Android.Packed.25894

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Spy.165.origin

Gains access to the ITelephony private interface

Network activity:

Connecting to:

a####.####.com
c####.####.com
gongjia####.com

HTTP GET requests:

gongjia####.com/web/city//1.asp

HTTP POST requests:

a####.####.com/app_logs
c####.####.com/ad/splash/stats.html

Modified file system:

Creates the following files:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/cache/####/WebpageIcons.db-journal
<Package Folder>/cache/####/WebpageIcons.db-journal (deleted)
<Package Folder>/databases/webview.db-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/firll.dat
<Package Folder>/files/.imprint
<Package Folder>/files/umeng_it.cache
<Package Folder>/shared_prefs/ad_show_time.xml
<Package Folder>/shared_prefs/com.e4a.runtime.android.mainActivity.xml
<Package Folder>/shared_prefs/com.e4a.runtime.android.mainActivity.xml.bak
<Package Folder>/shared_prefs/jg_app_update_settings_random.xml
<Package Folder>/shared_prefs/umeng_general_config.xml
<Package Folder>/shared_prefs/umeng_general_config.xml.bak
<SD-Card>/baidu/####/ls.db
<SD-Card>/baidu/####/ls.db-journal
<SD-Card>/baidu/####/yoh.dat
<SD-Card>/baidu/####/yol.dat
<SD-Card>/baidu/####/yom.dat
<SD-Card>/baidu/.cuid
<SD-Card>/cityisba/####/1.TXT
<SD-Card>/cityisba/####/102.TXT
<SD-Card>/cityisba/####/102a.TXT
<SD-Card>/cityisba/####/105.TXT
<SD-Card>/cityisba/####/105a.TXT
<SD-Card>/cityisba/####/106.TXT
<SD-Card>/cityisba/####/11.TXT
<SD-Card>/cityisba/####/113.TXT
<SD-Card>/cityisba/####/12.TXT
<SD-Card>/cityisba/####/13.TXT
<SD-Card>/cityisba/####/14.TXT
<SD-Card>/cityisba/####/15.TXT
<SD-Card>/cityisba/####/17.TXT
<SD-Card>/cityisba/####/18.TXT
<SD-Card>/cityisba/####/2.TXT
<SD-Card>/cityisba/####/21.TXT
<SD-Card>/cityisba/####/22.TXT
<SD-Card>/cityisba/####/225.TXT
<SD-Card>/cityisba/####/23.TXT
<SD-Card>/cityisba/####/24.TXT
<SD-Card>/cityisba/####/24a.TXT
<SD-Card>/cityisba/####/25.TXT
<SD-Card>/cityisba/####/26.TXT
<SD-Card>/cityisba/####/27.TXT
<SD-Card>/cityisba/####/27a.TXT
<SD-Card>/cityisba/####/29.TXT
<SD-Card>/cityisba/####/29a.TXT
<SD-Card>/cityisba/####/3.TXT
<SD-Card>/cityisba/####/30.TXT
<SD-Card>/cityisba/####/302.TXT
<SD-Card>/cityisba/####/302a.TXT
<SD-Card>/cityisba/####/303.TXT
<SD-Card>/cityisba/####/31.TXT
<SD-Card>/cityisba/####/311.TXT
<SD-Card>/cityisba/####/312.TXT
<SD-Card>/cityisba/####/317.TXT
<SD-Card>/cityisba/####/319.TXT
<SD-Card>/cityisba/####/32.TXT
<SD-Card>/cityisba/####/33.TXT
<SD-Card>/cityisba/####/34.TXT
<SD-Card>/cityisba/####/35.TXT
<SD-Card>/cityisba/####/36.TXT
<SD-Card>/cityisba/####/38.TXT
<SD-Card>/cityisba/####/5.TXT
<SD-Card>/cityisba/####/50.TXT
<SD-Card>/cityisba/####/52.TXT
<SD-Card>/cityisba/####/57.TXT
<SD-Card>/cityisba/####/6.TXT
<SD-Card>/cityisba/####/60.TXT
<SD-Card>/cityisba/####/61.TXT
<SD-Card>/cityisba/####/62.TXT
<SD-Card>/cityisba/####/73.TXT
<SD-Card>/cityisba/####/78.TXT
<SD-Card>/cityisba/####/79.TXT
<SD-Card>/cityisba/####/801.TXT
<SD-Card>/cityisba/####/802.TXT
<SD-Card>/cityisba/####/803.TXT
<SD-Card>/cityisba/####/805.TXT
<SD-Card>/cityisba/####/805gao.txt
<SD-Card>/cityisba/####/806.TXT
<SD-Card>/cityisba/####/806a.TXT
<SD-Card>/cityisba/####/807.TXT
<SD-Card>/cityisba/####/808.TXT
<SD-Card>/cityisba/####/809.TXT
<SD-Card>/cityisba/####/816.TXT
<SD-Card>/cityisba/####/816a.TXT
<SD-Card>/cityisba/####/9.TXT
<SD-Card>/cityisba/####/SJ.txt
<SD-Card>/cityisba/####/TS.mp3
<SD-Card>/cityisba/####/a.png
<SD-Card>/cityisba/####/baidu.txt
<SD-Card>/cityisba/####/f1.TXT
