Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.SmsSend.1848.origin
Downloads the following detected threats from the Web:
- Android.SmsSend.11446
Prompts to install third-party applications.
Network activity:
Connecting to:
- s####.####.com
- statis####.####.com
- 1####.####.93:8004
- p####.####.com
- r####.####.com
- 1####.####.93
- f####.####.com
- cdn-st####.####.com
- l####.####.com
- m####.####.com
- st####.####.com
- a####.####.com
HTTP GET requests:
- cdn-st####.####.com/doc/static/get_busi_config.html
- r####.####.com/upload/haogame/20160813/14/1473749696423.png
- f####.####.com/2017100/dd/GQ1092.apk
- 1####.####.93/m/umeng:56cfdc2567e58eb021002106/198/AhKcwzm6cgiZ6v88Cd8tB9u82uHtSrm9BEUrU0jK4Ikn?s=MDUzN####&c=####&pm=####&sv=####&ov=####
- st####.####.com/doc/static/welcome_adv.html
- st####.####.com/doc/static/banner_adv.html
- r####.####.com/upload/haogame/20161018/16/1479457410097.jpg
- a####.####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=####&v=####&sign=####&data=####&api=####&imsi=####
- st####.####.com/doc/static/channels.html
- st####.####.com/doc/static/hotRecommend_adv.html
- a####.####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####&v=####&sign=####&data=####&api=####&imsi=####
- r####.####.com/upload/haogame/20161130/11/1483067616163.png
- a####.####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=####&appKey=####&v=####&sign=####&data=####&api=####&imsi=####
- r####.####.com/upload/haogame/20161029/15/1480403517257.jpg
- st####.####.com/doc/static/get_taojin.html
- r####.####.com/upload/haogame/20160625/17/1469438552017.png
- st####.####.com/doc/static/special_adv.html
- a####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=####&app_version_code=####&apn=####&agoo_version_code=####&imsi=####
- 1####.####.93:8004/m/umeng:56cfdc2567e58eb021002106/198/AhKcwzm6cgiZ6v88Cd8tB9u82uHtSrm9BEUrU0jK4Ikn?s=MDUzN####&c=####&pm=####&sv=####&ov=####
- r####.####.com/upload/haogame/20160613/13/1468387005523.png
- a####.####.com/activeip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=####&app_version_code=####&apn=####&agoo_version_code=####&imsi=####
- st####.####.com/doc/static/inside_adv.html
HTTP POST requests:
- m####.####.com/v2/launch
- s####.####.com/pkl16.html
- a####.####.com/jiagu/t/infos
- a####.####.com/ad-service/ad/mark
- cdn-st####.####.com/doc/hdadvreport.htm
- statis####.####.com/statistics/init.json
- p####.####.com/thirdapp
- l####.####.com/sdk.php
- a####.####.com/app_logs
- m####.####.com/v2/register
- cdn-st####.####.com/doc/adv_report.htm
- l####.####.com/offline_loc
Modified file system:
Creates the following files:
- /data/data/####/files/.jiagu.lock
- /sdcard/baidu/tempdata/conlts.dat
- /sdcard/baidu/tempdata/ls.db
- /data/data/####/files/libcuid.so
- /data/data/####/files/lldt/firll.dat
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/shared_prefs/AGOO_HOST.xml
- /data/data/####/files/.jglogs/.log3
- /data/data/####/shared_prefs/umeng_message_state.xml.bak
- /data/data/####/shared_prefs/Alvin2.xml
- /sdcard/baidu/tempdata/ls.db-journal
- /sdcard/backups/.SystemConfig/.cuid2
- /data/data/####/shared_prefs/AGOO_CONNECT.xml
- /data/data/####/cache/webviewCacheChromium/data_2
- /data/data/####/cache/webviewCacheChromium/data_3
- /data/data/####/databases/MsgLogStore.db-journal
- /data/data/####/cache/webviewCacheChromium/data_1
- /data/data/####/shared_prefs/umeng_general_config.xml
- /data/data/####/databases/webviewCookiesChromium.db-journal
- /data/data/####/files/adinfo.txt
- /data/data/####/files/ofld/ofl_statistics.db-journal
- /data/data/####/shared_prefs/umeng_message_state.xml
- /data/data/####/files/ofld/ofl_location.db-journal
- /data/data/####/shared_prefs/jg_app_update_settings_random.xml
- /data/data/####/shared_prefs/AppStore.xml
- /data/data/####/shared_prefs/ContextData.xml
- /sdcard/ImgCach/####/1479457410097.jpg.cach
- /data/data/####/shared_prefs/PhoneUtil.xml
- /data/data/####/files/.imprint
- /sdcard/.UTSystemConfig/Global/Alvin2.xml
- /data/data/####/shared_prefs/AppStore.xml.bak
- /data/data/####/files/.jglogs/.jg.ri
- /data/data/####/databases/wifi.db-journal
- /data/data/####/files/libjiagu.so
- /data/data/####/app_appcache/ApplicationCache.db-journal
- /sdcard/.DataStorage/ContextData.xml
- /data/data/####/databases/MsgLogStore.db
- /data/data/####/shared_prefs/syezon_agent_online_setting_####.xml
- /data/data/####/files/.jglogs/.jg.ac
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /data/data/####/shared_prefs/umeng_general_config.xml.bak
- /data/data/####/shared_prefs/jg_core_control.xml
- /data/data/####/files/ofld/ofl_statistics.db
- /data/data/####/databases/UmengLocalNotificationStore.db-journal
- /sdcard/ImgCach/####/1480403517257.jpg.cach
- /sdcard/ImgCach/####/1468387005523.png.cach
- /data/data/####/files/ofld/ofl.config
- /sdcard/ImgCach/####/1473749696423.png.cach
- /sdcard/ImgCach/####/1483067616163.png.cach
- /data/data/####/files/ofld/ofl_location.db
- /data/data/####/databases/webview.db-journal
- /data/data/####/files/umeng_it.cache
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/databases/hot_download.db
- /sdcard/test.0
- /data/data/####/cache/webviewCacheChromium/data_0
- /sdcard/baidu/tempdata/ller.dat
- /data/data/####/cache/webviewCacheChromium/index
- /data/data/####/shared_prefs/jg_core_control.xml.bak
- /data/data/####/files/mobclick_agent_cached_####198
- /sdcard/backups/.SystemConfig/.cuid
- /data/data/####/files/DaemonServer
- /sdcard/ImgCach/####/1469438552017.png.cach
- /data/data/####/databases/hot_download.db-journal
- /sdcard/.android/mobclick_agent_cache/####/flowadd
- /data/data/####/files/agoo.pid
Sets the 'executable' attribute to the following files:
- /data/data/####/files/libjiagu.so
- /data/data/####/files/DaemonServer
Miscellaneous:
Executes next shell scripts:
- sh
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
