Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Waps.5.origin
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) lib.bao####.com:80
- TCP(HTTP/1.1) i####.c####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
- TCP(HTTP/1.1) gdv.a.s####.com:80
- TCP(HTTP/1.1) cf.cx####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) www.cfzhu####.com:80
- TCP(HTTP/1.1) pco####.ta####.com:80
- TCP(HTTP/1.1) c####.kno####.com:80
- TCP(HTTP/1.1) q4.q####.cn:80
- TCP(HTTP/1.1) www.xi####.com:80
- TCP(HTTP/1.1) vvv.1####.cn:80
- TCP(HTTP/1.1) a####.com:80
- TCP(HTTP/1.1) i2.t####.com.####.com:80
- TCP(HTTP/1.1) i####.51.la:80
- TCP(HTTP/1.1) js.u####.51.####.com:80
- TCP(HTTP/1.1) i1.f####.com.####.com:80
- TCP(HTTP/1.1) ds.k####.cn:80
- TCP(HTTP/1.1) cdn.q####.net:80
- TCP(SSL/3.0) www.cgt####.com:443
- TCP(TLS/1.0) all-pt-####.9####.cn:443
- TCP(TLS/1.0) www.cgt####.com:443
- TCP(TLS/1.0) gdv.a.s####.com:443
- TCP(TLS/1.0) bj.bc####.com:443
DNS requests:
- a####.com
- all-pt-####.9####.cn
- bj.bc####.com
- c####.kno####.com
- c####.mm####.com
- c.c####.com
- cdn.q####.net
- cdn.static####.org
- cf.cx####.com
- chan####.s####.com
- ds.k####.cn
- hm.b####.com
- i####.51.la
- i####.c####.com
- i1.f####.com
- i2.t####.com
- js.u####.51.la
- lib.bao####.com
- n####.yo####.com
- on####.c####.com
- pco####.c####.com
- q4.q####.cn
- s11.c####.com
- s22.c####.com
- vvv.1####.cn
- www.cfzhu####.com
- www.cgt####.com
- www.xi####.com
- wx2.sin####.cn
- wx3.sin####.cn
- wx4.sin####.cn
- z1.c####.com
- z13.c####.com
HTTP GET requests:
- a####.com/666.gif
- c####.kno####.com/count1/count.asp?id=####&sx=####&ys=####
- c####.kno####.com/img/9/1.gif
- c####.kno####.com/img/9/2.gif
- c####.kno####.com/img/9/4.gif
- c####.kno####.com/img/9/6.gif
- c####.kno####.com/img/9/9.gif
- c####.kno####.com/js.asp
- c.c####.com/core.php?web_id=####&online=####&t=####
- c.c####.com/core.php?web_id=####&show=####&t=####
- c.c####.com/online/online_v3.php?id=####&h=####&on=####&s=####
- c.c####.com/z_stat.php?id=####&online=####
- c.c####.com/z_stat.php?id=####&show=####
- cdn.q####.net/assets/appui/js/app.js
- cdn.q####.net/assets/appui/js/plugins.js
- cdn.q####.net/assets/css/common.css
- cdn.q####.net/assets/simple/css/main.css
- cdn.q####.net/assets/simple/css/oneui.css
- cdn.q####.net/assets/simple/css/plugins.css
- cf.cx####.com/
- cf.cx####.com/?zctkze=####
- cf.cx####.com/favicon.ico
- ds.k####.cn/
- ds.k####.cn/ajax.php?act=####
- ds.k####.cn/ajax.php?act=####&cid=####&info=####
- ds.k####.cn/assets/appui/js/app.js
- ds.k####.cn/assets/appui/js/plugins.js
- ds.k####.cn/assets/img/logo2.png
- ds.k####.cn/assets/img/right.png
- ds.k####.cn/assets/js/main.js?ver=####
- ds.k####.cn/assets/simple/css/main.css
- ds.k####.cn/assets/simple/css/oneui.css
- ds.k####.cn/assets/simple/css/plugins.css
- gdv.a.s####.com/upload/version-v3.js?1551663####
- gl####.w.kunl####.####.com/font-awesome/4.7.0/css/font-awesome.min.css
- gl####.w.kunl####.####.com/font-awesome/4.7.0/fonts/fontawesome-webfont....
- gl####.w.kunl####.####.com/jquery-cookie/1.4.1/jquery.cookie.min.js
- gl####.w.kunl####.####.com/jquery.lazyload/1.9.1/jquery.lazyload.min.js
- gl####.w.kunl####.####.com/jquery/1.12.4/jquery.min.js
- gl####.w.kunl####.####.com/layer/2.3/layer.js
- gl####.w.kunl####.####.com/layer/2.3/skin/default/loading-2.gif
- gl####.w.kunl####.####.com/layer/2.3/skin/layer.css
- gl####.w.kunl####.####.com/modernizr/2.8.3/modernizr.min.js
- gl####.w.kunl####.####.com/mw690/0060lm7Tly1fqlrwbblw1g301s01smx6.gif
- gl####.w.kunl####.####.com/mw690/0060lm7Tly1fqlrwbbtl0g305k05kaal.gif
- gl####.w.kunl####.####.com/mw690/0060lm7Tly1fqlrwbc2fag306o06oq39.gif
- gl####.w.kunl####.####.com/mw690/0060lm7Tly1fqlrwblr0yg3046044441.gif
- gl####.w.kunl####.####.com/mw690/0060lm7Tly1fw6wz3ptjsg30d001oq2v.gif
- gl####.w.kunl####.####.com/twitter-bootstrap/3.3.7/css/bootstrap.min.css
- gl####.w.kunl####.####.com/twitter-bootstrap/3.3.7/fonts/glyphicons-half...
