Android.Packed.40178

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.743.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) www.chuangk####.com:80
TCP(HTTP/1.1) www.go####.com:80
TCP(TLS/1.0) ssl.gst####.com:443
TCP(TLS/1.0) www.go####.com:443
TCP(TLS/1.0) www.gst####.com:443
TCP(TLS/1.0) adser####.go####.com:443

DNS requests:

adser####.go####.com
ssl.gst####.com
www.chuangk####.com
www.go####.com
www.gst####.com

HTTP POST requests:

www.chuangk####.com/cms/mutual.ws
www.chuangk####.com/mcd3/checkfilesupdate.jsp
www.go####.com/loc/json

Modified file system:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/banner_1.2.0.jar
/data/data/####/client_ini.xml
/data/data/####/collectiondb
/data/data/####/collectiondb-journal
/data/data/####/libjiagu1793804748.so
/data/data/####/webview.db-journal
/data/media/####/31_1358236389280_736590.jpg
/data/media/####/31_1358236389686_935482.jpg
/data/media/####/31_1358236389769_279377.jpg
/data/media/####/31_1358236389853_777505.jpg
/data/media/####/31_1358236389935_315509.jpg
/data/media/####/31_1358236389969_782978.jpg
/data/media/####/31_1358236390019_13879.jpg
/data/media/####/31_1358238981852_151008.png
/data/media/####/31_1358238984802_513519.png
/data/media/####/31_1358238984852_573538.png
/data/media/####/31_1358238984885_798286.png
/data/media/####/31_1358238984935_581528.png
/data/media/####/31_1358238984969_385607.png
/data/media/####/31_1358238985019_215291.png
/data/media/####/31_1358238985052_551486.png
/data/media/####/31_1358238985102_467143.png
/data/media/####/31_1358240913654_547469.jpg
/data/media/####/31_1358240913935_532812.jpg
/data/media/####/31_1358240913969_91197.jpg
/data/media/####/31_1358242930588_125050.jpg
/data/media/####/31_1358242930902_912853.jpg
/data/media/####/31_1358242930969_36094.jpg
/data/media/####/31_1358242931019_860957.jpg
/data/media/####/31_1358244125146_37894.jpg
/data/media/####/31_1358244970627_858948.jpg
/data/media/####/31_1358248805812_925093.png
/data/media/####/31_1358250124014_624752.png
/data/media/####/31_1358250124302_645824.png
/data/media/####/31_1358250124352_141723.png
/data/media/####/31_1358250124385_604459.png
/data/media/####/31_1358250124435_43192.png
/data/media/####/31_1358250124469_714251.png
/data/media/####/31_1358250520490_587022.png
/data/media/####/31_1358250520569_993031.png
/data/media/####/31_1358250945615_649522.png
/data/media/####/31_1358250945735_24569.png
/data/media/####/31_1358250945769_306728.png
/data/media/####/31_1358250945819_920953.png
/data/media/####/31_1358251447686_259412.png
/data/media/####/31_1358305891630_884307.png
/data/media/####/31_1358305891870_414896.png
/data/media/####/31_1358305934707_151294.png
/data/media/####/31_1358307382149_347691.png
/data/media/####/31_1358307382196_118525.png
/data/media/####/31_1358307382227_423618.png
/data/media/####/31_1358307382278_213326.png
/data/media/####/31_1358308827086_262689.jpg
/data/media/####/31_1358309992480_702601.jpg
/data/media/####/31_1358309992727_871791.jpg
/data/media/####/31_1358309992807_149372.jpg
/data/media/####/31_1358309992887_305709.jpg
/data/media/####/31_1358309992927_123719.jpg
/data/media/####/31_1358309992967_593555.jpg
/data/media/####/31_1358309993057_208.jpg
/data/media/####/31_1358309993137_803649.jpg
/data/media/####/31_1358309993177_760961.jpg
/data/media/####/31_1358309993217_631927.jpg
/data/media/####/31_1358309993337_782916.jpg
/data/media/####/31_1358318327249_334701.jpg
/data/media/####/31_1358321138363_279956.jpg
/data/media/####/31_1358321910874_690422.jpg
/data/media/####/31_1358323012548_996104.png
/data/media/####/31_1358323267430_227608.jpg
/data/media/####/31_1358323831756_679531.png
/data/media/####/31_1358324468830_927718.jpg
/data/media/####/31_1358324469115_575258.jpg
/data/media/####/31_1358324469149_647394.jpg
/data/media/####/31_1358324469199_217367.jpg
/data/media/####/31_1358324469232_61909.jpg
/data/media/####/31_1358324469282_881903.jpg
/data/media/####/31_1358324469365_411406.jpg
/data/media/####/31_1358331815649_898881.png
/data/media/####/31_1358331930690_756375.png
/data/media/####/354717045148153.txt
/data/media/####/clientBase.json
/data/media/####/nav_4000_08517c59-bac4-4cbd-8e59-23f8269a8174.json
/data/media/####/nav_4000_cf4a5a9d-0d29-4ace-b5ff-679fa9cb1960.json
/data/media/####/nav_4000_fefd67f7-4af5-4268-811c-9a0e7a0b0439.json
/data/media/####/nav_5000_9499dd91-2522-4059-8233-d5bb22c97f19.json
/data/media/####/nav_5000_fbec2291-874a-469c-b4fa-7c42170ca4a8.json
/data/media/####/navitem_5000_9499dd91-2522-4059-8233-d5bb22c97f19.json
/data/media/####/navitem_5000_fbec2291-874a-469c-b4fa-7c42170ca4a8.json
/data/media/####/page_1004_18d1ccc6-4f4d-4325-b19b-1e111742a431.json
/data/media/####/page_1004_1e81abbd-3a5f-40fe-9640-6cb7a41e9e59.json
/data/media/####/page_1004_2a1a65ad-2f31-4af5-b340-c1a8d0918278.json
/data/media/####/page_1004_2b81fd69-ad49-49d7-9408-992143d1aafc.json
/data/media/####/page_1004_35c27d4d-92a4-4c68-8b0a-14e87feafbb0.json
/data/media/####/page_1004_36d8b2d7-e647-4797-8e7c-c1fdf939a01f.json
/data/media/####/page_1004_4432084e-3217-40bc-a8d6-249bb836af24.json
/data/media/####/page_1004_516f9a9e-a604-497f-98af-f3a8d1cf65db.json
/data/media/####/page_1004_57416f07-4f49-457d-b91c-8dca5e255e07.json
/data/media/####/page_1004_5dc8a071-57f0-4de2-a2b7-53e52990a624.json
/data/media/####/page_1004_744d9cc7-09e3-4bf5-9ff7-d7f5209f4680.json
/data/media/####/page_1004_74e11ee2-dca1-4a23-945a-0465d1daa018.json
/data/media/####/page_1004_819be932-0b21-40f3-9148-eb36911abc85.json
/data/media/####/page_1004_86aa42c0-e32b-41c7-a79d-1e5c54e27083.json
/data/media/####/page_1004_8d7609a8-261b-4300-b0e6-b99c05da7abc.json
/data/media/####/page_1004_8e54f95a-b7ef-4d77-bb36-874e620826ff.json
/data/media/####/page_1004_a5c40892-9c2c-454d-9b23-2be80953ddb4.json
/data/media/####/page_1004_ab0e635d-6505-4682-a115-a9720ee53880.json
/data/media/####/page_1004_b1a174b4-d74c-44e0-9e24-5859374b45e0.json
/data/media/####/page_1004_b7d45726-e331-459f-9fa2-28bf581d62b2.json
/data/media/####/page_1004_bce365eb-8a5c-4296-b730-200d1c9b85fa.json
/data/media/####/page_1004_da004991-89d4-43bc-beba-0f5454400af6.json
/data/media/####/page_1004_e42d1180-868d-4a63-aba7-f59a95a55cc0.json
/data/media/####/page_1004_e55cb3ea-0615-4828-8347-8dd16e1fe882.json
/data/media/####/page_1004_ea540c69-f163-4f40-bbaf-c3addfddcdda.json
/data/media/####/page_1009_cfbae088-b4a6-465b-afad-bb23c6aa000f.json
/data/media/####/page_15_cadd7fb8-c70a-46b5-81fb-e974c9bfdc50.json
/data/media/####/page_9_5bae1da9-73b1-43fe-90f7-89cab3b7436f.json
/data/media/####/page_9_866af1ec-f8ee-4a91-902d-14bdf2d466f8.json
/data/media/####/page_9_8baae895-7b91-4f1f-a90c-0215f1b4b120.json
/data/media/####/pageitem2_1004_18d1ccc6-4f4d-4325-b19b-1e111742a431.json
/data/media/####/pageitem2_1004_1e81abbd-3a5f-40fe-9640-6cb7a41e9e59.json
/data/media/####/pageitem2_1004_2a1a65ad-2f31-4af5-b340-c1a8d0918278.json
/data/media/####/pageitem2_1004_2b81fd69-ad49-49d7-9408-992143d1aafc.json
/data/media/####/pageitem2_1004_35c27d4d-92a4-4c68-8b0a-14e87feafbb0.json
/data/media/####/pageitem2_1004_36d8b2d7-e647-4797-8e7c-c1fdf939a01f.json
/data/media/####/pageitem2_1004_4432084e-3217-40bc-a8d6-249bb836af24.json
