Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.890.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) 1####.194.180.28:443
- TCP(TLS/1.2) 1####.194.222.100:443
- TCP(TLS/1.2) 64.2####.161.95:443
- TCP(TLS/1.2) 64.2####.162.94:443
DNS requests:
- and####.cli####.go####.com
- f####.gst####.com
- https:/####.go####.com
- https:/####.go####.com.####.8
- https:/####.googl####.net
- https:/####.googl####.net.####.8
- p####.google####.com
- pla####.googleu####.com
File system changes:
Creates the following files:
- /data/data/####/.jg.ac
- /data/data/####/Ztrcy.so
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/classes.dex;classes4.dex
- /data/data/####/compVersion
- /data/data/####/dsecdxp.dex
- /data/data/####/dsecdxp.dex.flock (deleted)
- /data/data/####/dsecdxp.jar
- /data/data/####/kxqpChannal.xml
- /data/data/####/kxqpplatform2.dex
- /data/data/####/kxqpplatform2.dex.flock (deleted)
- /data/data/####/libjiagu_64.so
- /data/data/####/libkxqpplatform.so
- /data/data/####/mob_commons_1
- /data/data/####/platform.xml
- /data/data/####/proc_auxv
- /data/data/####/tmp1052611097tmp
- /data/data/####/tmp1052611097tmp (deleted)
- /data/data/####/tmp1060937655tmp
- /data/data/####/tmp1060937655tmp (deleted)
- /data/data/####/tmp1134162540tmp
- /data/data/####/tmp1134162540tmp (deleted)
- /data/data/####/tmp1329122512tmp
- /data/data/####/tmp1329122512tmp (deleted)
- /data/data/####/tmp1351792049tmp
- /data/data/####/tmp1351792049tmp (deleted)
- /data/data/####/tmp1417984184tmp (deleted)
- /data/data/####/tmp1517280499tmp
- /data/data/####/tmp1517280499tmp (deleted)
- /data/data/####/tmp1529069347tmp
- /data/data/####/tmp1529069347tmp (deleted)
- /data/data/####/tmp1556540211tmp (deleted)
- /data/data/####/tmp160409046tmp
- /data/data/####/tmp160409046tmp (deleted)
- /data/data/####/tmp1777739730tmp
- /data/data/####/tmp1777739730tmp (deleted)
- /data/data/####/tmp1827234420tmp
- /data/data/####/tmp1827234420tmp (deleted)
- /data/data/####/tmp2130401229tmp
- /data/data/####/tmp2130401229tmp (deleted)
- /data/data/####/tmp218183872tmp
- /data/data/####/tmp218183872tmp (deleted)
- /data/data/####/tmp241668879tmp
- /data/data/####/tmp241668879tmp (deleted)
- /data/data/####/tmp377500565tmp
- /data/data/####/tmp377500565tmp (deleted)
- /data/data/####/tmp474057214tmp
- /data/data/####/tmp474057214tmp (deleted)
- /data/data/####/tmp527691004tmp
- /data/data/####/tmp527691004tmp (deleted)
- /data/data/####/tmp551544985tmp
- /data/data/####/tmp551544985tmp (deleted)
- /data/data/####/tmp552437527tmp
- /data/data/####/tmp552437527tmp (deleted)
- /data/data/####/tmp958978746tmp
- /data/data/####/tmp958978746tmp (deleted)
- /data/data/####/verinfo.cfg
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.platformcache/dsecdxp.jar
- chmod 755 <Package Folder>/.platformcache/kxqpplatform2.jar
Loads the following dynamic libraries:
- Ztrcy
- libjiagu_64
Requests the system alert window permission.
