Technical information
Malicious functions:
Threat detection based on machine learning.
Contains typical locker code.
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) 1####.cn:80
- TCP(HTTP/1.1) app.2####.cn:80
- TCP(HTTP/1.1) lib.bao####.com.####.com:80
- TCP(HTTP/1.1) qq.t####.tools:80
- TCP(TLS/1.0) lib.bao####.com.####.com:443
- TCP(TLS/1.0) 64.2####.162.95:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) idu####.qini####.com:443
- TCP(TLS/1.0) cdn.boo####.com.####.com:443
- TCP(TLS/1.0) 64.2####.165.139:443
- TCP(TLS/1.0) android####.go####.com:443
- TCP(TLS/1.0) instant####.google####.com:443
- TCP(TLS/1.2) 64.2####.162.95:443
- TCP(TLS/1.2) 64.2####.165.139:443
- TCP(TLS/1.2) 1####.250.150.94:443
DNS requests:
- 1####.cn
- android####.go####.com
- app.2####.cn
- cdn.boo####.com
- cdn.static####.org
- instant####.google####.com
- lib.bao####.com
- p####.google####.com
- qq.t####.tools
HTTP GET requests:
- app.2####.cn/dmj/20210515.txt
- lib.bao####.com.####.com/clipboard.js/1.7.1/clipboard.min.js
- qq.t####.tools/
- qq.t####.tools/assets/css/layui.css
- qq.t####.tools/assets/css/style.css
- qq.t####.tools/assets/icon/icon.png
- qq.t####.tools/assets/img/Delgroup.png
- qq.t####.tools/assets/img/Hzuan.png
- qq.t####.tools/assets/img/QQhaoyou.png
- qq.t####.tools/assets/img/card.png
- qq.t####.tools/assets/img/danxiang.png
- qq.t####.tools/assets/img/games.png
- qq.t####.tools/assets/img/haoyou.png
- qq.t####.tools/assets/img/hideQQ.png
- qq.t####.tools/assets/img/hysc.png
- qq.t####.tools/assets/img/iphone.png
- qq.t####.tools/assets/img/jjtj.png
- qq.t####.tools/assets/img/kbmp.png
- qq.t####.tools/assets/img/kongbai.png
- qq.t####.tools/assets/img/lvzuan.png
- qq.t####.tools/assets/img/lysh.png
- qq.t####.tools/assets/img/mibao.png
- qq.t####.tools/assets/img/mingpai.png
- qq.t####.tools/assets/img/money.png
- qq.t####.tools/assets/img/name.png
- qq.t####.tools/assets/img/plsh.png
- qq.t####.tools/assets/img/qiandao.png
- qq.t####.tools/assets/img/qinmi.png
- qq.t####.tools/assets/img/qipao.png
- qq.t####.tools/assets/img/qqnumber.png
- qq.t####.tools/assets/img/qqyewu.png
- qq.t####.tools/assets/img/qqyuanfen.png
- qq.t####.tools/assets/img/qunfa.png
- qq.t####.tools/assets/img/qzone.png
- qq.t####.tools/assets/img/regtime.png
- qq.t####.tools/assets/img/renzheng.png
- qq.t####.tools/assets/img/school.png
- qq.t####.tools/assets/img/showss.png
- qq.t####.tools/assets/img/svip.png
- qq.t####.tools/assets/img/tbgx.png
- qq.t####.tools/assets/img/tuiqun.png
- qq.t####.tools/assets/img/wzry.png
- qq.t####.tools/assets/img/wztq.png
- qq.t####.tools/assets/img/ycss.png
- qq.t####.tools/assets/img/yes.png
- qq.t####.tools/assets/js/funtion.js
- qq.t####.tools/assets/js/main.js
- qq.t####.tools/assets/js/tools.js?r=####
HTTP POST requests:
- 1####.cn/user/1828753282/jc/312/jc/app.php
- 1####.cn/user/1828753282/jc/312/jc/tj.php
File system changes:
Creates the following files:
- /data/data/####/0683edae274b8e04_0
- /data/data/####/0f4d22e995f88255_0
- /data/data/####/2b09ede87d6b1cfc_0
- /data/data/####/2d87f5d8bd415ade_0
- /data/data/####/2dc5a309006251b7_0
- /data/data/####/2dc5a309006251b7_1
- /data/data/####/2fef22acafdd2695_0
- /data/data/####/302dc11d4cf452ce_0
- /data/data/####/33971f558908806a_0
- /data/data/####/33991930c5f31fd3_0
- /data/data/####/371096f5101adee8_0
- /data/data/####/3b87fdacbb3444ce_0
- /data/data/####/4116445535f0cddf_0
- /data/data/####/5480eb781cf8294b_0
- /data/data/####/5cfbd0ac7d88e3f9_0
- /data/data/####/5cfbd0ac7d88e3f9_1
- /data/data/####/6276e52d2231f748_0
- /data/data/####/63fa7451cb5b6906_0
- /data/data/####/64d3535ca12e69d3_0
- /data/data/####/64d3535ca12e69d3_1
- /data/data/####/66b6f453d1259a50_0
- /data/data/####/680c109a728b970d_0
- /data/data/####/69b862b56f207123_0
- /data/data/####/6a9a3bfe2b163c5c_0
- /data/data/####/6c59919e4ff9c72e_0
- /data/data/####/6f9c6fe59cc1972f_0
- /data/data/####/770318715db7d1b6_0
- /data/data/####/7f6ac8067ff6a6be_0
- /data/data/####/7f6ac8067ff6a6be_1
- /data/data/####/826931cbce154f14_0
- /data/data/####/83d3cfc10def7ddd_0
- /data/data/####/86e4e045d2d12a9c_0
- /data/data/####/8e142a26c66bf4da_0
- /data/data/####/8f1fb6f980c71752_0
- /data/data/####/91bb95601f61e466_0
- /data/data/####/92bb0624bef25160_0
- /data/data/####/92bb0624bef25160_1
- /data/data/####/9529e407de8012d7_0
- /data/data/####/97a2ec52a4aeaee0_0
- /data/data/####/Cookies-journal
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/a373eddcd887c3fe_0
- /data/data/####/a602f56ba98090b9_0
- /data/data/####/a6e433182983fcde_0
- /data/data/####/abde229035693bae_0
- /data/data/####/abde229035693bae_1
- /data/data/####/b234135e483aff69_0
- /data/data/####/b27d3bc89c4ca47e_0
- /data/data/####/b2c9ae231dd3da14_0
- /data/data/####/b2c9ae231dd3da14_1
- /data/data/####/bc83dace4a48290e_0
- /data/data/####/bea0e0c56f6a0c21_0
- /data/data/####/c0777efb356b0fa1_0
- /data/data/####/c7d9eee2b5ce3d37_0
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.oat
- /data/data/####/com.qiezhushou_preferences.xml
- /data/data/####/df4c0ff8578b8a49_0
- /data/data/####/e208ef0535320cff_0
- /data/data/####/e52c7f134f7571ed_0
- /data/data/####/edc039c8d2ea8282_0
- /data/data/####/f5fc23ade005c305_0
- /data/data/####/fa5d5c6d2f2c23c5_0
- /data/data/####/fea37691ba1529fe_0
- /data/data/####/index
- /data/data/####/libjiagu.so
- /data/data/####/metrics_guid
- /data/data/####/proc_auxv
- /data/data/####/the-real-index
Miscellaneous:
Executes the following shell scripts:
- /system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about network.
Displays its own windows over windows of other apps.
