Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.188.origin
- Android.RemoteCode.867
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.md####.cn:80
- TCP(HTTP/1.1) cdn.zs####.cn.####.cn:8080
- TCP(TLS/1.0) and####.cli####.go####.com:443
DNS requests:
- and####.cli####.go####.com
- cdn.zs####.cn
- www.md####.cn
HTTP GET requests:
- cdn.zs####.cn.####.cn:8080/resource/gist/2018
HTTP POST requests:
- www.md####.cn/pservers/loadip
File system changes:
Creates the following files:
- /data/air.earline.tqrroqurprincess.dressup.b5l.popdressupjessie....jg.ic
- /data/air.earline.tqrroqurprincess.dressup.b5l.popdressupjessie...M4.zip
- /data/data/####/.jg.ic
- /data/data/####/F6M4.zip
- /data/data/####/daiwolikai.zip
- /data/data/####/libjiagu101113750.so
- /data/data/####/qihoo_jiagu_crash_report.xml
- /data/data/####/umeng_socialize_qq.xml
- /data/media/####/05A76E1B833D0EA2219739085F6BE68A
- /data/media/####/0BB755E214932984BF074E2333FB162A
- /data/media/####/0BE266894690A972FC9922DBD3D83137
- /data/media/####/12B24F27356C885FBC59F895F5E30DDF
- /data/media/####/1543D335A7B76B64108BB6DB8E837227
- /data/media/####/18DE5D918D1C7A27A8266AF04741B2B8
- /data/media/####/28D03407DC883DBEA25149B08E066CEC
- /data/media/####/38940AF4B54067D13410B75AF5D8EF0A
- /data/media/####/3EB566DB4E7206111CE9C4E0FE8B6088
- /data/media/####/446BD4C28A584A4A3715867F5EAAB224
- /data/media/####/470D5297D459BB7C271030A2090904F8
- /data/media/####/47A23C326FBC816ABEC36AD06E0A288F
- /data/media/####/496D1F1228DF3F12131012AD28A552B6
- /data/media/####/553A2B8A1FCAA60498E210E90C86350F
- /data/media/####/5956979FEE83A1C30F9CF0809CDB5419
- /data/media/####/5A301360019DA6D52A8A7DF78D9E6D07
- /data/media/####/6252A686CB1A9FA97290A4ABF7C468EE
- /data/media/####/67A59C45224B9DCE911C236E6B00A0EE
- /data/media/####/681EA830C75540E8BD7C45FDF4FAA065
- /data/media/####/74433868978172DE31BFD614E8E607F5
- /data/media/####/760E9DF64FEB3B758668358AC621BB9A
- /data/media/####/80CE8899D696E7F7F50CF70D76C29FAF
- /data/media/####/8139DA3F5C3903A46D8EF01A24D4BADD
- /data/media/####/8A9D2FE1AD28E300249DA7B4E96C953E
- /data/media/####/8D9F1174E7A9F5661974ED6CE633DA82
- /data/media/####/9ED8F4D3D1CC64C89E528FB45B6FA660
- /data/media/####/A537C35DFF0A8F800BC9F5A030BB2DE0
- /data/media/####/B5862DB659C785A292B1AC33D3E1FA19
- /data/media/####/C7E14ED4D25FD8F59C981CF9699D9483
- /data/media/####/CCD873869806C43FAF69E6F4850562F6
- /data/media/####/CD88A120D28A1E6E70619544FC8C0B01
- /data/media/####/D23E115669D4D4797E128411C0D73EC2
- /data/media/####/DCEC0E05A95C751A2F1D0655FEA428FA
- /data/media/####/E300F78CA67CBA031AEE4A3BA263DD2E
- /data/media/####/E73E6DCD2D23F57CA55EBCF82C15AF13
- /data/media/####/E949EFACAADA5FCBA5922855F512F148
- /data/media/####/F0455F0A526B2505AD9DF4D9E5714F0A
- /drw/crypto/10043.2492.decrypt.AES-CFB-NoPadding.bd01a03e-8f02-...4.dump
- /drw/crypto/10043.2492.decrypt.AES-CFB-NoPadding.bd01a03e-8f02-...ck.txt
- /drw/dvm_dumps/10043.2492.F6M4.zip.7455fffc62a1eba2dc87fd47733e...ck.txt
- /drw/dvm_dumps/10043.2492.F6M4.zip.7455fffc62a1eba2dc87fd47733e...le.jar
- /drw/dvm_dumps/10043.2492.raw_array.c6da98adadc6849d894768dca84...ck.txt
- /drw/dvm_dumps/10043.2492.raw_array.c6da98adadc6849d894768dca84...ct.dex
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu101113750.so
Loads the following dynamic libraries:
- libjiagu101113750
- main
Uses the following algorithms to encrypt data:
- AES
Uses the following algorithms to decrypt data:
- AES-CFB-NoPadding
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
