Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.337.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 64.2####.162.94:80
- TCP(HTTP/1.1) data####.k####.cn:80
- TCP(TLS/1.0) 64.2####.161.95:443
- TCP(TLS/1.2) 74.1####.205.138:443
- TCP(TLS/1.2) 1####.194.163.27:443
- TCP(TLS/1.2) 64.2####.162.147:443
- TCP(TLS/1.2) 64.2####.161.95:443
- TCP arm.z####.cn:10003
- TCP arm.z####.cn:10001
- TCP arm.z####.cn:10018
- TCP arm.z####.cn:10012
- TCP arm.z####.cn:10014
- TCP arm.z####.cn:10020
- UDP 64.2####.161.95:443
DNS requests:
- arm.z####.cn
- data####.k####.cn
- m####.go####.com
- www.go####.com
HTTP GET requests:
- data####.k####.cn/mobileflow/flow/domain
File system changes:
Creates the following files:
- /data/data/####/.jg.ac
- /data/data/####/1004
- /data/data/####/1038cec090ae59e1b241b89046693640
- /data/data/####/12c043391f167a7709a1f709c03c40e4
- /data/data/####/12dc846af7ccf07f2042a86f3d60efdd
- /data/data/####/14447f0ce93d0dd1d0707b2748d5fbab
- /data/data/####/153932c30511f6ef153a7ddd5c220199
- /data/data/####/3ccbf9c421ade1517941ffc6afb5dcbb
- /data/data/####/43b70ca191c8bc46992ff860962fb9cb
- /data/data/####/4bd063435c7ddc9c2b6c7f01188b52a9
- /data/data/####/6162f33e1f5b249103ea80f040bb6e5a
- /data/data/####/7ea4266251191fbffcf7c815a6006837
- /data/data/####/814befed0ed5554df2a4d72069913207
- /data/data/####/912dc3c5386a6f54f99405820b207fe6
- /data/data/####/985c84ed19fdff0076aee586dbecf988
- /data/data/####/BUGLY_COMMON_VALUES.xml
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/CERT.RSA
- /data/data/####/a97342f9438b049e4f3633607bdd8895
- /data/data/####/c1e50811c55561de921518ed9c36e012
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes10.dex
- /data/data/####/classes.dex;classes11.dex
- /data/data/####/classes.dex;classes12.dex
- /data/data/####/classes.dex;classes13.dex
- /data/data/####/classes.dex;classes14.dex
- /data/data/####/classes.dex;classes15.dex
- /data/data/####/classes.dex;classes16.dex
- /data/data/####/classes.dex;classes17.dex
- /data/data/####/classes.dex;classes18.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/classes.dex;classes4.dex
- /data/data/####/classes.dex;classes5.dex
- /data/data/####/classes.dex;classes6.dex
- /data/data/####/classes.dex;classes7.dex
- /data/data/####/classes.dex;classes8.dex
- /data/data/####/classes.dex;classes9.dex
- /data/data/####/crashrecord.xml
- /data/data/####/d32ebda419121f5dbff8de6169608284
- /data/data/####/f6fc2c932d8ac23289d105466b14a130
- /data/data/####/fb88df2185e80508b959235668e3618a
- /data/data/####/libjiagu_64.so
- /data/data/####/native_record_lock
- /data/data/####/native_record_lock (deleted)
- /data/data/####/origin.apk
- /data/data/####/proc_auxv
- /data/media/####/xlog.mmap3
- /data/media/####/xlog_20240101.xlog
- /data/user_de/####/move_to_de_records.xml
Miscellaneous:
Loads the following dynamic libraries:
- libBugly
- libSignatureKiller
- libc++_shared
- libfakeapi
- libjiagu_64
- libkpk
- libmarsxlog
- libmmkv
Uses the following algorithms to encrypt data:
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Displays its own windows over windows of other apps.
Requests the system alert window permission.
