Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
File system changes:
Creates the following files:
- /data/data/####/libjiagu.so
- /data/data/####/multidex.version.xml
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- ps 2147
- ps 2233
- ps 2253
- ps 2273
- ps 2305
- ps 2325
- ps 2345
- ps 2376
- ps 2411
- ps 2431
- ps 2462
- ps 2482
- ps 2502
- ps 2533
- ps 2554
- ps 2574
- ps 2604
- ps 2624
- ps 2644
- ps 2674
- ps 2695
- ps 2715
- ps 2747
- ps 2768
- ps 2788
- ps 2819
- ps 2840
- ps 2860
- ps 2890
- ps 2911
- ps 2931
- ps 2962
- ps 2983
- ps 3003
- ps 3034
- ps 3056
- ps 3076
- ps 3106
- ps 3127
- ps 3147
- ps 3176
- ps 3197
- ps 3217
- ps 3247
- ps 3269
- ps 3289
Loads the following dynamic libraries:
- libjiagu
- tusdk-library
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
Uses special library to hide executable bytecode.
