Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Cooee.11.origin
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) api####.bao####.com:80
- TCP(HTTP/1.1) api.xiub####.com:80
- TCP(HTTP/1.1) www.zh####.com:80
- TCP(HTTP/1.1) cdn.md####.cn.####.cn:8080
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) b####.b0.a####.com:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(TLS/1.0) 2####.58.211.110:443
DNS requests:
- 2####.nd####.y####.com
- api####.bao####.com
- api.3####.cn
- api.xiub####.com
- cdn.md####.cn
- i1.bao####.com
- mi.g####.qq.com
- s####.e.qq.com
- www.zh####.com
HTTP GET requests:
- api####.bao####.com/calendar/cailing0225.png
- api.xiub####.com/wallpaper/default/discover?channelId=####&imei=####&ver...
- b####.b0.a####.com//download/2016/05/29/5453e2de2c6b1955633cded1c87d3839...
- b####.b0.a####.com/d/wallpaper/2017/08/30/54109c5b0fb9c559a7ef1caa7a1d64...
- b####.b0.a####.com/d/wallpaper/2017/08/30/70416a295d423dd6414c0ad7b25245...
- b####.b0.a####.com/d/wallpaper/2017/08/30/8442f63ce69a0e2a771e6dc7d51ff4...
- b####.b0.a####.com/d/wallpaper/2017/08/30/baoruan.com_28361f3ebad1d66e19...
- b####.b0.a####.com/d/wallpaper/2017/08/30/baoruan.com_412258eda200e872ea...
- b####.b0.a####.com/d/wallpaper/2017/08/30/baoruan.com_58180013107c6c3ab6...
- b####.b0.a####.com/d/wallpaper/2017/08/30/baoruan.com_6063a6417fc02a06f6...
- b####.b0.a####.com/d/wallpaper/2017/08/30/baoruan.com_6350360ffcc645e257...
- b####.b0.a####.com/d/wallpaper/2017/08/30/baoruan.com_8351a8d328f0e9454a...
- b####.b0.a####.com/d/wallpaper/2017/08/30/baoruan.com_9799dde447e4ac9c71...
- b####.b0.a####.com/d/wallpaper/2017/11/20/baoruan.com_57517d5ca6b25ddb92...
- b####.b0.a####.com/d/wallpaper/2018/01/18/baoruan.com_3185c1f66f9fceaa27...
- b####.b0.a####.com/d/wallpaper/2019/01/09/baoruan.com_1922f31c181e029350...
- b####.b0.a####.com/d/wallpaper/2019/01/16/baoruan.com_5224d8a6787d252e2c...
- b####.b0.a####.com/d/wallpaper/2019/01/24/baoruan.com_1159621dde41571275...
- b####.b0.a####.com/d/wallpaper/2019/01/24/baoruan.com_166529e04603cfb9b4...
- b####.b0.a####.com/d/wallpaper/2019/01/24/baoruan.com_17951b82bea9e1a9f1...
- b####.b0.a####.com/d/wallpaper/2019/01/24/baoruan.com_211029bbc2eaa11af8...
- b####.b0.a####.com/d/wallpaper/2019/01/24/baoruan.com_2478196cc1d47c5fe1...
- b####.b0.a####.com/d/wallpaper/2019/01/24/baoruan.com_4606935b080612cb16...
- b####.b0.a####.com/d/wallpaper/2019/01/24/baoruan.com_5935b213fc593a6e52...
- b####.b0.a####.com/d/wallpaper/2019/01/24/baoruan.com_7575ced99fa9a900bf...
- b####.b0.a####.com/d/wallpaper/2019/01/24/baoruan.com_76065ae5694cb900a6...
- b####.b0.a####.com/d/wallpaper/2019/01/24/baoruan.com_9238df513b248f2535...
- b####.b0.a####.com/d/wallpaper/2019/01/29/baoruan.com_218631477a1029b4c1...
- b####.b0.a####.com/d/wallpaper/2019/01/29/baoruan.com_47176b0fd4b125f180...
- b####.b0.a####.com/d/wallpaper/2019/01/29/baoruan.com_48546d8905ec31e779...
- b####.b0.a####.com/d/wallpaper/2019/01/29/baoruan.com_5201c7e4b145bccdfa...
- b####.b0.a####.com/d/wallpaper/2019/01/29/baoruan.com_62523250e041914322...
- b####.b0.a####.com/d/wallpaper/2019/01/29/baoruan.com_82560ee70a37c9a42c...
- b####.b0.a####.com/d/wallpaper/2019/01/29/baoruan.com_85832c902273fa210a...
- b####.b0.a####.com/d/wallpaper/2019/01/29/baoruan.com_914714f3bbb5eae44e...
- b####.b0.a####.com/d/wallpaper/2019/01/29/baoruan.com_9547660aabd3b25a16...
- b####.b0.a####.com/d/wallpaper/2019/01/29/baoruan.com_9836877dc0781458f4...
- cdn.md####.cn.####.cn:8080/resource/gist/46
- mi.g####.qq.com/gdt_mview.fcg?actual_width=####&count=####&r=####&templa...
- www.zh####.com/api_release.php
HTTP POST requests:
- api####.bao####.com/dh3g/default/index?name=####&channelId=####&imei=###...
- api####.bao####.com/themes/default/index?name=####&channelId=####&imei=#...
- api####.bao####.com/wallpaper/default/carousel
- api####.bao####.com/wallpaper/default/getClass?channelId=####&imei=####&...
