Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.3307
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) app.7####.cn:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) a####.7####.cn:80
- TCP(TLS/1.0) h####.b####.com.####.com:443
DNS requests:
- a####.7####.cn
- app.7####.cn
- h####.b####.com
- hm.b####.com
HTTP GET requests:
- a####.7####.cn/
- app.7####.cn/
- app.7####.cn/public/static/css/bootstrap/css/bootstrap.min.css
- app.7####.cn/public/static/css/bootstrap/css/style-min.css?aen=####
- app.7####.cn/public/static/css/bootstrap/image-min/back-img.png
- app.7####.cn/public/static/css/bootstrap/image-min/down-a.png
- app.7####.cn/public/static/css/bootstrap/image-min/footer-p.png
- app.7####.cn/public/static/css/bootstrap/image-min/image-1.png
- app.7####.cn/public/static/css/bootstrap/image-min/image-2.png
- app.7####.cn/public/static/css/bootstrap/image-min/image-3.png
- app.7####.cn/public/static/css/bootstrap/image-min/image-4.png
- app.7####.cn/public/static/css/bootstrap/image-min/img-1.png
- app.7####.cn/public/static/css/bootstrap/image-min/logo-1.png
- app.7####.cn/public/static/css/bootstrap/image-min/logo.png
- app.7####.cn/public/static/css/bootstrap/image/icon-1.png
- app.7####.cn/public/static/css/bootstrap/image/icon-2.png
- app.7####.cn/public/static/css/bootstrap/image/icon-3.png
- app.7####.cn/public/static/css/bootstrap/image/icon-4.png
- app.7####.cn/public/static/css/bootstrap/js/bootstrap.min.js
- app.7####.cn/public/static/js/jquery-1.9.1.min.js
- hm.b####.com/h.js?ce01cb2####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/cache/####/data_0
- <Package Folder>/cache/####/data_1
- <Package Folder>/cache/####/data_2
- <Package Folder>/cache/####/data_3
- <Package Folder>/cache/####/f_000001
- <Package Folder>/cache/####/f_000002
- <Package Folder>/cache/####/f_000003
- <Package Folder>/cache/####/index
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCookiesChromium.db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/mataid.txt
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/bazhangsdk/bazhangsdkdex.jar
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- libjiagu
- uninstallself
Uses special library to hide executable bytecode.
Displays its own windows over windows of other applications.