- gl####.w.kunl####.####.com/twitter-bootstrap/3.3.7/js/bootstrap.min.js
- gm.mm####.com/9.gif?abc=####&rnd=####
- hm.b####.com/h.js?4b0c844####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- i####.51.la/go1?id=####&rt=####&rl=####&lang=####&ct=####&pf=####&ins=##...
- i####.c####.com/img/pic.gif
- i1.f####.com.####.com/593183/12d033ba45df8560.jpg
- i2.t####.com.####.com/593183/14e48f6de4319bd7.jpg
- i2.t####.com.####.com/593183/60720d1085cc86de.jpg
- i2.t####.com.####.com/593183/944ce63627983074.jpg
- i2.t####.com.####.com/593183/d6ac4e371a876944.png
- js.u####.51.####.com/18855916.js
- lib.bao####.com/font-awesome/4.7.0/css/font-awesome.min.css
- lib.bao####.com/font-awesome/4.7.0/fonts/fontawesome-webfont.ttf?v=####
- lib.bao####.com/jquery-cookie/1.4.1/jquery.cookie.min.js
- lib.bao####.com/jquery/1.12.4/jquery.min.js
- lib.bao####.com/layer/2.3/layer.js
- lib.bao####.com/layer/2.3/skin/default/loading-2.gif
- lib.bao####.com/layer/2.3/skin/layer.css
- lib.bao####.com/modernizr/2.8.3/modernizr.min.js
- lib.bao####.com/twitter-bootstrap/3.3.7/css/bootstrap.min.css
- lib.bao####.com/twitter-bootstrap/3.3.7/fonts/glyphicons-halflings-regul...
- lib.bao####.com/twitter-bootstrap/3.3.7/js/bootstrap.min.js
- pco####.ta####.com/app.gif?&cna=####
- q4.q####.cn/headimg_dl?dst_uin=####&spec=####
- vvv.1####.cn/
- vvv.1####.cn/ajax.php?act=####
- vvv.1####.cn/ajax.php?act=####&cid=####&info=####
- vvv.1####.cn/assets/js/main.js?ver=####
- vvv.1####.cn/assets/simple/img/head2.png
- vvv.1####.cn/favicon.ico
- www.cfzhu####.com/
- www.cfzhu####.com/app
- www.cfzhu####.com/app/
- www.cfzhu####.com/app/base.css
- www.cfzhu####.com/app/bg1.jpg
- www.cfzhu####.com/app/favicon.ico
- www.cfzhu####.com/app/foot.js
- www.cfzhu####.com/app/gravity_h.png
- www.cfzhu####.com/app/logo.png
- www.cfzhu####.com/app/p1_btn3.png
- www.cfzhu####.com/app/p1_btn4.png
- www.cfzhu####.com/app/p1_cfk.png
- www.cfzhu####.com/app/parallax.js
- www.cfzhu####.com/banner1.jpg
- www.cfzhu####.com/banner_bg1.jpg
- www.cfzhu####.com/banner_bg2.jpg
- www.cfzhu####.com/base.css
- www.cfzhu####.com/cf.css
- www.cfzhu####.com/cf.txt
- www.cfzhu####.com/cf_sprites.png
- www.cfzhu####.com/changyan.js
- www.cfzhu####.com/favicon.ico
- www.cfzhu####.com/foot.js
- www.cfzhu####.com/jquery-1.9.1.min.js
- www.cfzhu####.com/logo.png
- www.cfzhu####.com/qcode.png
- www.cfzhu####.com/tongji2.html
- www.xi####.com/cf.txt
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/ApplicationCache.db-journal (deleted)
- /data/data/####/WebpageIcons.db-journal
- /data/data/####/com.e4a.runtime.android.mainActivity.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/index
- /data/data/####/libjiagu.so
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.nomedia
- /data/media/####/1c7a9xeggrj7smbjhxqntmowi.tmp
- /data/media/####/3qb2jcp8bh0vewm7s1p8xw4t5.tmp
- /data/media/####/4rhcq1n7rcmw0ffi7ytobl1yp.tmp
- /data/media/####/50mwsb1rv7b57e3g62ipmfueq.tmp
- /data/media/####/63n0nguq7x7u9wbvu7ut5uc61.tmp
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- libjiagu
Uses special library to hide executable bytecode.
Displays its own windows over windows of other apps.
