Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.743.origin
- Android.DownLoader.850.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.0) pis.al####.com:80
- TCP(HTTP/1.0) proxy-t####.al####.com:80
- TCP(HTTP/1.1) 4####.92.21.226:80
- TCP(HTTP/1.1) pus.al####.com:80
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) pns.al####.com:443
- TCP(TLS/1.0) sett####.crashly####.com:443
- TCP(TLS/1.0) rep####.crashly####.com:443
- UDP 1####.168.108.254:4466
DNS requests:
- g####.face####.com
- l####.4####.top
- pis.al####.com
- pns.al####.com
- proxy-t####.al####.com
- pss.al####.com
- pus.al####.com
- rep####.crashly####.com
- sett####.crashly####.com
HTTP GET requests:
- pus.al####.com/kernal/sdkcontrol/vod_android-mobile_x86_9.1.1.1220.jpg
HTTP POST requests:
- pis.al####.com/p/pcdn/i.php?v=####
- proxy-t####.al####.com/p/pcdn/i.php?v=####
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/24dac2b5-afdf-43fd-822e-d4103c1e453f
- /data/data/####/4e1a7aec-429f-4d6e-a84e-08855e8271ee.jar
- /data/data/####/575b379a-3730-4d48-b669-055bbe86ab57.jar
- /data/data/####/5E3DF08A021F-0001-084D-31C8121D2CC3BeginSession.cls_temp
- /data/data/####/5E3DF08A021F-0001-084D-31C8121D2CC3SessionApp.cls_temp
- /data/data/####/5E3DF08A021F-0001-084D-31C8121D2CC3SessionDevice.cls_temp
- /data/data/####/5E3DF08A021F-0001-084D-31C8121D2CC3SessionOS.cls_temp
- /data/data/####/5E3DF08B02FF-0001-0882-31C8121D2CC3BeginSession.cls_temp
- /data/data/####/5E3DF08C039D-0001-08F2-31C8121D2CC3BeginSession.cls_temp
- /data/data/####/5E3DF08C039D-0001-08F2-31C8121D2CC3SessionApp.cls_temp
- /data/data/####/5E3DF08C039D-0001-08F2-31C8121D2CC3SessionDevice.cls_temp
- /data/data/####/5E3DF08C039D-0001-08F2-31C8121D2CC3SessionOS.cls_temp
- /data/data/####/5E3DF08C039D-0001-08F2-31C8121D2CC3SessionUser.cls_temp
- /data/data/####/5E3DF08D02CF-0001-0916-31C8121D2CC3BeginSession.cls_temp
- /data/data/####/5E3DF08D02CF-0001-0916-31C8121D2CC3SessionApp.cls
- /data/data/####/5E3DF08D02CF-0001-0916-31C8121D2CC3SessionDevice.cls_temp
- /data/data/####/5E3DF08D02CF-0001-0916-31C8121D2CC3SessionOS.cls
- /data/data/####/743de35f79985d773e43170c2946327da426ee3d41bfa6c....0.tmp
- /data/data/####/AppEventsLogger.persistedsessioninfo
- /data/data/####/TwitterAdvertisingInfoPreferences.xml
- /data/data/####/c629.db-journal
- /data/data/####/c994cd0b76fc55b8d97c123c5f24466f242682009779028....0.tmp
- /data/data/####/ce288f7b-166d-4431-9374-ae15ddf64c5e
- /data/data/####/com.crashlytics.prefs.xml
- /data/data/####/com.crashlytics.sdk.android.crashlytics-core;co...re.xml
- /data/data/####/com.crashlytics.sdk.android;answers;settings.xml
- /data/data/####/com.crashlytics.settings.json
- /data/data/####/com.facebook.internal.preferences.APP_SETTINGS.xml
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.google.android.gms.measurement.prefs.xml
- /data/data/####/d25c702f-ae82-4322-9479-39d14ff19502.jar
- /data/data/####/ddaf5bc1-b2f4-460b-97af-c8b86b770e25
- /data/data/####/default_photo.jpg
- /data/data/####/e78db556e1aef9ee59c956e3128500f0c12233ccaf8ed96....0.tmp
- /data/data/####/initialization_marker
- /data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.andr...ng.xml
- /data/data/####/j.jar
- /data/data/####/journal.tmp
- /data/data/####/libjiagu1903115351.so
- /data/data/####/libpcdn_acc.so
- /data/data/####/libpcdn_acc.zip
- /data/data/####/libpcdn_acc_new.so
- /data/data/####/mivmi.xml
- /data/data/####/mivmi.xml.bak (deleted)
- /data/data/####/pcdnconfigs.xml
- /data/data/####/pcdnconfigs.xml.bak
- /data/data/####/sa_d25cfb84-7b0c-4db9-81b2-1696ad1f83e5_1581117578691.tap
- /data/data/####/session_analytics.tap
- /data/data/####/session_analytics.tap (deleted)
- /data/data/####/session_analytics.tap.tmp
- /data/data/####/会声会影手机版.xml
- /data/media/####/.nomedia
- /data/media/####/1.jpg
- /data/media/####/2.jpg
- /data/media/####/3.jpg
- /data/media/####/4.jpg
- /data/media/####/cache_acc.log
- /data/media/####/media_source_info.json
- /data/media/####/myself.dat
- /data/media/####/projectInfo.json
- /data/media/####/tile.mp4
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu1903115351.so
- ls -l /system/bin/su
Loads the following dynamic libraries:
- libjiagu1903115351
- libpcdn_acc
- pcdn_acc
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
