Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.511.origin
Network activity:
Connecting to:
- s####.####.com
- 1####.####.67
- f####.####.cn
- p####.####.com
- b####.####.com
HTTP GET requests:
- 1####.####.67/strategy/loss_4.3
- 1####.####.67/strategy/sul18
HTTP POST requests:
- f####.####.cn/ct/po/hr/ut
- f####.####.cn/ct/ba/npqki
- f####.####.cn/ct/az/p
- b####.####.com/jiagu/t/infos
- 1####.####.67/log/interface.html
- f####.####.cn/ct/yworx/utme
- f####.####.cn/ct/da/fqge
- 1####.####.67/strategy/interface.html
- p####.####.com/jiagu/msgs
- s####.####.com/pkl16.html
Modified file system:
Creates the following files:
- /data/data/####/files/.jiagu.lock
- /data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/app_ef75b71d-e786-4a70-a1c6-44f8e603caa8/wsroot.sh
- /data/data/####/files/SUBOXLOG_
- /data/data/####/app_ef75b71d-e786-4a70-a1c6-44f8e603caa8/su
- /data/data/####/app_subox_download/4d6d2da6-bdcb-435f-ad7b-6b3bec3f5667
- /data/data/####/files/.jglogs/.log3
- /data/data/####/shared_prefs/jg_core_control.xml.bak
- /data/data/####/app_ef75b71d-e786-4a70-a1c6-44f8e603caa8/fileWork
- /data/data/####/app_ef75b71d-e786-4a70-a1c6-44f8e603caa8/install-recovery.sh
- /data/data/####/app_ef75b71d-e786-4a70-a1c6-44f8e603caa8/pidof
- /data/data/####/app_dextmp/eh.jar
- /data/data/####/shared_prefs/jg_app_update_settings_random.xml
- /data/data/####/files/xc.jar
- /data/data/####/shared_prefs/qq.xml
- /data/data/####/shared_prefs/dsi.xml
- /data/data/####/files/.jglogs/.jg.ri
- /data/data/####/files/libjiagu.so
- /data/data/####/databases/t_u.db-journal
- /data/data/####/app_subox_download/d8f9f449-58d3-4e86-b771-41f5a974bbfd
- /data/data/####/app_ef75b71d-e786-4a70-a1c6-44f8e603caa8/debuggerd
- /data/data/####/files/.jglogs/.jg.ac
- /data/data/####/shared_prefs/jg_core_control.xml
- /data/data/####/shared_prefs/qq.xml.bak
- /data/data/####/app_ef75b71d-e786-4a70-a1c6-44f8e603caa8/toolbox
- /data/data/####/shared_prefs/GameData.xml
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/app_anonymous_files/anonymous_core.so
- /data/data/####/app_ef75b71d-e786-4a70-a1c6-44f8e603caa8/supolicy
- /data/data/####/app_ef75b71d-e786-4a70-a1c6-44f8e603caa8/Matrix
- /data/data/####/app_ef75b71d-e786-4a70-a1c6-44f8e603caa8/ddexe
Sets the 'executable' attribute to the following files:
- /data/data/####/app_ef75b71d-e786-4a70-a1c6-44f8e603caa8/Matrix
Miscellaneous:
Executes next shell scripts:
- chmod 755 /data/data/####/files/libjiagu.so
- sh
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