<SD-Card>/cityisba/####/f102.TXT
<SD-Card>/cityisba/####/f102a.TXT
<SD-Card>/cityisba/####/f105.TXT
<SD-Card>/cityisba/####/f105a.TXT
<SD-Card>/cityisba/####/f106.TXT
<SD-Card>/cityisba/####/f11.TXT
<SD-Card>/cityisba/####/f113.TXT
<SD-Card>/cityisba/####/f12.TXT
<SD-Card>/cityisba/####/f13.TXT
<SD-Card>/cityisba/####/f14.TXT
<SD-Card>/cityisba/####/f15.TXT
<SD-Card>/cityisba/####/f17.TXT
<SD-Card>/cityisba/####/f18.TXT
<SD-Card>/cityisba/####/f2.TXT
<SD-Card>/cityisba/####/f21.TXT
<SD-Card>/cityisba/####/f22.TXT
<SD-Card>/cityisba/####/f225.TXT
<SD-Card>/cityisba/####/f23.TXT
<SD-Card>/cityisba/####/f24.TXT
<SD-Card>/cityisba/####/f24a.TXT
<SD-Card>/cityisba/####/f25.TXT
<SD-Card>/cityisba/####/f26.TXT
<SD-Card>/cityisba/####/f27.TXT
<SD-Card>/cityisba/####/f27a.TXT
<SD-Card>/cityisba/####/f29.TXT
<SD-Card>/cityisba/####/f29a.TXT
<SD-Card>/cityisba/####/f3.TXT
<SD-Card>/cityisba/####/f30.TXT
<SD-Card>/cityisba/####/f302.TXT
<SD-Card>/cityisba/####/f302a.TXT
<SD-Card>/cityisba/####/f303.TXT
<SD-Card>/cityisba/####/f31.TXT
<SD-Card>/cityisba/####/f311.TXT
<SD-Card>/cityisba/####/f312.TXT
<SD-Card>/cityisba/####/f317.TXT
<SD-Card>/cityisba/####/f319.TXT
<SD-Card>/cityisba/####/f32.TXT
<SD-Card>/cityisba/####/f33.TXT
<SD-Card>/cityisba/####/f34.TXT
<SD-Card>/cityisba/####/f35.TXT
<SD-Card>/cityisba/####/f36.TXT
<SD-Card>/cityisba/####/f38.TXT
<SD-Card>/cityisba/####/f5.TXT
<SD-Card>/cityisba/####/f50.TXT
<SD-Card>/cityisba/####/f52.TXT
<SD-Card>/cityisba/####/f57.TXT
<SD-Card>/cityisba/####/f6.TXT
<SD-Card>/cityisba/####/f60.TXT
<SD-Card>/cityisba/####/f61.TXT
<SD-Card>/cityisba/####/f62.TXT
<SD-Card>/cityisba/####/f73.TXT
<SD-Card>/cityisba/####/f78.TXT
<SD-Card>/cityisba/####/f79.TXT
<SD-Card>/cityisba/####/f801.TXT
<SD-Card>/cityisba/####/f802.TXT
<SD-Card>/cityisba/####/f803.TXT
<SD-Card>/cityisba/####/f805.TXT
<SD-Card>/cityisba/####/f806.TXT
<SD-Card>/cityisba/####/f806a.TXT
<SD-Card>/cityisba/####/f807.TXT
<SD-Card>/cityisba/####/f808.TXT
<SD-Card>/cityisba/####/f809.TXT
<SD-Card>/cityisba/####/f816.TXT
<SD-Card>/cityisba/####/f816a.TXT
<SD-Card>/cityisba/####/f9.TXT
<SD-Card>/cityisba/####/fh2a.TXT
<SD-Card>/cityisba/####/fk1.TXT
<SD-Card>/cityisba/####/fk6.TXT
<SD-Card>/cityisba/####/fk7.TXT
<SD-Card>/cityisba/####/gaode.txt
<SD-Card>/cityisba/####/h1.TXT
<SD-Card>/cityisba/####/h2a.TXT
<SD-Card>/cityisba/####/h5a.TXT
<SD-Card>/cityisba/####/h7.TXT
<SD-Card>/cityisba/####/huan1a.TXT
<SD-Card>/cityisba/####/huan7a.TXT
<SD-Card>/cityisba/####/huan8a.TXT
<SD-Card>/cityisba/####/isba.zip
<SD-Card>/cityisba/####/jquery-1.6.2.min.js
<SD-Card>/cityisba/####/jquery-1.8.3.min.js
<SD-Card>/cityisba/####/k1.TXT
<SD-Card>/cityisba/####/k6.TXT
<SD-Card>/cityisba/####/k7.TXT
<SD-Card>/cityisba/####/laocity1.html
<SD-Card>/cityisba/####/leadline.html
<SD-Card>/cityisba/####/mi_indexstyle.css
<SD-Card>/cityisba/####/sf11.png
<SD-Card>/cityisba/####/weixin.txt
<SD-Card>/cityisba/####/xiaoyuan.png
<SD-Card>/cityisba/####/yuyin.txt

Miscellaneous:

Executes next shell scripts:

chmod 755 /data/data/com.chedaole/.jiagu/libjiagu.so
chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

libjiagu
locSDK5

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
RSA
RSA-ECB-NoPadding

Uses special library to hide executable bytecode.

Gains access to geolocation

Gains access to network information

Gains access to telephone information (number, imei, etc.)

Displays its own windows over windows of other applications

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial