Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSpy.677.origin
- Android.SmsSpy.677.origin
Downloads the following detected threats from the Web:
- Android.SmsSpy.677.origin
- Android.SmsSpy.677.origin
Network activity:
Connecting to:
- a####.####.com
- hangzho####.####.com
- q####.####.com
- q####.####.com:14302
- q####.####.com:9500
- s####.####.com
- z####.####.com
- z####.####.com:9500
- zxc####.####.com
- zxc####.####.com:8200
HTTP GET requests:
- hangzho####.####.com/qiyi/client/sdk/so/libzxvps.so
- q####.####.com/vpsSdk/file?timestamp=####&buildModel=####&buildVersionCo...
- s####.####.com/vpssdk/andrcool_1.0.1.jar
HTTP POST requests:
- a####.####.com/ad-service/ad/mark
- q####.####.com/sdk_login?t=####
- q####.####.com:14302/sdk_login?t=####
- q####.####.com:9500/
- z####.####.com/
- z####.####.com:9500/
- zxc####.####.com/qy/getOnlineLoginHttpReq
- zxc####.####.com:8200/qy/acceptSdkFileReq
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/PaySDK-1.2.12.40-UR_yx.jar
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/__gather_impl-1833014869130316169087.jar
- <Package Folder>/cache/cache-2136124840130316095380 (deleted)
- <Package Folder>/cache/cache1075378647130315947619 (deleted)
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/MyGame.db-journal
- <Package Folder>/databases/qy_db_pay-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/andrcool.jar
- <Package Folder>/files/__gather_impl.jar
- <Package Folder>/files/getprop
- <Package Folder>/files/pid
- <Package Folder>/libzxvps/####/libzxvps.so
- <Package Folder>/libzxvps/####/tmp_so
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/libgather.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/shared_prefs/unknown.xml
- <Package Folder>/tmp_jar
- <SD-Card>/.Systemp/.cfg
- <SD-Card>/.Systemp/device
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- app_process /system/bin com.android.commands.am.Am startservice --user 0 -n <Package>/com.google.android.gms.analytics.CampaignTrackingService
- cat /sys/block/mmcblk0/device/cid
- chmod 755 /data/data/com.fjdofd.gc/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 777 <Package Folder>/lib/helper
- dd if=<Package Folder>/lib/libhelper.so of=<Package Folder>/lib/helper
- getprop
- ls -l /system/bin/su
- ps | grep <Package>
- ps | grep com.fjdofd.gc
- sh
Uses special library to hide executable bytecode.
