Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.2083
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) h####.opensp####.cn:80
- TCP(TLS/1.0) bug####.com:443
- TCP(TLS/1.0) 1####.217.19.206:443
DNS requests:
- bug####.com
- d####.opensp####.cn
- h####.opensp####.cn
HTTP GET requests:
- h####.opensp####.cn/launchconfig?t=####&p=####
File system changes:
Creates the following files:
- /data/data/####/com.google.android.gms.appid-no-backup
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/evnlxd0
- /data/data/####/ifly_launch_lib.xml
- /data/data/####/iflytek_state_com.ishdgowedu.dgbdsgdn.xml
- /data/data/####/jg_so_upgrade_setting.xml
- /data/data/####/libjiagu.so
- /data/data/####/lxdMoblieAgent_event_com.ishdgowedu.dgbdsgdn.xml
- /data/data/####/lxdMoblieAgent_sys_config.xml
- /data/data/####/lxdMoblieAgent_upload_com.ishdgowedu.dgbdsgdn.xml
- /data/data/####/multidex.version.xml
- /data/media/####/crash-2018-12-02-11-10-15-1543749015346.log
- /data/media/####/crash-2018-12-02-11-10-16-1543749016327.log
- /data/media/####/crash-2018-12-02-11-10-17-1543749017293.log
- /data/media/####/crash-2018-12-02-11-10-19-1543749019074.log
- /data/media/####/crash-2018-12-02-11-10-20-1543749020033.log
- /data/media/####/crash-2018-12-02-11-10-21-1543749021013.log
- /data/media/####/crash-2018-12-02-11-10-24-1543749024862.log
- /data/media/####/crash-2018-12-02-11-10-25-1543749025866.log
- /data/media/####/crash-2018-12-02-11-10-26-1543749026841.log
- /data/media/####/crash-2018-12-02-11-10-29-1543749029412.log
- /data/media/####/crash-2018-12-02-11-10-30-1543749030433.log
- /data/media/####/crash-2018-12-02-11-10-31-1543749031422.log
- /data/media/####/crash-2018-12-02-11-10-33-1543749033866.log
- /data/media/####/crash-2018-12-02-11-10-34-1543749034893.log
- /data/media/####/crash-2018-12-02-11-10-35-1543749035890.log
- /data/media/####/crash-2018-12-02-11-10-39-1543749039251.log
- /data/media/####/crash-2018-12-02-11-10-40-1543749040300.log
- /data/media/####/crash-2018-12-02-11-10-41-1543749041364.log
- /data/media/####/crash-2018-12-02-11-10-44-1543749044877.log
- /data/media/####/crash-2018-12-02-11-10-46-1543749046398.log
- /data/media/####/crash-2018-12-02-11-10-47-1543749047453.log
- /data/media/####/crash-2018-12-02-11-10-52-1543749052830.log
- /data/media/####/crash-2018-12-02-11-10-53-1543749053804.log
- /data/media/####/crash-2018-12-02-11-10-54-1543749054795.log
- /data/media/####/crash-2018-12-02-11-10-58-1543749058684.log
- /data/media/####/crash-2018-12-02-11-10-59-1543749059683.log
- /data/media/####/crash-2018-12-02-11-11-00-1543749060729.log
- /data/media/####/crash-2018-12-02-11-11-04-1543749064396.log
- /data/media/####/crash-2018-12-02-11-11-05-1543749065387.log
- /data/media/####/crash-2018-12-02-11-11-06-1543749066402.log
- /data/media/####/crash-2018-12-02-11-11-08-1543749068432.log
- /data/media/####/crash-2018-12-02-11-11-09-1543749069426.log
- /data/media/####/crash-2018-12-02-11-11-10-1543749070478.log
- /data/media/####/crash-2018-12-02-11-11-14-1543749074685.log
- /data/media/####/crash-2018-12-02-11-11-15-1543749075660.log
- /data/media/####/crash-2018-12-02-11-11-16-1543749076696.log
- /data/media/####/crash-2018-12-02-11-11-22-1543749082801.log
- /data/media/####/crash-2018-12-02-11-11-30-1543749090794.log
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- logcat -v time -d 2273
- logcat -v time -d 2326
- logcat -v time -d 2373
- logcat -v time -d 2433
- logcat -v time -d 2483
- logcat -v time -d 2534
- logcat -v time -d 2596
- logcat -v time -d 2646
- logcat -v time -d 2697
- logcat -v time -d 2762
- logcat -v time -d 2813
- logcat -v time -d 2865
- logcat -v time -d 2927
- logcat -v time -d 2977
- logcat -v time -d 3030
- logcat -v time -d 3092
- logcat -v time -d 3142
- logcat -v time -d 3192
- logcat -v time -d 3261
- logcat -v time -d 3311
- logcat -v time -d 3361
- logcat -v time -d 3425
- logcat -v time -d 3479
- logcat -v time -d 3529
- logcat -v time -d 3590
- logcat -v time -d 3643
- logcat -v time -d 3695
- logcat -v time -d 3774
- logcat -v time -d 3837
- logcat -v time -d 3888
- logcat -v time -d 3952
- logcat -v time -d 4005
- logcat -v time -d 4055
- logcat -v time -d 4117
- logcat -v time -d 4169
- logcat -v time -d 4220
- logcat -v time -d 4283
- logcat -v time -d 4383
Loads the following dynamic libraries:
- libjiagu
- msc
- zmf
Uses special library to hide executable bytecode.
Accesses camera interface.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
