Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.113.origin
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) i####.t####.cn:80
- TCP(HTTP/1.1) gw.api.ta####.com:80
- TCP(HTTP/1.1) i####.taoba####.com:80
- TCP(HTTP/1.1) sp.pop####.com:80
- TCP(HTTP/1.1) imgp####.ff####.cn:80
- TCP(HTTP/1.1) s####.wagbr####.ta####.com:80
- TCP(HTTP/1.1) api.appj####.com:80
- TCP(TLS/1.0) s.t####.cn:443
- TCP(TLS/1.0) na61-####.wagbr####.non####.####.com:443
- TCP(TLS/1.0) i####.taoba####.com:443
- TCP(TLS/1.0) gw.al####.com:443
- TCP(TLS/1.0) na61-####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) wild####.al####.com.####.net:443
- TCP(TLS/1.0) y.tao####.com:443
- TCP(TLS/1.0) log.mm####.com:443
DNS requests:
- a####.u####.com
- aeu.al####.com
- api.appj####.com
- as####.al####.com
- at.al####.com
- cf.al####.com
- feed####.u####.com
- g.al####.com
- gd4.al####.com
- gw.al####.com
- gw.api.ta####.com
- i####.t####.cn
- i####.taoba####.com
- i####.taoba####.com
- i####.taoba####.com
- i####.taoba####.com
- img.al####.com
- imgp####.ff####.cn
- l####.m.ta####.com
- log.mm####.com
- mm####.al####.com
- o####.m.ta####.com
- o####.ta####.com
- s.t####.cn
- sp.pop####.com
- sug####.ta####.com
- y####.al####.com
- y.tao####.com
HTTP GET requests:
- i####.t####.cn/tfscom/i2/3012829663/TB1QjM0bdrJ8KJjSspaXXXuKpXa_!!0-item...
- i####.taoba####.com/imgextra/i1/56612440/TB2WDwudXXXXXawXpXXXXXXXXXX_!!5...
- i####.taoba####.com/imgextra/i1/56612440/TB2ijnhcpXXXXbOXXXXXXXXXXXX_!!5...
- i####.taoba####.com/imgextra/i1/56612440/TB2k1v4cpXXXXXuXXXXXXXXXXXX_!!5...
- i####.taoba####.com/imgextra/i2/56612440/TB2pg_RcpXXXXa_XpXXXXXXXXXX_!!5...
- i####.taoba####.com/imgextra/i3/56612440/TB2cFGHdXXXXXaVXpXXXXXXXXXX_!!5...
- i####.taoba####.com/imgextra/i4/56612440/TB2VfYYcpXXXXc5XXXXXXXXXXXX_!!5...
- imgp####.ff####.cn/imgextra/i1/3265188276/*t*b28o.*qa*b*lo*k1*rj*s*z*fu*...
- imgp####.ff####.cn/imgextra/i2/1077391594/*o1*c*n011*ne5n*tp*l*pk*m*y*g*...
- imgp####.ff####.cn/imgextra/i4/1077391594/*o1*c*n011*ne5n*s*z*p*lfa*s*oh...
- s####.wagbr####.ta####.com/sug?code=####&extras=####&q=####&userkey=####...
- sp.pop####.com/sp/ChnnelHot2.ashx?pageindex=####&pagesize=####&channel_i...
- sp.pop####.com/sp/Config.ashx?channel=####&versioncode=####&userkey=####...
- sp.pop####.com/sp/MyLikeState.ashx?sp_user_id=####&itemid=####&taobao_ou...
- sp.pop####.com/sp/SpFocus2.ashx?versioncode=####&userkey=####&appkey=####
HTTP POST requests:
- a####.u####.com/app_logs
- api.appj####.com/appjiagu
- gw.api.ta####.com/router/rest
- gw.api.ta####.com/tql/2.0/json
- sp.pop####.com/sp/AddUser3.ashx?userkey=####&appkey=####
- sp.pop####.com/sp/ItemCache.ashx?userkey=####&appkey=####
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/INSTALLATION
- /data/data/####/cache.db-journal
- /data/data/####/com.neil_preferences.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/index
- /data/data/####/jiagu.lock
- /data/data/####/libjiagu.so
- /data/data/####/mobclick_agent_cached_com.neil53
- /data/data/####/mobclick_agent_online_setting_com.neil.xml
- /data/data/####/umeng_feedback_conversations.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/-1150903278
- /data/media/####/-1277090637
- /data/media/####/-1350708131
- /data/media/####/-1443592334
- /data/media/####/-1662666351
- /data/media/####/-1819533828
- /data/media/####/-1875603897
- /data/media/####/-1890116537
- /data/media/####/-2052001833
- /data/media/####/-215028546
- /data/media/####/-251604526
- /data/media/####/-341509358
- /data/media/####/-431126788
- /data/media/####/-60953849
- /data/media/####/-812504244
- /data/media/####/-857312178
- /data/media/####/-985821350
- /data/media/####/-987646486
- /data/media/####/105441214
- /data/media/####/1110942143
- /data/media/####/1158821572
- /data/media/####/1262763607
- /data/media/####/1269007211
- /data/media/####/1294801756
- /data/media/####/1326608538
- /data/media/####/1392620358
- /data/media/####/1456848917
- /data/media/####/1780704352
- /data/media/####/1845305570
- /data/media/####/1910405906
- /data/media/####/2033338891
- /data/media/####/2060115449
- /data/media/####/2119356038
- /data/media/####/294493868
- /data/media/####/31834904
- /data/media/####/453472681
- /data/media/####/485380355
- /data/media/####/527454104
- /data/media/####/725746809
- /data/media/####/829185692
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu
- top-sdk
Uses the following algorithms to encrypt data:
- DES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Displays its own windows over windows of other applications.