Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
DNS requests:
- ebf3ee5####.bug####.com
File system changes:
Creates the following files:
- /data/data/####/1565949885156
- /data/data/####/jg_so_upgrade_setting.xml
- /data/data/####/journal.tmp
- /data/data/####/libjiagu.so
- /data/data/####/multidex.version.xml
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- logcat -v time -t 500 2150
- logcat -v time -t 500 2187
- logcat -v time -t 500 2221
- logcat -v time -t 500 2265
- logcat -v time -t 500 2299
- logcat -v time -t 500 2333
- logcat -v time -t 500 2378
- logcat -v time -t 500 2415
- logcat -v time -t 500 2449
- logcat -v time -t 500 2494
- logcat -v time -t 500 2529
- logcat -v time -t 500 2563
- logcat -v time -t 500 2608
- logcat -v time -t 500 2642
- logcat -v time -t 500 2676
- logcat -v time -t 500 2721
- logcat -v time -t 500 2756
- logcat -v time -t 500 2790
- logcat -v time -t 500 2834
- logcat -v time -t 500 2869
- logcat -v time -t 500 2903
- logcat -v time -t 500 2948
- logcat -v time -t 500 2982
- logcat -v time -t 500 3016
- logcat -v time -t 500 3061
- logcat -v time -t 500 3095
- logcat -v time -t 500 3129
- logcat -v time -t 500 3173
- logcat -v time -t 500 3210
- logcat -v time -t 500 3244
- logcat -v time -t 500 3287
- logcat -v time -t 500 3322
- logcat -v time -t 500 3356
- logcat -v time -t 500 3401
- logcat -v time -t 500 3435
- logcat -v time -t 500 3469
- logcat -v time -t 500 3512
- logcat -v time -t 500 3547
- logcat -v time -t 500 3581
- logcat -v time -t 500 3626
- logcat -v time -t 500 3660
- logcat -v time -t 500 3694
- logcat -v time -t 500 3738
- logcat -v time -t 500 3772
- logcat -v time -t 500 3806
- logcat -v time -t 500 3850
- logcat -v time -t 500 3884
- logcat -v time -t 500 3918
- logcat -v time -t 500 3963
- logcat -v time -t 500 3998
- logcat -v time -t 500 4032
- logcat -v time -t 500 4066
- logcat -v time -t 500 4100
- logcat -v time -t 500 4134
- logcat -v time -t 500 4179
- logcat -v time -t 500 4213
- logcat -v time -t 500 4247
- logcat -v time -t 500 4292
- logcat -v time -t 500 4327
- logcat -v time -t 500 4361
- logcat -v time -t 500 4438
Loads the following dynamic libraries:
- Bugtags
- LanSongffmpeg
- libjiagu
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
