Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.203.origin
Network activity:
Connecting to:
- o####.####.com
- a####.####.com
HTTP POST requests:
- a####.####.com/app_logs
- a####.####.com/api/check_app_update
- o####.####.com/check_config_update
- a####.####.com/appjiagu
Modified file system:
Creates the following files:
- /data/data/####/files/libjiagu.so
- /data/data/####/files/.jiagu.lock
- /data/data/####/shared_prefs/reputation.xml
- /data/data/####/files/wowow.jar
- /data/data/####/files/mteeep.jar
- /data/data/####/files/.jiagu.ls
- /data/data/####/shared_prefs/pround.xml
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/shared_prefs/mobclick_agent_header_####.xml
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml.bak
- /data/data/####/shared_prefs/mobclick_agent_state_####.xml
Miscellaneous:
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
