Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 2####.243.193.35:80
- TCP(HTTP/1.1) c####.im.qq.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) t.si####.net:80
- TCP(HTTP/1.1) ts.k####.cn:80
- TCP(HTTP/1.1) m####.k####.cn:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) c####.k####.cn.####.net:80
- TCP(HTTP/1.1) f.xingch####.com.####.com:80
DNS requests:
- a####.u####.com
- c####.im.qq.com
- c####.k####.cn
- f.xingch####.com
- m####.k####.cn
- mt####.go####.com
- oc.u####.com
- t.si####.net
- ts.k####.cn
HTTP GET requests:
- c####.im.qq.com/cgi-bin/cgi_svrtime
- c####.k####.cn.####.net/tingshu/catIcon/1.png
- c####.k####.cn.####.net/tingshu/catIcon/16.png
- c####.k####.cn.####.net/tingshu/catIcon/2.png
- c####.k####.cn.####.net/tingshu/catIcon/27.png
- c####.k####.cn.####.net/tingshu/catIcon/44.png
- c####.k####.cn.####.net/tingshu/catIcon/59.png
- c####.k####.cn.####.net/tingshu/catIcon/8.png
- c####.k####.cn.####.net/tingshu/catIcon/97.png
- c####.k####.cn.####.net/tingshu/catIcon/98.png
- c####.k####.cn.####.net/tingshu/img/11/262811.jpg
- c####.k####.cn.####.net/tingshu/img/20/100100620.jpg
- c####.k####.cn.####.net/tingshu/img/21/100100321.jpg
- c####.k####.cn.####.net/tingshu/img/25/100100425a.jpg
- c####.k####.cn.####.net/tingshu/img/26/111626.jpg
- c####.k####.cn.####.net/tingshu/img/29/100166829.jpg
- c####.k####.cn.####.net/tingshu/img/29/e5l1yq.jpg
- c####.k####.cn.####.net/tingshu/img/30/100132030.jpg
- c####.k####.cn.####.net/tingshu/img/40/100100540A.jpg
- c####.k####.cn.####.net/tingshu/img/45/100103245a.jpg
- c####.k####.cn.####.net/tingshu/img/46/100100146a.jpg
- c####.k####.cn.####.net/tingshu/img/55/100136555.jpg
- c####.k####.cn.####.net/tingshu/img/58/100112058.jpg
- c####.k####.cn.####.net/tingshu/img/63/100100363a.jpg
- c####.k####.cn.####.net/tingshu/img/72/100103172q.jpg
- c####.k####.cn.####.net/tingshu/img/72/100130372.jpg
- c####.k####.cn.####.net/tingshu/img/78/100129878.jpg
- c####.k####.cn.####.net/tingshu/img/80/100100180.jpg
- c####.k####.cn.####.net/tingshu/img/92/100000092.jpg
- c####.k####.cn.####.net/tingshu/img/92/100103392.jpg
- c####.k####.cn.####.net/tingshu/img/94/424794a.jpg
- f.xingch####.com.####.com/201801/8c28-ea9e37366bab.jar
- m####.k####.cn/mobi.s?f=####&q=XWGUx####
- ts.k####.cn/service/gethome.php?act=####
- ts.k####.cn/service/getlist.v31.php?act=####
- ts.k####.cn/service/getlist.v31.php?act=####&pos=####
HTTP POST requests:
- a####.u####.com/app_logs
- oc.u####.com/check_config_update
- t.si####.net/t1?requestId=####&g=####&ua=####
- t.si####.net/t2
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/databases/downloadswc
- <Package Folder>/databases/downloadswc-journal
- <Package Folder>/databases/kw_tingshu.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/.imprint
- <Package Folder>/files/umeng_it.cache
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/W_Key.xml
- <Package Folder>/shared_prefs/jg_so_upgrade_setting.xml
- <Package Folder>/shared_prefs/mobclick_agent_online_setting_<Package>.xml
- <Package Folder>/shared_prefs/st.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/uuid.xml
- <Package Folder>/shared_prefs/xx.xml
- <SD-Card>/.DataStorage/ContextData.xml
- <SD-Card>/.UTSystemConfig/####/Alvin2.xml
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/1a06cj8k17lrbm1mun2jvprjx.tmp
- <SD-Card>/Android/####/1kk2u9gcal44j6acaujta9ehp.tmp
- <SD-Card>/Android/####/1nkoqr8gpd8e10e9oceo1x1x5.tmp
- <SD-Card>/Android/####/1to707mxwublgnx0kdg7i8ygq.tmp
- <SD-Card>/Android/####/2mkruxxtf8qd45ls79ywhs36p.tmp
- <SD-Card>/Android/####/2su9re2l47awl8chbsu72c5h9.tmp
- <SD-Card>/Android/####/2t4rwfo3l23vo7qqit9dlr77g.tmp
- <SD-Card>/Android/####/2z16cq1oguw1d6jypkwi27tw7.tmp
- <SD-Card>/Android/####/3cy3ytof2s7uoyf82n503at2k.tmp
- <SD-Card>/Android/####/3d9g6dljim54tu0v3ann2lok9.tmp
- <SD-Card>/Android/####/3mknrfp4mpn5cisk1tljhruwn.tmp
- <SD-Card>/Android/####/439o2atq69l2lfnbpq6a8vt8k.tmp
- <SD-Card>/Android/####/4akq7vxmzmioh09uiujzibqlx.tmp
- <SD-Card>/Android/####/4aufnlg1208hef3nfbl72c3h8.tmp
- <SD-Card>/Android/####/4g7uo03eu0ttgs8txs4xvfi5l.tmp
- <SD-Card>/Android/####/4tul91sestf1swz47xd5rhfvp.tmp
- <SD-Card>/Android/####/544d51un2rlhffrrvp6bkmgp7.tmp
- <SD-Card>/Android/####/55dd56rf50y19kzqdco8yhlk1.tmp
- <SD-Card>/Android/####/55lno7navy17j0uf4obstbopr.tmp
- <SD-Card>/Android/####/5br8k67j4wfphukx4umzn8js3.tmp
- <SD-Card>/Android/####/5k20zryun0lmrawr0zekpyra6.tmp
- <SD-Card>/Android/####/5rndjvr4djojmr3oqskstv64c.tmp
- <SD-Card>/Android/####/5tlx8yxjh9x7o536kgwd6hm68.tmp
- <SD-Card>/Android/####/5yxpx2r7l7cuskl5oqdud5xc4.tmp
- <SD-Card>/Android/####/7f4xenr8lztls85xpjetdoxm5.tmp
- <SD-Card>/Android/####/g1joosi29gcwy9eh5hwmkhe4.tmp
- <SD-Card>/Android/####/j52s8mzi5cpfuisab6mq2bdv.tmp
- <SD-Card>/Android/####/n9smm5cjht41ngc74g1qlxch.tmp
- <SD-Card>/Android/####/sn16jm0ly63ictct64qmk0j7.tmp
- <SD-Card>/Android/####/zq0egskpjx38vzqd2tk15imi.tmp
- <SD-Card>/Download/####/10.08c28-ea9e37366bab.jar.t
- <SD-Card>/KwTingShu/####/104263205
- <SD-Card>/KwTingShu/####/105010748
- <SD-Card>/KwTingShu/####/1147985540
- <SD-Card>/KwTingShu/####/1376978974
- <SD-Card>/KwTingShu/####/test.aac
- <SD-Card>/KwTingShu/.setting.dat
- <SD-Card>/dt/restime.dat
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- fg
- libjiagu
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
