Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.803
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a.appj####.com:80
- TCP(HTTP/1.1) ser####.j####.360.cn:80
- TCP(HTTP/1.1) 5####.58.34.219:5000
DNS requests:
- a.appj####.com
- mt####.go####.com
- ser####.j####.360.cn
HTTP POST requests:
- a.appj####.com/ad-service/ad/mark
- ser####.j####.360.cn/jiagu/check/upgrade
Modified file system:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/.jiagu.lock
- /data/data/####/applist.dat
- /data/data/####/jg_app_update_settings_random.xml
- /data/data/####/libjiagu.so
- /data/data/####/open.dat
- /data/data/####/store.dat
- /data/data/####/txt1
- /data/data/####/txt2
- /data/data/####/txt3
- /data/data/####/txt4
- /data/data/####/txt5
- /data/data/####/txt6
- /data/data/####/txt7
- /data/data/####/txt8
- /data/media/####/app1
- /data/media/####/app2
- /data/media/####/app3
- /data/media/####/app4
- /data/media/####/app5
- /data/media/####/app6
- /data/media/####/app7
- /data/media/####/app8
Miscellaneous:
Loads the following dynamic libraries:
- cocos2dcpp
- libjiagu
Uses special library to hide executable bytecode.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
