Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Triada.43.origin
Network activity:
Connecting to:
- s####.####.com
- mo####.####.com
- p####.####.com
- a####.####.com:11039
- a####.####.com:8700
- a####.####.com
HTTP GET requests:
- a####.####.com/appstore/img/3fea7048ec9f46ffb7cae2541fcd554a.png
- s####.####.com/s?switch=1?os=####&imei=####&imsi=####&mac=####&model=####&sdkv=####&appv=####&density=####&appname=####&apppkg=####&net=####&channelid...
- a####.####.com/appstore/img/bae1f6bf895745bc9aca5ff1408d2f90.png
- mo####.####.com/ads/pa/__pasys_remote_banner.jar
- a####.####.com/appstore/pri/1459226725432.slz
- a####.####.com/appstore/img/de9cc5a7dc324d11acb0d5674de47f6c.png
- a####.####.com/appstore/img/9cb27544325942d4b7f67c20d2c3f6a8.png
- a####.####.com/appstore/img/723ad4a5397043d2a7793773435b3683.png
- a####.####.com/appstore/img/408e1760189e45f786edffab536b8655.png
- a####.####.com/appstore/img/5430d7316a2f450c8e10592198e18e65.png
- a####.####.com/appstore/img/64793f28312c40d1bac2499b30166c8a.png
- s####.####.com/update?sdkv=####&nsdkv=####&imei=####&model=####&channelid=####&appv=####&appvc=####&apppkg=####&brand=####
- a####.####.com/appstore/img/9441bef2838943feb333f87a30d4648d.png
- a####.####.com/appstore/img/38005816810542ba9d0b8df5c758b663.png
- a####.####.com/appstore/img/b23a8a0347aa4407916fa61f1652c48a.png
- a####.####.com/appstore/img/f23944d9c41a463e9c4d2e94b73dd552.png
- a####.####.com/appstore/img/18998e6b96694452b3e14b47696d4c57.png
- a####.####.com/appstore/img/b7e137df524c44e6bab313877f4cd74a.png
- a####.####.com/rest/?api=####&appkey=####&crc=####&market=####&os=####&v=####&ver=####&versioncode=####
- mo####.####.com/ads/pa/__pasys_remote_banner.php?v=####&tp=####&os=####&bdr=####
- a####.####.com/appstore/img/71c8e8adadf94f1082dbb8c8f6346d4f.png
- a####.####.com/appstore/img/2a4b96004fc443238c6474f236905337.png
- a####.####.com/appstore/img/22b6497377914e28a441e9a99cfa4b43.png
HTTP POST requests:
- s####.####.com/pkl16.html
- a####.####.com/jiagu/t/infos
- s####.####.com/t?type=####
- p####.####.com/jiagu/msgs
- a####.####.com/ad-service/ad/mark
- a####.####.com/
- a####.####.com:11039/
- a####.####.com/app_logs
- a####.####.com:8700/
- a####.####.com/jiagu/mark/upgrade
Modified file system:
Creates the following files:
- /sdcard/.4d02db8e14/float/22b6497377914e28a441e9a99cfa4b43.dt
- /sdcard/.4d02db8e14/dd/ad/38005816810542ba9d0b8df5c758b663
- /data/data/####/.jiagu/libjiagu.so
- /sdcard/.4d02db8e14/dd/ad/de9cc5a7dc324d11acb0d5674de47f6c
- /sdcard/.4d02db8e14/dd/ad/3fea7048ec9f46ffb7cae2541fcd554a
- /sdcard/.4d02db8e14/dd/ad/f23944d9c41a463e9c4d2e94b73dd552
- /sdcard/.4d02db8e14/enhance/com.refly.mot.zq/com.refly.mot.zq.tmp
- /data/data/####/databases/MF_SQdb-journal
- /sdcard/.4d02db8e14/dd/ad/408e1760189e45f786edffab536b8655
- /sdcard/.4d02db8e14/float/de9cc5a7dc324d11acb0d5674de47f6c.dt
- /sdcard/.4d02db8e14/float/408e1760189e45f786edffab536b8655
- /sdcard/.4d02db8e14/dd/ad/22b6497377914e28a441e9a99cfa4b43
