Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
DNS requests:
- log.u####.com
- s####.u####.com
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/1557604564719.log
- /data/data/####/2f594bea52530dacb8de68c3daa54a921668b8d8976f9fb....0.tmp
- /data/data/####/8521072658023f2ae98359692d30114bc811a933f6383ec....0.tmp
- /data/data/####/BMWEEXOPEN_NATIVE_SP.xml
- /data/data/####/MultiDex.lock
- /data/data/####/a203a23b22b6c3c78965893a797f11878ab3ab3c9008fff....0.tmp
- /data/data/####/a203a23b22b6c3c78965893a797f11878ab3ab3c9008fff...52b3.0
- /data/data/####/f20de36dfe0dd2ce0e6c51889a15101a3f209c69a1fb1ed....0.tmp
- /data/data/####/journal.tmp
- /data/data/####/libjiagu-417525568.so
- /data/data/####/multidex.version.xml
- /data/data/####/umeng_socialize.xml
- /data/media/####/aboutus.js
- /data/media/####/add.png
- /data/media/####/addorder.js
- /data/media/####/alipay.png
- /data/media/####/award.png
- /data/media/####/award_a.png
- /data/media/####/award_fun.png
- /data/media/####/award_g.png
- /data/media/####/award_global.png
- /data/media/####/award_mvp.png
- /data/media/####/award_round.png
- /data/media/####/award_s.png
- /data/media/####/bindphone.js
- /data/media/####/bundle.zip
- /data/media/####/checked.png
- /data/media/####/checked_static.png
- /data/media/####/citypicker.js
- /data/media/####/clockpicker.js
- /data/media/####/close.png
- /data/media/####/commentedit.js
- /data/media/####/coupon.png
- /data/media/####/coupon_big.png
- /data/media/####/couponpicker.js
- /data/media/####/datepicker.js
- /data/media/####/datingdetail.js
- /data/media/####/datingorder.js
- /data/media/####/districtpicker.js
- /data/media/####/down.png
- /data/media/####/dy.png
- /data/media/####/dy_active.png
- /data/media/####/enrolldetail.js
- /data/media/####/enrollorder.js
- /data/media/####/face_cry.png
- /data/media/####/feedback.js
- /data/media/####/formatpicker.js
- /data/media/####/funpay.png
- /data/media/####/gameorder.js
- /data/media/####/gm.png
- /data/media/####/gm_active.png
- /data/media/####/gmcomplaint.js
- /data/media/####/gmevaluate.js
- /data/media/####/guide.js
- /data/media/####/guide_1.png
- /data/media/####/guide_2.png
- /data/media/####/helpcategory.js
- /data/media/####/helpdetail.js
- /data/media/####/helplist.js
- /data/media/####/home.js
- /data/media/####/iconfont.css
- /data/media/####/iconfont.eot
- /data/media/####/iconfont.js
- /data/media/####/iconfont.svg
- /data/media/####/iconfont.ttf
- /data/media/####/iconfont.woff
- /data/media/####/idsetting.js
- /data/media/####/index.js
- /data/media/####/leaguedetail.js
- /data/media/####/leaguenote.js
- /data/media/####/leagueorder.js
- /data/media/####/line.png
- /data/media/####/loading.gif
- /data/media/####/loading_2.gif
- /data/media/####/locate.png
- /data/media/####/login.js
- /data/media/####/loginphone.js
- /data/media/####/md5.json
- /data/media/####/msgdetail.js
- /data/media/####/mycoupon.js
- /data/media/####/mydating.js
- /data/media/####/myenroll.js
- /data/media/####/mymsg.js
- /data/media/####/myorder.js
- /data/media/####/mysetting.js
- /data/media/####/mywallet.js
- /data/media/####/newsdetail.js
- /data/media/####/orderdetail.js
- /data/media/####/pay.js
- /data/media/####/payafter.js
- /data/media/####/playerpicker.js
- /data/media/####/real_logo.png
- /data/media/####/real_logo_small.png
- /data/media/####/register.js
- /data/media/####/resetpwd.js
- /data/media/####/search.png
- /data/media/####/select.png
- /data/media/####/sub.png
- /data/media/####/test.js
- /data/media/####/three_point.png
- /data/media/####/tm.png
- /data/media/####/tm_active.png
- /data/media/####/tmapply.js
- /data/media/####/tmbond.js
- /data/media/####/tmbondbill.js
- /data/media/####/tmbondrecharge.js
- /data/media/####/tmcreate.js
- /data/media/####/tmcutdown.js
- /data/media/####/tmevaluation.js
- /data/media/####/tmhome.js
- /data/media/####/tmhonor.js
- /data/media/####/tminfo.js
- /data/media/####/tminfoedit.js
- /data/media/####/tmmates.js
- /data/media/####/tmschedule.js
- /data/media/####/tmsearch.js
- /data/media/####/tmsetting.js
- /data/media/####/tmtransfer.js
- /data/media/####/uc.png
- /data/media/####/uc_active.png
- /data/media/####/uccollection.js
- /data/media/####/uchome.js
- /data/media/####/uchonor.js
- /data/media/####/ucinfo.js
- /data/media/####/ucinfoedit.js
- /data/media/####/ucreal.js
- /data/media/####/ucrealedit.js
- /data/media/####/ucsetting.js
- /data/media/####/unchecked.png
- /data/media/####/unchecked_static.png
- /data/media/####/verifyinvitation.js
- /data/media/####/walletbill.js
- /data/media/####/webview.js
- /data/media/####/wepay.png
- /data/media/####/wxc_cell_arrown.png
- /data/media/####/wxc_checked.png
- /data/media/####/wxc_mask_close.png
- /data/media/####/wxc_noticebar_close.png
- /data/media/####/wxc_noticebar_coupon.png
- /data/media/####/wxc_noticebar_error.png
- /data/media/####/wxc_noticebar_notice.png
- /data/media/####/wxc_noticebar_ok.png
- /data/media/####/wxc_noticebar_question.png
- /data/media/####/wxc_noticebar_right.png
- /data/media/####/wxc_noticebar_time.png
- /data/media/####/wxc_noticebar_warning.png
- /data/media/####/wxc_radio_check.png
- /data/media/####/wxc_radio_uncheck.png
- /data/media/####/wxc_unchecked.png
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu-417525568.so
Loads the following dynamic libraries:
- Patcher
- libjiagu-417525568
- weexjsc
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
