Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.5032####.com:8089
- TCP(TLS/1.0) between####.oss-cn-####.aliy####.com:443
DNS requests:
- between####.oss-cn-####.aliy####.com
- www.5032####.com
HTTP POST requests:
- www.5032####.com:8089/PartnerService/demandAction.do?method=####
- www.5032####.com:8089/PartnerService/homePageAction.do?method=####
- www.5032####.com:8089/PartnerService/messageAction.do?method=####
- www.5032####.com:8089/PartnerService/systemAction.do?method=####
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/02865574748ab955fdfc944b9d64ead3040e40a55e49b19....0.tmp
- /data/data/####/03a96c1107982e62d166a6f9027611d0ac9e0a3f455806c....0.tmp
- /data/data/####/1bb843020d66ca2b1d7081d8a0eb9eca975dc637e6fca86....0.tmp
- /data/data/####/2401806023f46a4997fa52d1aeef4077e2fbeb4f9369df0....0.tmp
- /data/data/####/2d588f387a686ef68682c67a96a3a09448bac7c6a9822bb....0.tmp
- /data/data/####/3a28e657fd96b237649a556708ced85ab2659e63a929844....0.tmp
- /data/data/####/515e2501230cee82b7818f0069db29a4397239c86b83d07....0.tmp
- /data/data/####/5649a715d2b70b4c3fe68985b9de1ac957a1217cba720fd....0.tmp
- /data/data/####/82da63a80acce0f4d4ceb0e1ecd25271c86cb3ce9d9240a....0.tmp
- /data/data/####/86d7b548af4f681bfcbc0973b331e6d071781083efab694....0.tmp
- /data/data/####/8faba8c0669184c9c289d8947942a8a1465656b4c3239a5....0.tmp
- /data/data/####/947f6e53119b2b4e532ef0d343b10d5e0df758781966247....0.tmp
- /data/data/####/95c5774c88a3f49dadade172664e962bc1f60552f26e908....0.tmp
- /data/data/####/9ac965109b966c0e90bf07641c96963342eeea8f7f27270....0.tmp
- /data/data/####/MultiDex.lock
- /data/data/####/a2dd5cc694732129661040b44ecc0fbc2c9c68b2c65edcf....0.tmp
- /data/data/####/ad982cbf6d5fd787b7ab6a592add8674b9515d84435e04c....0.tmp
- /data/data/####/c2f1275b76526e3f00254efed2e91a6faa60985a6735eb2....0.tmp
- /data/data/####/c3ad00bb17f3a483d5f30e1dabcaacece54624e35c422a1....0.tmp
- /data/data/####/cc8d4cc647757c3b2f270313b44b8d2b6a1214ef41af0e6....0.tmp
- /data/data/####/e6db067ca2f4b4ee8f0747c454f86504efa345d965d80e2....0.tmp
- /data/data/####/e9821a815d0c51eb18b1bcd8f2f9f59f315ab8317fa673f....0.tmp
- /data/data/####/f99ae972f0fbd6ef2703505b0d51d21b7de783c2b4917f1....0.tmp
- /data/data/####/info.xml
- /data/data/####/jiujiuyun_user.xml
- /data/data/####/journal.tmp
- /data/data/####/libjiagu122489193.so
- /data/data/####/multidex.version.xml
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/media/####/350f6117c6a48cb2da11b522c3051d52.0.tmp
- /data/media/####/3622ed412fc20033b6c4a8e10eb7411d.0.tmp
- /data/media/####/47ab97eb893cce3e5e701d2ec07bdb4a.0.tmp
- /data/media/####/725e64abe4a5bd4329e44d56d3296106.0.tmp
- /data/media/####/journal
- /data/media/####/journal.tmp
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu122489193.so
Loads the following dynamic libraries:
- libjiagu122489193
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