/data/media/####/pageitem2_1004_516f9a9e-a604-497f-98af-f3a8d1cf65db.json
/data/media/####/pageitem2_1004_57416f07-4f49-457d-b91c-8dca5e255e07.json
/data/media/####/pageitem2_1004_5dc8a071-57f0-4de2-a2b7-53e52990a624.json
/data/media/####/pageitem2_1004_744d9cc7-09e3-4bf5-9ff7-d7f5209f4680.json
/data/media/####/pageitem2_1004_74e11ee2-dca1-4a23-945a-0465d1daa018.json
/data/media/####/pageitem2_1004_819be932-0b21-40f3-9148-eb36911abc85.json
/data/media/####/pageitem2_1004_86aa42c0-e32b-41c7-a79d-1e5c54e27083.json
/data/media/####/pageitem2_1004_8d7609a8-261b-4300-b0e6-b99c05da7abc.json
/data/media/####/pageitem2_1004_8e54f95a-b7ef-4d77-bb36-874e620826ff.json
/data/media/####/pageitem2_1004_a5c40892-9c2c-454d-9b23-2be80953ddb4.json
/data/media/####/pageitem2_1004_ab0e635d-6505-4682-a115-a9720ee53880.json
/data/media/####/pageitem2_1004_b1a174b4-d74c-44e0-9e24-5859374b45e0.json
/data/media/####/pageitem2_1004_b7d45726-e331-459f-9fa2-28bf581d62b2.json
/data/media/####/pageitem2_1004_bce365eb-8a5c-4296-b730-200d1c9b85fa.json
/data/media/####/pageitem2_1004_da004991-89d4-43bc-beba-0f5454400af6.json
/data/media/####/pageitem2_1004_e42d1180-868d-4a63-aba7-f59a95a55cc0.json
/data/media/####/pageitem2_1004_e55cb3ea-0615-4828-8347-8dd16e1fe882.json
/data/media/####/pageitem2_1004_ea540c69-f163-4f40-bbaf-c3addfddcdda.json
/data/media/####/pageitem2_1009_cfbae088-b4a6-465b-afad-bb23c6aa000f.json
/data/media/####/pageitem_1004_18d1ccc6-4f4d-4325-b19b-1e111742a431.json
/data/media/####/pageitem_1004_1e81abbd-3a5f-40fe-9640-6cb7a41e9e59.json
/data/media/####/pageitem_1004_2a1a65ad-2f31-4af5-b340-c1a8d0918278.json
/data/media/####/pageitem_1004_2b81fd69-ad49-49d7-9408-992143d1aafc.json
/data/media/####/pageitem_1004_35c27d4d-92a4-4c68-8b0a-14e87feafbb0.json
/data/media/####/pageitem_1004_36d8b2d7-e647-4797-8e7c-c1fdf939a01f.json
/data/media/####/pageitem_1004_4432084e-3217-40bc-a8d6-249bb836af24.json
/data/media/####/pageitem_1004_516f9a9e-a604-497f-98af-f3a8d1cf65db.json
/data/media/####/pageitem_1004_57416f07-4f49-457d-b91c-8dca5e255e07.json
/data/media/####/pageitem_1004_5dc8a071-57f0-4de2-a2b7-53e52990a624.json
/data/media/####/pageitem_1004_744d9cc7-09e3-4bf5-9ff7-d7f5209f4680.json
/data/media/####/pageitem_1004_74e11ee2-dca1-4a23-945a-0465d1daa018.json
/data/media/####/pageitem_1004_819be932-0b21-40f3-9148-eb36911abc85.json
/data/media/####/pageitem_1004_86aa42c0-e32b-41c7-a79d-1e5c54e27083.json
/data/media/####/pageitem_1004_8d7609a8-261b-4300-b0e6-b99c05da7abc.json
/data/media/####/pageitem_1004_8e54f95a-b7ef-4d77-bb36-874e620826ff.json
/data/media/####/pageitem_1004_a5c40892-9c2c-454d-9b23-2be80953ddb4.json
/data/media/####/pageitem_1004_ab0e635d-6505-4682-a115-a9720ee53880.json
/data/media/####/pageitem_1004_b1a174b4-d74c-44e0-9e24-5859374b45e0.json
/data/media/####/pageitem_1004_b7d45726-e331-459f-9fa2-28bf581d62b2.json
/data/media/####/pageitem_1004_bce365eb-8a5c-4296-b730-200d1c9b85fa.json
/data/media/####/pageitem_1004_da004991-89d4-43bc-beba-0f5454400af6.json
/data/media/####/pageitem_1004_e42d1180-868d-4a63-aba7-f59a95a55cc0.json
/data/media/####/pageitem_1004_e55cb3ea-0615-4828-8347-8dd16e1fe882.json
/data/media/####/pageitem_1004_ea540c69-f163-4f40-bbaf-c3addfddcdda.json
/data/media/####/pageitem_1009_cfbae088-b4a6-465b-afad-bb23c6aa000f.json

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /proc/cpuinfo
chmod 755 <Package Folder>/.jiagu/libjiagu1793804748.so

Loads the following dynamic libraries:

libjiagu1793804748

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Displays its own windows over windows of other applications.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial