Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Backdoor.564.origin
Downloads the following detected threats from the Web:
- Android.Backdoor.564.origin
Network activity:
Connecting to:
- a####.####.cn
- ga####.####.com
- hotp####.####.com
- i####.####.com
- on####.####.com:88
- s####.####.com
HTTP GET requests:
- a####.####.cn/info/verfiy_api_id?api_id=####&api_secret=####
- hotp####.####.com/patch?version=####&patchver=####&platform=####&appId=#...
- i####.####.com/service/getIpInfo.php?ip=####
HTTP POST requests:
- ga####.####.com/?st=####&sv=####&tm=####&sid=####&apn=####&ct=####&tc=##...
- on####.####.com:88/?mid=####&st=####&sv=####&tm=####&sid=####&apn=####&c...
- s####.####.com/api.php?format=####&t=####
Modified file system:
Creates the following files:
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/app_jgls/.log.lock
- <Package Folder>/app_jgls/.log.ls
- <Package Folder>/cache/####/1496217059594
- <Package Folder>/cache/####/1496217066313
- <Package Folder>/cache/####/1496217073140
- <Package Folder>/cache/####/1496217079857
- <Package Folder>/cache/####/1496217086484
- <Package Folder>/cache/####/1496217093525
- <Package Folder>/cache/####/1496217100265
- <Package Folder>/cache/####/1496217103709
- <Package Folder>/cache/####/1496217111991
- <Package Folder>/cache/####/1496217115570
- <Package Folder>/cache/####/1496217117875
- <Package Folder>/cache/####/1496217117876.jpeg
- <Package Folder>/cache/####/761561561481284856
- <Package Folder>/cache/####/journal.tmp
- <Package Folder>/databases/####/cc.db
- <Package Folder>/databases/####/cc.db-journal
- <Package Folder>/databases/lib.point-journal
- <Package Folder>/databases/notes-db-journal
- <Package Folder>/files/####/.jg.ic
- <Package Folder>/files/####/05-31_07_50_<Package>_2101
- <Package Folder>/files/####/05-31_07_50_<Package>_TcmsService_2134
- <Package Folder>/files/####/05-31_07_51_<Package>_2269
- <Package Folder>/files/####/05-31_07_51_<Package>_2374
- <Package Folder>/files/####/05-31_07_51_<Package>_2460
- <Package Folder>/files/####/05-31_07_51_<Package>_2554
- <Package Folder>/files/####/05-31_07_51_<Package>_2650
- <Package Folder>/files/####/05-31_07_51_<Package>_2748
- <Package Folder>/files/####/05-31_07_51_<Package>_2846
- <Package Folder>/files/####/05-31_07_51_<Package>_2978
- <Package Folder>/files/####/05-31_07_51_<Package>_3067
- <Package Folder>/files/####/libBaiduMapSDK_base_v4_3_0.so
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsData_78ZPDHTPZ3RJQKPZTWN9_216
- <Package Folder>/files/.YFlurrySenderIndex.info.AnalyticsMain
- <Package Folder>/files/.yflurrydatasenderblock.7afaccdf-0f93-4f20-95d9-751ef069a87a
- <Package Folder>/files/.yflurrydatasenderblock.8a7747dd-e53c-41cb-834a-dfb550d73381
- <Package Folder>/files/.yflurrydatasenderblock.9f4e6634-9583-4f6c-a1e5-3df2af0dda42
- <Package Folder>/files/.yflurrydatasenderblock.fc2ae05f-6466-45b0-b93e-264dc9e56db6
- <Package Folder>/files/.yflurrydatasenderblock.fe79de57-6df4-4482-94d5-078db9e4c35a
- <Package Folder>/files/.yflurryreport.33c1f91bf818825f
- <Package Folder>/files/init_c1.pid
- <Package Folder>/files/init_er.pid
- <Package Folder>/files/libcuid.so
- <Package Folder>/files/lotuseed.apps
- <Package Folder>/files/lotuseed.lock
- <Package Folder>/files/lotuseed.s
- <Package Folder>/files/lotuseed.task
- <Package Folder>/files/mobclick_agent_cached_<Package>37
- <Package Folder>/lib-main/dso_deps
- <Package Folder>/lib-main/dso_lock
- <Package Folder>/lib-main/dso_manifest
- <Package Folder>/lib-main/dso_state
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/<Package>_preferences.xml.bak
- <Package Folder>/shared_prefs/FLURRY_SHARED_PREFERENCES.xml
- <Package Folder>/shared_prefs/app_preferences.xml
- <Package Folder>/shared_prefs/authStatus_<Package>.xml
- <Package Folder>/shared_prefs/finance_cache_preference.xml
- <Package Folder>/shared_prefs/finance_cache_preference.xml.bak
- <Package Folder>/shared_prefs/getui_sp.xml
- <Package Folder>/shared_prefs/lotuseed_global.xml
- <Package Folder>/shared_prefs/lotuseed_main.xml
- <Package Folder>/shared_prefs/mobclick_agent_user_<Package>.xml
- <Package Folder>/shared_prefs/multidex.version.xml
- <Package Folder>/shared_prefs/notification_config.xml
- <Package Folder>/shared_prefs/qihoo_jiagu_crash_report.xml
- <Package Folder>/shared_prefs/tcms_istied.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <SD-Card>/.system/lotuseed.devid
- <SD-Card>/<Package>/####/2_20170531_r
- <SD-Card>/backups/####/.cuid
- <SD-Card>/backups/####/.cuid2
Miscellaneous:
Executes next shell scripts:
- chmod 755 /data/data/com.microfundrn/.jiagu/libjiagu.so
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- df
- getprop ro.product.cpu.abi
- logcat -v time -t 500 2101
- logcat -v time -t 500 2269
- logcat -v time -t 500 2374
- logcat -v time -t 500 2460
- logcat -v time -t 500 2554
- logcat -v time -t 500 2650
- logcat -v time -t 500 2748
- logcat -v time -t 500 2846
- logcat -v time -t 500 2978
- logcat -v time -t 500 3067
- ps
- sh
Uses special library to hide executable bytecode.