Technical information
Malicious functions:
Sends SMS messages:
- 10690133603: auto##0092533314##mpc_yxhezi_and_200253741##该短信用于360游戏注册/登录
Network activity:
Connecting to:
- a####.####.cn
- a####.####.com
- and####.####.com
- d####.####.com:8083
- m####.####.cn
- ope####.####.cn
- p####.####.cn
- p####.####.com
- s####.####.cn
- sh####.####.com
HTTP GET requests:
- a####.####.cn/10/popup/notice?appid=####&nonce=####&rkey=####&signid=####
- and####.####.com/group/?method=####&n=####
- m####.####.cn/list/get?product=####&source=####&version=####
- ope####.####.cn/index/upgrade?package=####&version=####&apk_version=####...
- p####.####.com/t0174936816868190aa.jpg
- p####.####.com/t0178c548e210e9c425.png
- s####.####.cn/ak/02522a2b2726fb0a03bb19f2d8d9524d.html?m2=####
- sh####.####.com/160422/57b92647917cce029e2634ba82d77e69/libpatch.so
HTTP POST requests:
- a####.####.com/ad-service/ad/mark
- d####.####.com:8083/
- p####.####.cn/pstat/plog.php
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/9e321132b5fd45e1e7a38f5d185d2066_pic
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/QHA_JSON_PERSISTER_02522a2b2726fb0a03bb19f2d8d9524d
- <Package Folder>/files/####/Y29tLmltb2QzNjA=.tick.lock
- <Package Folder>/files/####/pvpjh1.dat
- <Package Folder>/files/####/pvpjh2.dat
- <Package Folder>/files/####/pvpjh3.dat
- <Package Folder>/files/####/pvpjh4.dat
- <Package Folder>/files/####/pvpjh5.dat
- <Package Folder>/files/frameso
- <Package Folder>/files/statistics.log (deleted)
- <Package Folder>/libs/####/libpatch
- <Package Folder>/libs/####/libpatch1
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/Pay_config.xml
- <Package Folder>/shared_prefs/QH_DeviceSDK.xml
- <Package Folder>/shared_prefs/QH_SDK_M2.xml
- <Package Folder>/shared_prefs/QH_SDK_UserData.xml
- <Package Folder>/shared_prefs/QH_SDK_UserData.xml.bak
- <Package Folder>/shared_prefs/QH_SDK_UserData02522a2b2726fb0a03bb19f2d8d9524d.xml
- <Package Folder>/shared_prefs/QH_SDK_UserData02522a2b2726fb0a03bb19f2d8d9524d.xml.bak
- <Package Folder>/shared_prefs/QH_SDK_sessionID.xml
- <Package Folder>/shared_prefs/QH_SDK_sessionID.xml.bak
- <Package Folder>/shared_prefs/WukongSDKPre.xml
- <Package Folder>/shared_prefs/coolcloud_config.xml
- <Package Folder>/shared_prefs/gamecenter_sdk_plugin_pre.xml
- <Package Folder>/shared_prefs/gamecenter_sdk_plugin_pre.xml.bak
- <Package Folder>/shared_prefs/iapppay_config.xml
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/q_p2_plib_plugin_lib_sp.xml
- <Package Folder>/shared_prefs/qh_login_cfg.xml
- <Package Folder>/shared_prefs/qh_login_cfg.xml.bak
- <Package Folder>/shared_prefs/qihoo_hosts_cfg.xml
- <Package Folder>/shared_prefs/qihoo_hosts_cfg.xml.bak
- <Package Folder>/shared_prefs/qihoo_https_cer_pre.xml
- <Package Folder>/shared_prefs/qihoo_https_cer_pre.xml.bak
- <Package Folder>/shared_prefs/qlocal_float_sdk_share_preference.xml
- <Package Folder>/shared_prefs/qlocal_float_sdk_share_preference.xml.bak
- <Package Folder>/shared_prefs/sdk_apk_info.xml
- <Package Folder>/shared_prefs/share_data_updatesdk.xml
- <Package Folder>/update.qh
- <SD-Card>/360/####/02522a2b2726fb0a03bb19f2d8d9524d
- <SD-Card>/360/####/8sg
- <SD-Card>/360/####/8sg (deleted)
- <SD-Card>/360/####/Y29tLmltb2QzNjA=
- <SD-Card>/360/####/Y29tLmltb2QzNjA= (deleted)
- <SD-Card>/360/####/dcsdid.dat
- <SD-Card>/360/.deviceId
- <SD-Card>/360Download/libpatch.so
- <SD-Card>/360Download/libpatch1.so
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/2srnjblqxn03998ej90uotas2.0.tmp
- <SD-Card>/Android/####/journal.tmp
Miscellaneous:
Executes next shell scripts:
- chmod 755 /data/data/com.imod360/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 777 /storage/emulated/0/360gamecentersdk/.cache/image
Uses special library to hide executable bytecode.