- api####.bao####.com/wallpaper/default/getlist?channelId=####&imei=####&v...
- api####.bao####.com/wallpaper/default/index?name=####
- api####.bao####.com/wallpaper/default/index?name=####&channelId=####&ime...
- api.xiub####.com/wallpaper/default/index?name=####
- api.xiub####.com/wallpaper/default/index?name=####&channelId=####&imei=#...
- s####.e.qq.com/activate
File system changes:
Creates the following files:
- /data/data/####/-169248287-740642811
- /data/data/####/-169248287-740642811 (deleted)
- /data/data/####/.jg.ic
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/android.app.ContextImpl.zip
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/launcher.settings.prefs.xml
- /data/data/####/libjiagu-536087271.so
- /data/data/####/qihoo_jiagu_crash_report.xml
- /data/data/####/screen_lock_preference.xml
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/update_lc
- /data/media/####/-1316494915.tmp
- /data/media/####/-1320368217.tmp
- /data/media/####/.nomedia
- /data/media/####/1922272790.tmp
- /data/media/####/1974226926.tmp
- /data/media/####/1c30c22b555528642768907d155792049100105b9805de....0.tmp
- /data/media/####/2413c40e518e72bd12de6eb59863dc89626e8e7a2768f6....0.tmp
- /data/media/####/29c2391deeadbc2f99bca78855a50eb7a2161d9c1d5dfd....0.tmp
- /data/media/####/33e078e5113f86ff8b63324c15b3a703c29e9f648ea29f....0.tmp
- /data/media/####/347143_preview
- /data/media/####/347143_preview.jpg
- /data/media/####/347144_preview
- /data/media/####/347144_preview.jpg
- /data/media/####/347145_preview
- /data/media/####/347147_preview
- /data/media/####/347147_preview.jpg
- /data/media/####/40c8137c0e9e88e59cbfb8e53155ca5669bb7ce55019ff....0.tmp
- /data/media/####/4348e97f0711efb50fb346f7f5f71d8c10a301f231a78c....0.tmp
- /data/media/####/4e31218358c60f57d92783a277186cfc8014bd4d10f96a....0.tmp
- /data/media/####/60f03b85e3ee1f2df13a91b49031d94f2852295d27e4bd....0.tmp
- /data/media/####/63d5d6499f3c45f36500847d1df4f2aea4a8d2f18627f7....0.tmp
- /data/media/####/7016686b67a32e7e7c3f3dca64ca137ac3bbe4749cf7f1....0.tmp
- /data/media/####/727b065a5d6adff2d4d04753cf858aaf281844b37e8e9e....0.tmp
- /data/media/####/785c35fbea37e43d273bf8f436ed9087e2b948905c0c79....0.tmp
- /data/media/####/786e371f1e04d90993106568ab2719fcb05f79c174af7a....0.tmp
- /data/media/####/7a330f76cbb67feb6b67a5bbdfbfafce336d8c45fd5e2a....0.tmp
- /data/media/####/7e2dfb93fcc507761826ab298423eac5c48cf08d3d03c6....0.tmp
- /data/media/####/83b9314d97404894d51eaafecaf4dfad544084df687a13....0.tmp
- /data/media/####/8cdbfbd1a351e3441f774b7f86a23251913fb4e36d12d7....0.tmp
- /data/media/####/94bfb5e32241ef4ca8b9a234cfcae57dcb679d35fcad84....0.tmp
- /data/media/####/9d743df5c677c750d97be01bf455c20a9badcac2f03364....0.tmp
- /data/media/####/a1af2f360cc1bf077452bd911d39f26c048331006f7fde....0.tmp
- /data/media/####/a3dac9564f82cda81e1a2901c93d582b15a8d24221bfc9....0.tmp
- /data/media/####/b6a2c356a54770d6f9d7cedf73ff9832470301996fd0c8....0.tmp
- /data/media/####/b74f5b27da9c07c81c02992a517f9afcc84a451368e5a3....0.tmp
- /data/media/####/bf1d7835f82922de09ebe6fb332bf43b1a2ae75b9e00e1....0.tmp
- /data/media/####/bf4b61abc7453c17ad6da3b953cc4d0fff6c613a474716....0.tmp
- /data/media/####/c035f0dbf453936e1ff7d9f73871cf9175a212568bd028....0.tmp
- /data/media/####/c2c99350a9a02a3fb7c13484684f35aaf2e72f465cbbba....0.tmp
- /data/media/####/d0cadf31fc472b71181bc2b7996d95e95d05a86396da36....0.tmp
- /data/media/####/d5eb37a5bc924f3e18da79b2c50afe9e57d6be7b41ab88....0.tmp
- /data/media/####/e271af0941569d8f71aa261f97be9471edeee62309a09c....0.tmp
- /data/media/####/e8cb304376657426d262796a68d5388c15ddd670cde78b....0.tmp
- /data/media/####/f047beb17d88759595666405b1b37044cbeedb7ac9f4be....0.tmp
- /data/media/####/icon_-1133528357
- /data/media/####/icon_-1213825779
- /data/media/####/icon_1656857395
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/null
- /data/media/####/null.jpg
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /proc/cpuinfo
- <Package Folder>/app_bin/daemon -p <Package> -s com.example.zzb.screenlock.LockService -t 30
- chmod 755 <Package Folder>/.jiagu/libjiagu-536087271.so
- getprop
Loads the following dynamic libraries:
- libjiagu-536087271
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.