- /data/data/####/files/.jglogs/.jg.ac
- /sdcard/.4d02db8e14/float/b23a8a0347aa4407916fa61f1652c48a.dt
- /data/data/####/shared_prefs/ver_info.xml
- /sdcard/.4d02db8e14/dd/ad/bae1f6bf895745bc9aca5ff1408d2f90
- /data/data/####/shared_prefs/jg_core_setting.xml.bak
- /sdcard/.4d02db8e14/dd/ad/18998e6b96694452b3e14b47696d4c57
- /sdcard/.4d02db8e14/dd/ad/9441bef2838943feb333f87a30d4648d
- /data/data/####/shared_prefs/initdata.xml
- /sdcard/.4d02db8e14/float/64793f28312c40d1bac2499b30166c8a.dt
- /sdcard/Android/data/.nomedia
- /sdcard/.4d02db8e14/dd/ad/b23a8a0347aa4407916fa61f1652c48a
- /sdcard/.4d02db8e14/dd/ad/2a4b96004fc443238c6474f236905337
- /data/data/####/files/test
- /sdcard/Android/data/####/cache/mvad_updatesdk_error
- /data/data/####/shared_prefs/jg_app_update_settings_random.xml
- /sdcard/Android/data/####/cache/mvad_sdk_error.log
- /sdcard/.4d02db8e14/dd/ad/723ad4a5397043d2a7793773435b3683
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/files/__pasys_remote_banner.jar
- /sdcard/.4d02db8e14/dd/ad/71c8e8adadf94f1082dbb8c8f6346d4f
- /sdcard/.4d02db8e14/float/bae1f6bf895745bc9aca5ff1408d2f90.dt
- /data/data/####/files/.jglogs/.jg.ri
- /sdcard/.4d02db8e14/dd/ad/b7e137df524c44e6bab313877f4cd74a
- /data/data/####/databases/MF_CFG-journal
- /data/data/####/files/mv_crash.log
- /data/data/####/databases/MF_STATS-journal
- /sdcard/.4d02db8e14/dd/ad/c10b336cca214c92baa7612ee7698a74
- /data/data/####/files/.imprint
- /sdcard/.4d02db8e14/.sks
- /data/data/####/files/zlook
- /data/data/####/files/loo/look
- /data/data/####/app_jgls/.log.lock
- /data/data/####/files/mv_swich.cfg
- /sdcard/.4d02db8e14/dd/ad/5430d7316a2f450c8e10592198e18e65
- /sdcard/.4d02db8e14/enhance/1459226725432.tmp
- /data/data/####/files/mvad/update/dynamic1100.jar
- /data/data/####/files/.jglogs/.log3
- /sdcard/.4d02db8e14/enhance/1459226725432
- /data/data/####/files/umeng_it.cache
- /data/data/####/app_jgls/.log.ls
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /sdcard/.4d02db8e14/info/723ad4a5397043d2a7793773435b3683
- /data/data/####/shared_prefs/indion.xml
- /sdcard/.4d02db8e14/.init
- /sdcard/.4d02db8e14/info/de9cc5a7dc324d11acb0d5674de47f6c
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/shared_prefs/jg_core_setting.xml
- /data/data/####/files/.jiagu.lock
- /sdcard/.4d02db8e14/dd/ad/9cb27544325942d4b7f67c20d2c3f6a8
- /data/data/####/files/look
- /data/data/####/files/loo/liblive.so
- /data/data/####/files/578ca005ae8/aff8fa0f-1f5f-4ba6-8166-42ce3ee6dc78.zip
Sets the 'executable' attribute to the following files:
- /data/data/####/files/look
- /data/data/####/.jiagu/libjiagu.so
- /data/data/####/files/test
Miscellaneous:
Executes next shell scripts:
- chmod -R 777 /data/data/####/files/
- ps
- /data/data/####/files/test /data/data/####/files/ 77cb2f178f4a415bbca45b44e5174ec9
- chmod 755 /data/data/####/.jiagu/libjiagu.so
- sh
- chmod -R 777 /data/data/####/files/test
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
