Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
- Android.Xiny.53.origin
Downloads the following detected threats from the Web:
- Android.Xiny.20
- Android.Xiny.53.origin
Network activity:
Connecting to:
- 2####.####.32
- a####.####.com
- b####.####.com
- y####.####.com
HTTP GET requests:
- 2####.####.32/bwc.info525.com/download//jarFile/SDKAutoUpdate/test29.tar...
- b####.####.com/download//jarFile/SDKAutoUpdate/test29.tar.gz
HTTP POST requests:
- a####.####.com/ad-service/ad/mark
- y####.####.com/collectcc.do
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/databases/lcdownloads
- <Package Folder>/databases/lcdownloads-journal
- <Package Folder>/databases/ldownloads
- <Package Folder>/databases/ldownloads-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/shared_prefs/L_Key.xml
- <Package Folder>/shared_prefs/L_Key.xml.bak
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/ki.xml
- <Package Folder>/shared_prefs/l_cp_st.xml
- <Package Folder>/shared_prefs/ljk.xml
- <Package Folder>/shared_prefs/new_l_req_st.xml
- <Package Folder>/shared_prefs/upg_jar_root.xml
- <Package Folder>/shared_prefs/upg_jar_version.xml
- <Package Folder>/shared_prefs/upja_r.xml
- <Package Folder>/shared_prefs/x.xml
- <SD-Card>/Android/####/IM.DAT
- <SD-Card>/Android/####/ljk.dat
- <SD-Card>/Android/security
- <SD-Card>/Download/####/jar_dex.tar.gz
- <SD-Card>/Download/####/test.jar
- <SD-Card>/Download/####/u.dat
- <SD-Card>/ljk/####/reqt.dat
- <SD-Card>/ljk/####/spt.dat
- <SD-Card>/ljk/####/time.dat
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- chmod 755 /data/data/ws.wdpys.kxlemwqfe/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Uses special library to hide executable bytecode.
