Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Waps.5.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.ddse####.cn:80
- TCP(HTTP/1.1) e####.top:80
DNS requests:
- e####.top
- www.ddse####.cn
HTTP GET requests:
- e####.top/jihuo.php?a=####&b=####
- www.ddse####.cn/favicon.ico
- www.ddse####.cn/ss/share/qi-yuancaotang-01/towx.png
Modified file system:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/libjiagu-1537636161.so
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu-1537636161.so
Loads the following dynamic libraries:
- libjiagu-1537636161
Uses special library to hide executable bytecode.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.
