Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.b####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) 1####.217.19.206:443
DNS requests:
- and####.cli####.go####.com
- sdk.o####.p####.####.com
- www.b####.com
HTTP GET requests:
- www.b####.com//zgw/files/2017/12/09/ecd5c0875847130776a248f312b9d59b51a0...
- www.b####.com//zgw/files/2018/01/08/817c69517d0996d84b0df14b3df4df43505f...
- www.b####.com//zgw/files/2018/03/13/5ef9c3a1f3436149a64d911eff1552e5a2cc...
- www.b####.com//zgw/files/2018/03/22/67982c55996b797c82cd0f6de75ac286581d...
- www.b####.com//zgw/files/2018/03/25/5844879be9462e37d16a23b4c0e2d70b1749...
- www.b####.com//zgw/files/2018/03/27/e4e9094cc71d3326331a854e114c5279c314...
- www.b####.com//zgw/files/2018/04/14/02dce1b06cc05142c35f09ec4a5a64a022f6...
- www.b####.com//zgw/files/2018/04/16/6b88344afef8ce5efd3c5fbd874343c770a5...
- www.b####.com//zgw/files/2018/05/12/356e60ebf109a38d5350ddb79a182f3259be...
- www.b####.com//zgw/files/2018/05/12/e3a989e857e43bd3106cd6b84445513bc609...
- www.b####.com//zgw/files/2018/07/04/f1971751ce33735454e21d4ba04248dc7084...
- www.b####.com//zgw/files/2018/09/05/192c902bd965f5dca3aa17c2c87ca4ce7aae...
- www.b####.com//zgw/files/2018/09/11/ebeb5dd282fac857ba17e18da92e7394bd54...
- www.b####.com//zgw/files/2018/09/26/3a87533e7cc4c92938365ef7224ec2b66edd...
- www.b####.com//zgw/files/2018/09/26/43d6024139b4767a22c5616d49535892f8d8...
- www.b####.com//zgw/files/2018/10/11/49b166a881c337ceebc5ecb416353c3ff8a1...
- www.b####.com//zgw/files/2018/10/11/591f13bcf91b2805a4cffcdb180772d6ea3d...
- www.b####.com//zgw/files/2018/10/11/7136f44fe1caaa151222096d15c646bb3c05...
- www.b####.com//zgw/files/2018/10/11/b21f7b7ace2222b98bbadfe0a8795f5b0610...
- www.b####.com//zgw/files/2018/10/11/be2c9964d2388d99e46113d098d5e53abe83...
- www.b####.com//zgw/files/2018/10/11/c14e2b8e6c90caf37ce8e5d1c6e91333f731...
- www.b####.com//zgw/files/2018/10/11/c5bead69a6c9b9cec139d8788a8706ff8315...
- www.b####.com//zgw/files/2018/10/11/e22e4ae7ae5fad2d0a153f5f20b51eb1f8f3...
- www.b####.com//zgw/files/2018/10/11/e35a13d5de92fcfbb42bccf40eb9818c8b30...
- www.b####.com//zgw/public/static/foreground/image/logo/17033065.jpg
- www.b####.com//zgw/public/static/foreground/image/logo/24757669.jpg
- www.b####.com/libs/js3party/ajaxfileupload/ajaxfileupload.js
- www.b####.com/libs/js3party/bootstrap/3.3.6/bootstrap.min.js
- www.b####.com/libs/js3party/jquery-nicescroll/3.6.8/js/jquery.nicescroll...
- www.b####.com/libs/js3party/jquery-ui/1.11.4/js/jquery-ui.min.js
- www.b####.com/libs/js3party/jquery/jquery-2.2.4.min.js
- www.b####.com/libs/js3party/weixin/jweixin-1.0.0.js
- www.b####.com/libs/jsapi/base.js
- www.b####.com/libs/jsapi/json2.js
- www.b####.com/libs/jsapi/md5.js
- www.b####.com/libs/jsapi/service.js
- www.b####.com/zgw/find/banner?token=####
- www.b####.com/zgw/find/bearSeek?count=####&maxid=####&sinceid=####
- www.b####.com/zgw/find/commodityAll?cityid=####&comtype=####&formerattri...
