Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.657.origin
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) poll-di####.cooteks####.com:80
- TCP(HTTP/1.1) unipa####.wos####.cn:8080
- TCP(HTTP/1.1) un####.wos####.cn:8061
- TCP(HTTP/1.1) se####.wos####.cn:81
- UDP(NTP) 1.cn.p####.####.org:123
DNS requests:
- 1.cn.p####.####.org
- i####.cn
- pg.x####.com
- poll-di####.cooteks####.com
- se####.wos####.cn
- un####.wos####.cn
- unipa####.wos####.cn
HTTP GET requests:
- poll-di####.cooteks####.com/dualsim/appkey_dsi?appkey=####&host=####&man...
HTTP POST requests:
- se####.wos####.cn:81/unipay/precheck?secrettype=####&sdktime=####&urlsig...
- un####.wos####.cn:8061/logserver/unipay/unipayLogin
- un####.wos####.cn:8061/logserver/wostore/logCrash
- unipa####.wos####.cn:8080/sdk_upgrade_server/sdkupdate.action
File system changes:
Creates the following files:
- /data/data/####/4.6.0L2111B1010_resource_400.apk
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/TDpref_longtime.xml
- /data/data/####/TDpref_shorttime.xml
- /data/data/####/TDtcagent.db
- /data/data/####/TDtcagent.db-journal
- /data/data/####/app_crash_1955b4b387d5c87b3d62ccda603d0f30.txt
- /data/data/####/app_crash_1b7503a5472aa55d1cd7b63d772f6708.txt
- /data/data/####/app_crash_1d04a3fe621ed5d2c1f64edb01b5304a.txt
- /data/data/####/app_crash_220b41fc9b4974f0e0d7af79d74329d0.txt
- /data/data/####/app_crash_2a5ec6b7c326b6979c899df6e981b61c.txt
- /data/data/####/app_crash_2e8706bec0b929e8ce8682db8b27cde4.txt
- /data/data/####/app_crash_31e4e5a4337b92a300720b619ffa8158.txt
- /data/data/####/app_crash_37df3efc8de79eb82e0e61673c2ff8f8.txt
- /data/data/####/app_crash_409a26bb26604c5c235efb0255c2e1ce.txt
- /data/data/####/app_crash_516c4a6d9107942d3f244f1971560738.txt
- /data/data/####/app_crash_5d066e775f734a48cde86197559a6374.txt
- /data/data/####/app_crash_5fec67d3cc14b9247ff4669c02d5459a.txt
- /data/data/####/app_crash_694d810ab54dda8e13ce4035d2073e24.txt
- /data/data/####/app_crash_6a4f470f3032a8d4dbd8d09c4132ed31.txt
- /data/data/####/app_crash_7dd4d35cec40493947726a5713fbdd95.txt
- /data/data/####/app_crash_8756893f7eaf0a05a41af3a1976d203c.txt
- /data/data/####/app_crash_9bf5114c3c3df8dad9b0af91baafe0f4.txt
- /data/data/####/app_crash_a3c6a057a8d6c4f9c0dac17978a9304c.txt
- /data/data/####/app_crash_a45ab3fc6dca51b4d93efee62370b3f4.txt
- /data/data/####/app_crash_a56043b962c44747472c855f49b42459.txt
- /data/data/####/app_crash_a9eceb2804c3eb840b7d5a17d959814a.txt
- /data/data/####/app_crash_b14fe529ab16feeadac5c4b15a12a431.txt
- /data/data/####/app_crash_c859738edd53c8623f0ca62e17e02e50.txt
- /data/data/####/app_crash_cf2fbf9555137f7890d1cbcdeaa4780b.txt
- /data/data/####/app_crash_e520a09a91bfc0cfdd76352dc397b0c3.txt
- /data/data/####/libjiagu471371021.so
- /data/data/####/local.jar
- /data/data/####/login
- /data/data/####/msg_store.xml
- /data/data/####/sdk_load_info.xml
- /data/data/####/sdkclasses.dex
- /data/data/####/sdkclasses.dve
- /data/data/####/sdkclasses.jar
- /data/data/####/talkingdata_app.db-journal
- /data/data/####/talkingdata_app_process_preferences_file
- /data/data/####/talkingdata_app_version_preferences_file
- /data/data/####/td.lock
- /data/data/####/tdid.xml
- /data/data/####/unicom_cl.xml
- /data/media/####/.tcookieid
- /data/media/####/data0.dat
- /data/media/####/data1.dat
- /data/media/####/data111.dat
- /data/media/####/dualsim.dat
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu471371021.so
- netstat -apn
Loads the following dynamic libraries:
- libjiagu471371021
- me_unipay
- megjb
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
- DESede-CBC-NoPadding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS7Padding
- DESede-CBC-NoPadding
- RSA-ECB-PKCS1Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
