Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Spy.505.origin
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) sm####.com:80
- TCP(TLS/1.0) and####.cli####.go####.com:443
DNS requests:
- and####.cli####.go####.com
- sm####.com
HTTP POST requests:
- sm####.com/HT/bk/deduplicationMsg.do
- sm####.com/HT/bk/saveMsg.do
- sm####.com/HT/bk/testing.do
Modified file system:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/Contacts.xml
- /data/data/####/libjiagu250474146.so
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu250474146.so
Loads the following dynamic libraries:
- libjiagu250474146
Uses special library to hide executable bytecode.
Gains access to interfaces of audio/video data writing.
Writes audio/video data.
Gains access to geolocation.
Displays its own windows over windows of other applications.
Gains access to information about incoming/outgoing calls.
Gains access to information about sent/received SMS messages.
