- /data/data/####/index.html
- /data/data/####/left_bg.png
- /data/data/####/libjiagu1322537986.so
- /data/data/####/libonlywechat_plugin.so
- /data/data/####/libs.min.js
- /data/data/####/middle_bg.png
- /data/data/####/nearme_func_com.zhangdong.jump.nearme.gamecenter.xml
- /data/data/####/nearme_setting_com.zhangdong.jump.nearme.gamecenter.xml
- /data/data/####/no_more_left_icon.png
- /data/data/####/no_more_right_icon.png
- /data/data/####/num_bg.png
- /data/data/####/oppo_game_service_200702.apk_temp
- /data/data/####/oppo_spinner_black_16.png
- /data/data/####/oppo_spinner_black_48.png
- /data/data/####/plugin_framework.xml
- /data/data/####/pref_file.xml
- /data/data/####/qihoo_jiagu_crash_report.xml
- /data/data/####/round_bg1.png
- /data/data/####/smile_face.png
- /data/data/####/style.css
- /data/data/####/table_bg.png
- /data/data/####/talkingdata_app.db-journal
- /data/data/####/talkingdata_app_process_preferences_file
- /data/data/####/talkingdata_app_version_preferences_file
- /data/data/####/td_pefercen_profile.xml
- /data/data/####/tdid.xml
- /data/data/####/version
- /data/data/####/vip_tag.png
- /data/data/####/webview.db-journal
- /data/data/####/zdjoys.xml
- /data/media/####/.Og.meta
- /data/media/####/.nomedia
- /data/media/####/.tcookieid
- /data/media/####/journal.tmp
- /data/media/####/mcs_msg.ini
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu1322537986.so
Loads the following dynamic libraries:
- iconv
- jump
- libjiagu1322537986
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
