Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.208
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) s.3####.cn:80
DNS requests:
- ims.1####.com
- no####.1####.com
- p####.1####.com
- s.3####.cn
- t####.typl####.com
HTTP GET requests:
- s.3####.cn/jiagu/s.html?model=####&osVersion=####&b=####&c=####&rid=####...
Modified file system:
Creates the following files:
- /data/data/####/522jni.jar
- /data/data/####/522tempjni.jar
- /data/data/####/Iad_lock.db
- /data/data/####/Iad_lock.db-journal
- /data/data/####/i.so
- /data/data/####/iad.db-journal
- /data/data/####/iad_frame.db-journal
- /data/data/####/iad_unkit.xml
- /data/data/####/iad_ypu.db-journal
- /data/data/####/ipssp.xml
- /data/data/####/libni.so
- /data/data/####/libprotectClass.so
- /data/data/####/libqupc.so
- /data/data/####/qihooLock.xml
- /data/data/####/ypksp.xml
- /data/media/####/justin.txt
Miscellaneous:
Executes next shell scripts:
- chmod 777 <Package Folder>/files/libqupc.so
- getprop ro.product.cpu.abi
Loads the following dynamic libraries:
- libni
- libprotectClass
Uses special library to hide executable bytecode.
Gains access to telephone information (number, imei, etc.).
