Technical information
Malicious functions:
Executes code of the following detected threats:
- Tool.SilentInstaller.3.origin
Downloads the following detected threats from the Web:
- Tool.SilentInstaller.3.origin
Network activity:
Connecting to:
- datase####.####.com
- datase####.####.com:10009
- t####.####.net
- toumise####.####.com
HTTP GET requests:
- toumise####.####.com/mainline2/toumi-app/p2pBandingActivity/css/index.css
HTTP POST requests:
- datase####.####.com/payappsdk/app/checkappkey
- datase####.####.com:10009/payappsdk/app/devsave
- t####.####.net/g/d
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/index
- <Package Folder>/databases/analysis_cache.mSqLiteDatabase
- <Package Folder>/databases/analysis_cache.mSqLiteDatabase-journal
- <Package Folder>/databases/analysis_cache.mSqLiteDatabase-journal (deleted)
- <Package Folder>/databases/analysis_cache.mSqLiteDatabase-shm (deleted)
- <Package Folder>/databases/analysis_cache.mSqLiteDatabase-wal (deleted)
- <Package Folder>/databases/itoumi2.db-journal
- <Package Folder>/databases/itoumi_msg.db-journal
- <Package Folder>/databases/stock_chart.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/TDtcagent.db
- <Package Folder>/files/TDtcagent.db-journal
- <Package Folder>/files/splash0993a757561581bfa93d87caa1b73f3c
- <Package Folder>/files/td.lock
- <Package Folder>/shared_prefs/TD_CHANNEL_ID.xml
- <Package Folder>/shared_prefs/general.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/pref_longtime.xml
- <Package Folder>/shared_prefs/pref_longtime.xml.bak
- <Package Folder>/shared_prefs/pref_shorttime.xml
- <Package Folder>/shared_prefs/pref_shorttime.xml.bak
- <Package Folder>/shared_prefs/running_backgrand.xml
- <Package Folder>/shared_prefs/shenyun_analysis.xml
- <Package Folder>/shared_prefs/shenyun_analysis.xml.bak
- <Package Folder>/shared_prefs/sp_all_assets.xml
- <Package Folder>/shared_prefs/sp_user.xml
- <Package Folder>/shared_prefs/sp_user.xml.bak
- <Package Folder>/shared_prefs/talkingdata_file_prefence.xml
- <Package Folder>/shared_prefs/talkingdata_file_prefence.xml.bak
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/tinker_hotfix_local.xml
- <SD-Card>/.tcookieid
- <SD-Card>/yixintoumi/####/crash.trace
- <SD-Card>/yixintoumi/####/crash_obj.trace
Miscellaneous:
Executes next shell scripts:
- cat /proc/cpuinfo
- chmod 755 /data/data/com.yixin.itoumi/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- getprop
Uses special library to hide executable bytecode.
