Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- d####.####.com
- m####.####.com
- pag####.####.com
- ip####.io
- l####.####.net
HTTP GET requests:
- pag####.####.com/pagead/js/adsbygoogle.js
- m####.####.com/static/uploadfiles/201612/201612261351546085.jpg
- d####.####.com/image/3.jpg
- m####.####.com/static/girls/images/msg_img/loading.gif
- m####.####.com/static/girls/js/common.js
- m####.####.com/static/girls/img/fl.png
- m####.####.com/static/uploadfiles/201702/201702241750574811.jpg
- m####.####.com/static/girls/img/home.png
- m####.####.com/static/girls/images/logo.png
- m####.####.com/static/girls/css/style.css
- pag####.####.com/pagead/js/r20170315/r20170110/show_ads_impl.js
- ip####.io/json
- m####.####.com/static/girls/img/label.png
- m####.####.com/static/girls/js/zepto/zepto.min.js
- m####.####.com/
HTTP POST requests:
- l####.####.net/gkview/info/600
- m####.####.com/smartview/api/920
Droppers:
Downloaded by the following detected threats from the Web:
- Android.Xiny.26.origin
Modified file system:
Creates the following files:
- /data/data/####/files/.jiagu.lock
- /data/data/####/.jiagu/libjiagu.so
- /data/data/####/cache/picasso-cache/journal.tmp
- /data/data/####/app_jgls/.log.ls
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/app_jgls/.log.lock
- /data/data/####/files/.jglogs/.jg.ri
- /data/data/####/files/.jglogs/.jg.ac
- /data/data/####/cache/picasso-cache/4af17b765dc7f29d8c86179ba2415d0d.1.tmp
- /data/data/####/cache/picasso-cache/4af17b765dc7f29d8c86179ba2415d0d.0.tmp
Sets the 'executable' attribute to the following files:
- /data/data/####/.jiagu/libjiagu.so
Miscellaneous:
Executes next shell scripts:
- chmod 755 /data/data/####/.jiagu/libjiagu.so
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
