Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Kyview.2.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 1####.190.123.237:80
- TCP(HTTP/1.1) rcv.icli####.com:81
- TCP(HTTP/1.1) v.j####.cn:80
- TCP(HTTP/1.1) c####.h####.com:80
- TCP(HTTP/1.1) 1####.28.114.73:80
- TCP(HTTP/1.1) v.pic.fas####.####.com:80
- TCP(HTTP/1.1) cdn.aicli####.com:80
- TCP(HTTP/1.1) sdk.s####.cn:80
- TCP(HTTP/1.1) rtb.fas####.net:80
- TCP(HTTP/1.1) log.yex.yo####.com:80
- TCP(HTTP/1.1) t####.youd####.cn:80
- TCP(HTTP/1.1) rcv.icli####.com:80
- TCP(HTTP/1.1) y####.51on####.com:80
- TCP(TLS/1.0) d####.dengy####.com:443
DNS requests:
- api.aicli####.com
- c####.h####.com
- cdn.aicli####.com
- cfg.aicli####.com
- d####.dengy####.com
- l.fas####.net
- log.yex.yo####.com
- r.fas####.net
- rcv.icli####.com
- s.s####.cn
- sdk.s####.cn
- t####.youd####.cn
- v.j####.cn
- v.pic.fas####.net
- y####.51on####.com
HTTP GET requests:
- c####.h####.com/upload/scripts/tpl.js
- cdn.aicli####.com/uploads/b046eb7c39851921eaec3866a4d8f63e_1001888_225_1...
- cdn.aicli####.com/uploads/b525aba81f7e82eddc89fd5af520b49b_1001888_225_1...
- log.yex.yo####.com/ct?slot=####&yexi=####&yexcb=####
- log.yex.yo####.com/it?yexi=####&yexv=####&yexcb=####
- rcv.icli####.com/req?aid=####&callback=####&
- rcv.icli####.com/show?CAAQCA.####
- rcv.icli####.com/show?CAAQIw.####
- rcv.icli####.com/show?CAAQPg.####
- rcv.icli####.com/trace?t=####&duration=####&iclicashsid=####&w=####&h=##...
- rcv.icli####.com/trace?t=####&iclicashsid=####&w=####&h=####&sw=####&sh=...
- rcv.icli####.com/trace?t=####&s=####&iclicashsid=####&w=####&h=####&sw=#...
- rcv.icli####.com:81/click?CAAQNg.####
- rtb.fas####.net/imp?e=####&ext2=####&pid=####&sid=####
- rtb.fas####.net/j?e=wyu6M4eYiWZgzqrG3OdDMF_-9-fEzbMBbjJSZWudrM4HD5jODecj...
- rtb.fas####.net/l?action=####&p1=####&p2=####&slotid=####&pvid=####&adid...
- v.j####.cn/toutiao/index?key=####&type=####
- v.pic.fas####.####.com/magic/57/57a7315b46e93770fce171368e4077ec.jpg?p=#...
- y####.51on####.com/?iclicashsid=####
- y####.51on####.com/css/main.css
- y####.51on####.com/images/camera.png
- y####.51on####.com/images/canon.png
- y####.51on####.com/images/charger.png
- y####.51on####.com/images/icon-alipay.png
- y####.51on####.com/images/icon-wx.png
- y####.51on####.com/images/icon.png
- y####.51on####.com/images/iphone.png
- y####.51on####.com/images/oppo.png
- y####.51on####.com/images/qrcode.jpg
- y####.51on####.com/images/vivo.png
- y####.51on####.com/images/vr.png
- y####.51on####.com/images/watch.png
- y####.51on####.com/js/ad.js?aid=####
- y####.51on####.com/js/app.js
- y####.51on####.com/js/doT.js
- y####.51on####.com/js/index.js
- y####.51on####.com/js/jquery-1.8.3.min.js
- y####.51on####.com/js/lib.js
- y####.51on####.com/js/trace.js
HTTP POST requests:
- rcv.icli####.com/v2/json
- sdk.s####.cn/v10/android/banner
- sdk.s####.cn/v10/android/config?publisherID=####
- sdk.s####.cn/v10/android/hsbanner
- t####.youd####.cn/sdk.gif
HTTP OPTIONS requests:
- rcv.icli####.com/v2/json
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_database/####/http_yuan.51oneone.com_0.loc...ournal
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/f_000004
- <Package Folder>/cache/####/f_000005
- <Package Folder>/cache/####/f_000006
- <Package Folder>/cache/####/f_000007
- <Package Folder>/cache/####/f_000008
- <Package Folder>/cache/####/f_000009
- <Package Folder>/cache/####/f_00000a
- <Package Folder>/cache/####/f_00000b
- <Package Folder>/cache/####/f_00000c
- <Package Folder>/cache/####/f_00000d
- <Package Folder>/cache/####/f_00000e
- <Package Folder>/cache/####/f_00000f
- <Package Folder>/cache/####/f_000010
- <Package Folder>/cache/####/f_000011
- <Package Folder>/cache/####/f_000012
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/WebViewSettings.xml
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- libjiagu
Uses the following algorithms to encrypt data:
- DES
Uses special library to hide executable bytecode.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
