Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Plague.1.origin
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.lion####.com:80
- TCP(HTTP/1.1) upd####.lion####.com:80
- TCP(HTTP/1.1) gameboo####.lion####.com:80
- TCP(TLS/1.0) api.face####.com:443
- TCP(TLS/1.0) d####.fl####.com:443
DNS requests:
- cn.wa####.com
- cn1.wa####.com
- cn2.wa####.com
- d####.fl####.com
- g####.face####.com
- gameboo####.lion####.com
- upd####.lion####.com
- www.lion####.com
HTTP GET requests:
- upd####.lion####.com/public/games/candyrain/?lang=####
- upd####.lion####.com/public/games/candyrain/assets/art/0.png
- upd####.lion####.com/public/games/candyrain/assets/art/1.png
- upd####.lion####.com/public/games/candyrain/assets/art/2.png
- upd####.lion####.com/public/games/candyrain/assets/art/3.png
- upd####.lion####.com/public/games/candyrain/assets/art/4.png
- upd####.lion####.com/public/games/candyrain/assets/art/5.png
- upd####.lion####.com/public/games/candyrain/assets/art/6.png
- upd####.lion####.com/public/games/candyrain/assets/art/7.png
- upd####.lion####.com/public/games/candyrain/assets/art/8.png
- upd####.lion####.com/public/games/candyrain/assets/art/9.png
- upd####.lion####.com/public/games/candyrain/assets/art/arrow_bonus_hor.png
- upd####.lion####.com/public/games/candyrain/assets/art/arrow_bonus_vert....
- upd####.lion####.com/public/games/candyrain/assets/art/awesome.png
- upd####.lion####.com/public/games/candyrain/assets/art/back.jpg
- upd####.lion####.com/public/games/candyrain/assets/art/big_shining.png
- upd####.lion####.com/public/games/candyrain/assets/art/bomb_bonus.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_1.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_10.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_11.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_2.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_3.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_4.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_5.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_6.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_7.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_8.png
- upd####.lion####.com/public/games/candyrain/assets/art/boom_9.png
- upd####.lion####.com/public/games/candyrain/assets/art/border_corner.png
- upd####.lion####.com/public/games/candyrain/assets/art/border_side.png
- upd####.lion####.com/public/games/candyrain/assets/art/button_close.png
- upd####.lion####.com/public/games/candyrain/assets/art/button_exit.png
- upd####.lion####.com/public/games/candyrain/assets/art/button_pause.png
- upd####.lion####.com/public/games/candyrain/assets/art/button_play.png
- upd####.lion####.com/public/games/candyrain/assets/art/button_restart.png
- upd####.lion####.com/public/games/candyrain/assets/art/button_sound_off....
- upd####.lion####.com/public/games/candyrain/assets/art/button_sound_on.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_1.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_2.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_3.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_4.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_5.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_6.png
- upd####.lion####.com/public/games/candyrain/assets/art/cake_7.png
- upd####.lion####.com/public/games/candyrain/assets/art/cell.png
- upd####.lion####.com/public/games/candyrain/assets/art/dirt.png
- upd####.lion####.com/public/games/candyrain/assets/art/donut.png
- upd####.lion####.com/public/games/candyrain/assets/art/drop.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_0.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_1.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_2.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_3.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_4.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_5.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_6.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_7.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_8.png
- upd####.lion####.com/public/games/candyrain/assets/art/font_9.png
- upd####.lion####.com/public/games/candyrain/assets/art/gameover_caption....
- upd####.lion####.com/public/games/candyrain/assets/art/global_map.jpg
- upd####.lion####.com/public/games/candyrain/assets/art/gui.png
- upd####.lion####.com/public/games/candyrain/assets/art/heart_particle.png
- upd####.lion####.com/public/games/candyrain/assets/art/hint_arrow.png
- upd####.lion####.com/public/games/candyrain/assets/art/level_button.png
- upd####.lion####.com/public/games/candyrain/assets/art/lock.png
- upd####.lion####.com/public/games/candyrain/assets/art/main_menu_back_en...
- upd####.lion####.com/public/games/candyrain/assets/art/message_window.png
- upd####.lion####.com/public/games/candyrain/assets/art/out_of_moves.png
- upd####.lion####.com/public/games/candyrain/assets/art/p.png
- upd####.lion####.com/public/games/candyrain/assets/art/point_control_big...
- upd####.lion####.com/public/games/candyrain/assets/art/point_control_sma...
- upd####.lion####.com/public/games/candyrain/assets/art/rotate.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_0.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_1.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_2.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_3.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_4.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_5.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_6.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_7.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_8.png
- upd####.lion####.com/public/games/candyrain/assets/art/sel_9.png
- upd####.lion####.com/public/games/candyrain/assets/art/select_level_back...
- upd####.lion####.com/public/games/candyrain/assets/art/shining.png
- upd####.lion####.com/public/games/candyrain/assets/art/sickle.png
- upd####.lion####.com/public/games/candyrain/assets/art/stone_heart.png
- upd####.lion####.com/public/games/candyrain/assets/art/superb.png
- upd####.lion####.com/public/games/candyrain/assets/art/task_panel.png
- upd####.lion####.com/public/games/candyrain/assets/art/win_caption.png
- upd####.lion####.com/public/games/candyrain/assets/art/win_strings.png
- upd####.lion####.com/public/games/candyrain/js/game.min.js
- upd####.lion####.com/public/games/candyrain/sg/sg.hooks.js
- upd####.lion####.com/public/games/candyrain/sg/softgames-1.1.js
HTTP POST requests:
- gameboo####.lion####.com/view/portal/api.php
- upd####.lion####.com/api/check_update
- www.lion####.com/powerclean/analysis/api.php
File system changes:
Creates the following files:
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsData_XQZX8X42...M8_202
- /data/data/####/.YFlurrySenderIndex.info.AnalyticsMain
- /data/data/####/.jg.ic
- /data/data/####/.yflurrydatasenderblock.25f8a1d5-743f-4d65-9631...569e41
- /data/data/####/.yflurryreport.-5c0a4c881c3037f9
- /data/data/####/AppEventsLogger.persistedsessioninfo
- /data/data/####/FLURRY_SHARED_PREFERENCES.xml
- /data/data/####/app_ncxlclasses.jar
- /data/data/####/com.facebook.sdk.appEventPreferences.xml
- /data/data/####/com.facebook.sdk.attributionTracking.xml
- /data/data/####/com.quick.gamebooster_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/dbhcnjn-journal
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/ignoreliondefdb
- /data/data/####/index
- /data/data/####/info
- /data/data/####/info-journal
- /data/data/####/libjiagu.so
- /data/data/####/lionigoredb-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- ls /system/xbin
Loads the following dynamic libraries:
- libjiagu
- vzrv
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- DES-ECB-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Gets information about running apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
