Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Waps.5.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) vop.b####.com:80
- TCP(HTTP/1.1) l####.b####.com:80
- TCP(HTTP/1.1) www.p####.com:80
- TCP(HTTP/1.1) siguoc####.f####.net:18080
- TCP(HTTP/1.1) app.w####.cn:80
- TCP(TLS/1.0) ope####.b####.com:443
DNS requests:
- ads.w####.cn
- app.w####.cn
- l####.b####.com
- ope####.b####.com
- siguoc####.f####.net
- vop.b####.com
- www.p####.com
HTTP GET requests:
- app.w####.cn/action/ad/show?app_id=####&udid=####&imsi=####&net=####&bas...
- app.w####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=#...
- app.w####.cn/action/pop_ad/ad?app_id=####&udid=####&imsi=####&net=####&b...
- l####.b####.com/jquery/2.0.0/jquery.min.js
- siguoc####.f####.net:18080/login.js?user=####
HTTP POST requests:
- app.w####.cn/action/user_info
- vop.b####.com/v2/down?sn=####
- vop.b####.com/v2/up?sn=####
- www.p####.com/apiv1/sdkstat/install
- www.p####.com/apiv1/sdkstat/launch
- www.p####.com/apiv1/update/check
File system changes:
Creates the following files:
- /data/data/####/.cuid
- /data/data/####/.cuid2
- /data/data/####/.jg.ic
- /data/data/####/AppSettings.xml
- /data/data/####/CacheTime.dat
- /data/data/####/ShowAdFlag.xml
- /data/data/####/com.e4a.runtime.android.mainActivity.xml
- /data/data/####/com.e4a.runtime.android.mainActivity.xml.bak
- /data/data/####/d10505c32a271ff70afb097144bbd504.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/index
- /data/data/####/libcuid.so
- /data/data/####/libjiagu-142494906.so
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/AppPackage.dat
- /data/media/####/CacheTime.dat
- /data/media/####/UnPackage.dat
- /data/media/####/android
- /data/media/####/voice_empty1png
- /data/media/####/voice_full1png
- /data/media/####/voice_none1png
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu-142494906.so
Loads the following dynamic libraries:
- BaiduSpeechSDK
- bdEASRAndroid
- bdSpilWakeup
- libjiagu-142494906
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- DES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Accesses audio/video recording interfaces.
Records audio/video.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.
