Technical information
Malicious functions:
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) i####.51.la:80
- TCP(HTTP/1.1) js.u####.51.la:80
- TCP(HTTP/1.1) www.gr####.top:80
- TCP(HTTP/1.1) www.17s####.com:80
- TCP(HTTP/1.1) cdn-boo####.b0.a####.com:80
DNS requests:
- cdn.boo####.com
- i####.51.la
- js.u####.51.la
- www.17s####.com
- www.gr####.top
HTTP GET requests:
- cdn-boo####.b0.a####.com/layer/3.0.1/mobile/layer.min.js
- cdn-boo####.b0.a####.com/layer/3.0.1/mobile/need/layer.css
- cdn-boo####.b0.a####.com/layer/3.0.1/mobile/need/layer.css?2####
- i####.51.la/go1?id=####&rt=####&rl=####&lang=####&ct=####&pf=####&ins=##...
- js.u####.51.la/19311636.js
- www.17s####.com/preview/206286/2017-01-19/login/css/style.css
- www.17s####.com/preview/206286/2017-01-19/login/js/jquery-1.7.2.min.js
- www.17s####.com/preview/206286/2017-01-19/login/js/login.js
- www.17s####.com/preview/206286/2017-01-19/login/js/phone.js
- www.gr####.top/
- www.gr####.top/favicon.ico
- www.gr####.top/index.jpg
Modified file system:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/libjiagu.so
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- libjiagu
Uses special library to hide executable bytecode.
Displays its own windows over windows of other applications.
