Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.3394
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/databases/webviewCache.db
- <Package Folder>/databases/webviewCache.db-journal
- <Package Folder>/shared_prefs/multidex.version.xml
- <SD-Card>/ZW4U99SQQ3.com.linecorp.trident.shared/com.linecorp.t...ychain
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- libjiagu
- line-game-growthy-android
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
