Android.Triada.491

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.SmsSend.1848.origin
Android.Triada.170
Android.Triada.247.origin
Android.Triada.248.origin

Gains access to the ITelephony private interface.

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) i####.api.eji####.com:10003
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) pg.x####.com:80
TCP(HTTP/1.1) i####.cn.com:80
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(HTTP/1.1) re####.api.eji####.com:10002
TCP(HTTP/1.1) 1####.1.17.224:80
TCP(HTTP/1.1) a.cs####.top:8090
TCP(TLS/1.0) ga.x####.com:443
TCP bg.vas####.cn:8090

DNS requests:

a.appj####.com
a.cs####.top
bg.vas####.cn
collec####.yw####.com
ga.x####.com
i####.api.eji####.com
i####.cn.com
mobil####.yw####.com
pg.x####.com
pv.s####.com
re####.api.eji####.com
sm####.yw####.com

HTTP GET requests:

a.cs####.top:8090/phoneget?cpid=####&ismi=####&calltime=####&callcount=#...
gd.a.s####.com/cityjson?ie=####
i####.cn.com/a/3cff577985556567209c8fa8131303f63
re####.api.eji####.com:10002/v1/sdk/init?net_name=####&imei=####&package...

HTTP POST requests:

a.appj####.com/ad-service/ad/mark
a.appj####.com/jiagu/check/upgrade
i####.api.eji####.com:10003/v2/chis
pg.x####.com/api/q/a/3cff577985556567209c8fa8131303f63

Modified file system:

Creates the following files:

