Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.511.origin
Network activity:
Connecting to:
- s####.####.com
- l####.####.com
- 1####.####.67
- a####.####.com
HTTP GET requests:
- l####.####.com/res/20161101/201611011345466.png
- 1####.####.67/strategy/sul18
- 1####.####.67/strategy/loss_4.3
HTTP POST requests:
- l####.####.com/bdeal
- s####.####.com/pkl16.html
- a####.####.com/jiagu/check/upgrade
- 1####.####.67/log/interface.html
- l####.####.com/8a61/gf2
- a####.####.com/ad-service/ad/mark
- l####.####.com/ea1fk
- a####.####.com/app_logs
- l####.####.com/8a61/l2a
- 1####.####.67/strategy/interface.html
Modified file system:
Creates the following files:
- /data/data/####/files/.jiagu.lock
- /data/data/####/app_subox/32edd79a240b5f1e461d069caab1ec3e
- /data/data/####/app_pum/[B@4aafbc00.jar
- /data/data/####/files/SUBOXLOG_
- /data/data/####/shared_prefs/i_l_y.xml
- /data/data/####/app_8bb7d2e4-ef8b-456e-a17d-811bfe526a92/ddexe
- /data/data/####/shared_prefs/5de73938.xml.bak
- /data/data/####/app_8bb7d2e4-ef8b-456e-a17d-811bfe526a92/debuggerd
- /data/data/####/databases/t_u.db-journal
- /data/data/####/shared_prefs/####.appirater3.xml
- /data/data/####/files/cn.bkbk.garys.jar
- /data/data/####/app_gld/[B@4a96ad98.jar
- /data/data/####/app_8bb7d2e4-ef8b-456e-a17d-811bfe526a92/install-recovery.sh
- /data/data/####/shared_prefs/_w120777912.xml
- /data/data/####/shared_prefs/5de73938.xml
- /data/data/####/app_8bb7d2e4-ef8b-456e-a17d-811bfe526a92/fileWork
- /data/data/####/shared_prefs/jg_app_update_settings_random.xml
- /data/data/####/app_subox_download/863c81e5-e61a-4c99-83d7-448a8ed2a863
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/shared_prefs/qq.xml
- /data/data/####/files/.imprint
- /data/data/####/files/.jglogs/.jg.ri
- /data/data/####/shared_prefs/_w120777912.xml.bak
- /data/data/####/shared_prefs/_i120777912.xml
- /data/data/####/files/cr.jar
- /data/data/####/app_8bb7d2e4-ef8b-456e-a17d-811bfe526a92/Matrix
- /data/data/####/files/####c.jar
- /data/data/####/app_8bb7d2e4-ef8b-456e-a17d-811bfe526a92/pidof
- /data/data/####/files/ul.jar
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/.jglogs/.jg.ac
- /data/data/####/app_ehtmp/eh.jar
- /data/data/####/app_8bb7d2e4-ef8b-456e-a17d-811bfe526a92/su
- /data/data/####/shared_prefs/qq.xml.bak
- /data/data/####/app_8bb7d2e4-ef8b-456e-a17d-811bfe526a92/toolbox
- /data/data/####/files/libjiagu.so
- /data/data/####/files/uw.jar
- /data/data/####/app_8bb7d2e4-ef8b-456e-a17d-811bfe526a92/supolicy
- /data/data/####/app_anonymous_files/anonymous_core.so
- /data/data/####/shared_prefs/mobclick_agent_online_setting_####.xml
- /data/data/####/app_subox_download/22341983-1fd1-46e7-9ebf-e981e5f8d91d
- /sdcard/Android/data/####/cache/201611011345466#png
- /data/data/####/app_etv/[B@4a9dd39c.jar
- /data/data/####/app_8bb7d2e4-ef8b-456e-a17d-811bfe526a92/wsroot.sh
Sets the 'executable' attribute to the following files:
- /data/data/####/files/libjiagu.so
- /data/data/####/app_8bb7d2e4-ef8b-456e-a17d-811bfe526a92/Matrix
Miscellaneous:
Executes next shell scripts:
- chmod 755 /data/data/####/files/libjiagu.so
- sh
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
