Technical information
Malicious functions:
Prompts to install third-party applications.
Network activity:
Connecting to:
- s####.####.com
- d####.####.com
- f####.####.com
- cf####.####.com
- a####.####.com
HTTP GET requests:
- d####.####.com/70/sign2016.jks
- d####.####.com/BD/jiyoujingling.apk
- d####.####.com/70/statrimg_02.png
- d####.####.com/70/201701161355.pro
HTTP POST requests:
- s####.####.com/pkl16.html
- a####.####.com/jiagu/t/infos
- f####.####.com/api/Orders/SaveMachineLog
- cf####.####.com/api/Orders/IsFree2
- a####.####.com/ad-service/ad/mark
- f####.####.com/api/Orders/GetStartImg
- a####.####.com/app_logs
- f####.####.com/api/Orders/GetselfstartingData3?type=####&sver=####&chanleid=####&model=####&aver=####
Modified file system:
Creates the following files:
- /data/data/####/files/.jiagu.lock
- /sdcard/com.boly.jyelves/splash.png
- /data/data/####/shared_prefs/####_main_prefs.xml.bak
- /data/data/####/.jiagu/libjiagu.so
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /sdcard/.wxdkgj/cache/.nomedia
- /data/data/####/files/umeng_it.cache
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/####_main_prefs.xml
- /data/data/####/shared_prefs/umeng_feedback_conversations.xml
- /sdcard/huihu/protect/####
- /data/data/####/files/.umeng/exchangeIdentity.json
- /data/data/####/shared_prefs/umeng_feedback_user_info.xml
- /data/data/####/files/.imprint
- /sdcard/####/jiyoujingling.apk
- /data/data/####/files/.jglogs/.jg.ri
- /data/data/####/files/mobclick_agent_cached_####210
Sets the 'executable' attribute to the following files:
- /data/data/####/.jiagu/libjiagu.so
Miscellaneous:
Executes next shell scripts:
- chmod 755 /data/data/####/.jiagu/libjiagu.so
- chmod 755 /data/data/com.boly.jyelves/.jiagu/libjiagu.so
- cat /sys/class/net/wlan0/address
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