<Package Folder>/.jiagu/libjiagu.so
<Package Folder>/app_apCoreplugn/####/plugin-20170330-2.1.9-release.bin
<Package Folder>/app_apCoreplugn/map.apk
<Package Folder>/app_apCoreplugn/sm.apk
<Package Folder>/app_jgls/.log.lock
<Package Folder>/app_jgls/.log.ls
<Package Folder>/app_plugin_dir/####/base-1.apk
<Package Folder>/app_plugin_dir/####/base-1.dex
<Package Folder>/cache/####/crash-1510833289137.log
<Package Folder>/cache/####/crash-1510833297140.log
<Package Folder>/cache/####/crash-1510833345354.log
<Package Folder>/cache/map.apk.apk
<Package Folder>/cache/sm.apk.apk
<Package Folder>/databases/MA_epay_db
<Package Folder>/databases/MA_epay_db-journal
<Package Folder>/databases/bil_db
<Package Folder>/databases/bil_db-journal
<Package Folder>/databases/com.souying.pay.plugmain_sy_pay_record-journal
<Package Folder>/databases/mpush_game.db-journal
<Package Folder>/databases/recordInfo-journal
<Package Folder>/databases/sms_db
<Package Folder>/databases/sms_db-journal
<Package Folder>/databases/sy_pay_record-journal
<Package Folder>/files/####/.jg.ic
<Package Folder>/files/####/6olnKniIW8am7ld2
<Package Folder>/files/####/9mtcCaWyb-3z_lobgbTJdA==
<Package Folder>/files/####/TLBam3qL_bnad9B22GSBkQ==.new
<Package Folder>/files/####/YvE4sdx-qIQanMMk.zip
<Package Folder>/files/####/about.png
<Package Folder>/files/####/anim_0.plist
<Package Folder>/files/####/anim_0.png
<Package Folder>/files/####/anim_1.plist
<Package Folder>/files/####/anim_1.png
<Package Folder>/files/####/anim_2.plist
<Package Folder>/files/####/anim_2.png
<Package Folder>/files/####/anim_3.plist
<Package Folder>/files/####/anim_3.png
<Package Folder>/files/####/anim_4.plist
<Package Folder>/files/####/anim_4.png
<Package Folder>/files/####/baidu
<Package Folder>/files/####/board1.png
<Package Folder>/files/####/bomb.ogg
<Package Folder>/files/####/box.png
<Package Folder>/files/####/buy.png
<Package Folder>/files/####/chest_anim.plist
<Package Folder>/files/####/close.png
<Package Folder>/files/####/close0.png
<Package Folder>/files/####/com.plist
<Package Folder>/files/####/com.png
<Package Folder>/files/####/com_bg.jpg
<Package Folder>/files/####/counting.plist
<Package Folder>/files/####/counting.png
<Package Folder>/files/####/data.dat.tmp
<Package Folder>/files/####/finger.png
<Package Folder>/files/####/g_num.png
<Package Folder>/files/####/g_num_c.png
<Package Folder>/files/####/g_prop_num.png
<Package Folder>/files/####/game.plist
<Package Folder>/files/####/game.png
<Package Folder>/files/####/get.png
<Package Folder>/files/####/inShopButton.png
<Package Folder>/files/####/ingame.mp3
<Package Folder>/files/####/k1.png
<Package Folder>/files/####/kk_data.xml
<Package Folder>/files/####/lightning.mp3
<Package Folder>/files/####/line.ogg
<Package Folder>/files/####/load0.png
<Package Folder>/files/####/load0s.png
<Package Folder>/files/####/load1.png
<Package Folder>/files/####/load1s.png
<Package Folder>/files/####/logo.jpg
<Package Folder>/files/####/map_anim.plist
<Package Folder>/files/####/map_anim.png
<Package Folder>/files/####/map_data.xml
<Package Folder>/files/####/map_data.xml.bak
<Package Folder>/files/####/map_num.plist
<Package Folder>/files/####/map_num.png
<Package Folder>/files/####/menu.mp3
<Package Folder>/files/####/my.cfg
<Package Folder>/files/####/ok.png
<Package Folder>/files/####/ok2.png
<Package Folder>/files/####/pause.plist
<Package Folder>/files/####/pause.png
<Package Folder>/files/####/plus.jar
<Package Folder>/files/####/price10.png
<Package Folder>/files/####/price4.png
<Package Folder>/files/####/prop0.png
<Package Folder>/files/####/prop1.png
<Package Folder>/files/####/prop2.png
<Package Folder>/files/####/prop3.png
<Package Folder>/files/####/rwGGBxMDfmQCRKqiskXwQQ==.new
<Package Folder>/files/####/score.mp3
<Package Folder>/files/####/score.wav
<Package Folder>/files/####/sound0.png
<Package Folder>/files/####/sound1.png
<Package Folder>/files/####/startGameButton.png
<Package Folder>/files/####/static_data.plist
<Package Folder>/files/####/temobw_f.zip
<Package Folder>/files/####/text0.png
<Package Folder>/files/####/text01_2.png
<Package Folder>/files/####/text0_2.png
<Package Folder>/files/####/text1.png
<Package Folder>/files/####/text2.png
<Package Folder>/files/####/text2_2.png
<Package Folder>/files/####/text3.png
<Package Folder>/files/####/text4.png
<Package Folder>/files/####/text4s.png
<Package Folder>/files/####/text5.png
<Package Folder>/files/####/text52.png
<Package Folder>/files/####/text5s.png
<Package Folder>/files/####/u_c_num.png
<Package Folder>/files/####/u_map_bg.jpg
<Package Folder>/files/####/u_map_lv_0.png
<Package Folder>/files/####/u_map_lv_1.png
<Package Folder>/files/####/u_map_rode.png
<Package Folder>/files/mj.apk
<Package Folder>/files/mj.dex (deleted)
<Package Folder>/files/mpush_gateway_preferences_file
<Package Folder>/files/mpush_version_preferences_file
<Package Folder>/files/rdata_comvmnsfmnb.new
<Package Folder>/pspace/nexor.jar
<Package Folder>/pspace/prim.jar
<Package Folder>/shared_prefs/3cff577985556567209c8fa8131303f63...le.xml
<Package Folder>/shared_prefs/TD_app_pefercen_profile.xml
<Package Folder>/shared_prefs/b_setting.xml
<Package Folder>/shared_prefs/b_share.xml
<Package Folder>/shared_prefs/com.souying.pay.xml
<Package Folder>/shared_prefs/jg_app_update_settings_random.xml
<Package Folder>/shared_prefs/ma_call.xml
<Package Folder>/shared_prefs/ma_data.xml
<Package Folder>/shared_prefs/ma_epay_share.xml
<Package Folder>/shared_prefs/ma_phone.xml
<Package Folder>/shared_prefs/nnt_data.xml
<Package Folder>/shared_prefs/plugins.installed.xml
<Package Folder>/shared_prefs/plugins.serviceMapping.xml
<Package Folder>/shared_prefs/pref_file.xml
<Package Folder>/shared_prefs/pref_file.xml.bak
<Package Folder>/shared_prefs/pref_file.xml.bak (deleted)
<Package Folder>/shared_prefs/qihoo_jiagu_crash_report.xml
<Package Folder>/shared_prefs/sdk.xml
<Package Folder>/shared_prefs/share_ecd.xml
<Package Folder>/shared_prefs/share_version.xml
<Package Folder>/shared_prefs/sy_pay_config.xml
<Package Folder>/shared_prefs/sy_pay_config.xml.bak
<Package Folder>/shared_prefs/td_pefercen_profile.xml
<Package Folder>/shared_prefs/tdid.xml
<Package Folder>/shared_prefs/zzconfig.xml
<SD-Card>/.tcookieid
<SD-Card>/gooogle/userid.cfg

Miscellaneous:

Executes next shell scripts:

cat /proc/version
chmod 755 <Package Folder>/.jiagu/libjiagu.so

Loads the following dynamic libraries:

cocos2dcpp
libjiagu

Uses the following algorithms to encrypt data:

DES
DES-CBC-PKCS5Padding

Uses the following algorithms to decrypt data:

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about installed applications.

Displays its own windows over windows of other applications.

Parses information from SMS messages.

Gains access to information about incoming/outgoing calls.

Gains access to information about sent/received SMS messages.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial