Technical information
Malicious functions:
Sends SMS messages:
- 1069099952520: mly-700ada4e
- 1069099952520: mly-700b028f
- 1069099952520: mly-700b2f0b
- 1069099952520: mly-700b70fc
- 1069099952520: mly-700ba0fd
Network activity:
Connecting to:
- 1####.####.211
- a####.####.com
HTTP GET requests:
- 1####.####.211/websdk/exception?playerId=####&gameId=####&channelId=####...
HTTP POST requests:
- a####.####.com/jiagu/check/upgrade
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/mlyres.dat
- <Package Folder>/files/mlyrestemp.jar
- <Package Folder>/shared_prefs/jg_app_update_settings_random.xml
- <Package Folder>/shared_prefs/qihoo_jiagu_crash_report.xml
- <SD-Card>/.mlysdk/####/6312f4fb0d74f598b5b7611d32adb029.properties
- <SD-Card>/.mlysdk/####/marketinfocrypted.dat
- <SD-Card>/.mlysdk/####/marketlinkcrypted.dat
- <SD-Card>/.mlysdk/####/mlysdkconfig.dat
- <SD-Card>/.mlysdk/####/mlyuser.dat
- <SD-Card>/.mlysdk/####/smsinfocrypted.dat
Miscellaneous:
Executes next shell scripts:
- <dexopt>
- chmod 755 /data/data/com.game.kxlxx.bj_ykainew_7e4/.jiagu/libjiagu.so
Uses special library to hide executable bytecode.
