Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Panda.5.origin
- Android.RemoteCode.188.origin
- Android.RemoteCode.867
Downloads the following detected threats from the Web:
- Adware.Panda.5.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) www.md####.cn:80
- TCP(HTTP/1.1) cdn.zs####.cn:8080
- TCP(HTTP/1.1) rd####.f####.com:8080
- TCP(HTTP/1.1) gdv.a.s####.com:80
- TCP(TLS/1.0) w####.io:443
- TCP(TLS/1.0) s####.tc.qq.com:443
DNS requests:
- cdn.zs####.cn
- chan####.s####.com
- r####.wx.qq.com
- rd####.f####.com
- w####.io
- www.md####.cn
HTTP GET requests:
- cdn.zs####.cn:8080/resource/gist/2018
- gdv.a.s####.com/api/2/topic/load?page_size=####&s####&hot_size=####&topi...
- gdv.a.s####.com/stat/uvstat?platform=####&uuid=####&client_id=####
- rd####.f####.com:8080/GaoXiao/upload//20170105091718_290353.png
- rd####.f####.com:8080/GaoXiao/upload/00368bf68e469a589ccd49d44fa52470.gif
- rd####.f####.com:8080/GaoXiao/upload/48409abea2e46810cef1b2d3411b9a2f.gif
- rd####.f####.com:8080/GaoXiao/upload/82a20e797d08018cad838b679eebff71.jpg
- rd####.f####.com:8080/GaoXiao/upload/92dffba8ea85207d84e62633807bebee.jpg
- rd####.f####.com:8080/GaoXiao/upload/99d9ee57e2661ee6e21b8913a92bf0e1.jpg
- rd####.f####.com:8080/GaoXiao/upload/aa34028ec258f8416d5c459f5e9709d9.gif
- rd####.f####.com:8080/GaoXiao/upload/af50e6cf7a7ecef9b4943fc61ceeff45.gif
- rd####.f####.com:8080/GaoXiao/upload/dfaa39e192d4e52c3e0952c5f7ecc361.gif
- rd####.f####.com:8080/GaoXiao/upload/ec73bceb8b13594d052838795574b8c0.gif
- rd####.f####.com:8080/GaoXiao/upload/f378dcf24a8a20e36be496fa2462aac1.gif
- rd####.f####.com:8080/GaoXiao/wap/images/layers/content.png
- rd####.f####.com:8080/GaoXiao/wap/images/layers/navigation.png
- rd####.f####.com:8080/GaoXiao/wap/images/layers/popout.png
- rd####.f####.com:8080/GaoXiao/wap/images/layers/transparent.gif
- rd####.f####.com:8080/GaoXiao/wap/kflist
- rd####.f####.com:8080/GaoXiao/weixinui/dist/example/example.css
- rd####.f####.com:8080/GaoXiao/weixinui/dist/example/example.js
- rd####.f####.com:8080/GaoXiao/weixinui/dist/example/zepto.min.js
- rd####.f####.com:8080/GaoXiao/weixinui/dist/style/weui.css
HTTP POST requests:
- rd####.f####.com:8080/GaoXiao/interface/getParentList
- rd####.f####.com:8080/GaoXiao/interface/getThreeClassList
- rd####.f####.com:8080/GaoXiao/interface/getUpdateInfo
- rd####.f####.com:8080/GaoXiao/interface/getgoods
- www.md####.cn/pservers/loadip
Modified file system:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/A6N.zip
- /data/data/####/daiwolikai.zip
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/index
- /data/data/####/libjiagu-153970571.so
- /data/data/####/news.db-journal
- /data/data/####/register.xml
- /data/data/####/silename.xml
- /data/data/####/uuid.xml
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/-1054533677.tmp
- /data/media/####/-128680631.tmp
- /data/media/####/-1604014133.tmp
- /data/media/####/-1621238415.tmp
- /data/media/####/-41041165.tmp
- /data/media/####/10169691.tmp
- /data/media/####/1449834712.tmp
- /data/media/####/1684100630.tmp
- /data/media/####/2067202296.tmp
- /data/media/####/337170877.tmp
- /data/media/####/82a20e797d08018cad838b679eebff71.jpg
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /proc/cpuinfo
- chmod 755 <Package Folder>/.jiagu/libjiagu-153970571.so
Loads the following dynamic libraries:
- libjiagu-153970571
- pl_droidsonroids_gif
Uses the following algorithms to encrypt data:
- AES
Uses the following algorithms to decrypt data:
- AES-CFB-NoPadding
Uses special library to hide executable bytecode.
Displays its own windows over windows of other applications.