- www.b####.com/zgw/find/commodityAttr?id=####
- www.b####.com/zgw/find/commodityAttres
- www.b####.com/zgw/find/commodityCommend?comtype=####&count=####&id=####&...
- www.b####.com/zgw/find/commodityDetail?id=####&protype=####&token=####
- www.b####.com/zgw/find/commodityPrice?goodsid=####&protype=####
- www.b####.com/zgw/find/commodityType?id=####&leveled=####
- www.b####.com/zgw/find/getBrand?vnumb=####
- www.b####.com/zgw/find/groomBrand
- www.b####.com/zgw/find/groomCommodity?count=####&maxid=####&sinceid=####
- www.b####.com/zgw/find/seekList
- www.b####.com/zgw/find/wantBuy?areas=####&brandname=####&count=####&maxi...
- www.b####.com/zgw/find/zouDsp?id=####&type=####
- www.b####.com/zgw/public/static/foreground/css/reset.css
- www.b####.com/zgw/public/static/foreground/js/pause.js
HTTP POST requests:
- sdk.o####.p####.####.com/api.php?format=####&t=####
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/1b8fe8949e4f0864b3a22e4b93356344.0.tmp
- /data/data/####/1b8fe8949e4f0864b3a22e4b93356344.1.tmp
- /data/data/####/32be38450d7609df4f0a023067824864.0.tmp
- /data/data/####/32be38450d7609df4f0a023067824864.1.tmp
- /data/data/####/46214218b7f0ad298e16ed25cfc8a069.0.tmp
- /data/data/####/46214218b7f0ad298e16ed25cfc8a069.1.tmp
- /data/data/####/5338dcdb847de7f976908f187a1e5a75.0.tmp
- /data/data/####/5338dcdb847de7f976908f187a1e5a75.1.tmp
- /data/data/####/59d2dca071590b246a68dd64eaef7cac.0.tmp
- /data/data/####/59d2dca071590b246a68dd64eaef7cac.1.tmp
- /data/data/####/7236a054a8b4eb4d2512203ec68e0b63.0.tmp
- /data/data/####/7236a054a8b4eb4d2512203ec68e0b63.1.tmp
- /data/data/####/77ca04a2f287643e13cd6efef2dd98c7.0.tmp
- /data/data/####/77ca04a2f287643e13cd6efef2dd98c7.1.tmp
- /data/data/####/7c22bf0453c75e0a47ac2ff36d83e9ab.0.tmp
- /data/data/####/7c22bf0453c75e0a47ac2ff36d83e9ab.1.tmp
- /data/data/####/ab13e637996a7c8450615ac3488d3440.0.tmp
- /data/data/####/ab13e637996a7c8450615ac3488d3440.1.tmp
- /data/data/####/app_prefs.xml
- /data/data/####/b8055f96a8c591dfff0c49a68ce2bc3c.0.tmp
- /data/data/####/b8055f96a8c591dfff0c49a68ce2bc3c.1.tmp
- /data/data/####/d41ec061f38d6310ebb4d81e03f6cb7e.0.tmp
- /data/data/####/d41ec061f38d6310ebb4d81e03f6cb7e.1.tmp
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/databasesbearing_brand.db
- /data/data/####/databasesbearing_brand.db-journal
- /data/data/####/f40582b752c92668205091d6aca354d1.0.tmp
- /data/data/####/f40582b752c92668205091d6aca354d1.1.tmp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/getui_sp.xml
- /data/data/####/index
- /data/data/####/initDb.db-journal
- /data/data/####/init_c1.pid
- /data/data/####/init_er.pid
- /data/data/####/journal.tmp
- /data/data/####/libjiagu32334417.so
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu32334417.so
Loads the following dynamic libraries:
- getuiext2
- libjiagu32334417
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
