Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.337.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) 64.2####.164.94:80
- TCP(HTTP/1.1) api.gua####.tv:80
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP(TLS/1.0) rr2---s####.g####.com:443
- TCP(TLS/1.0) img.guaz####.com:443
- TCP(TLS/1.0) and####.b####.qq.com:443
- TCP(TLS/1.0) rr9---s####.g####.com:443
- TCP(TLS/1.0) rr18---####.g####.com:443
- TCP(TLS/1.0) 64.2####.164.94:443
- TCP(TLS/1.0) digital####.google####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.2) www.go####.com:443
- TCP(TLS/1.2) and####.cli####.go####.com:443
- TCP(TLS/1.2) 1####.250.150.102:443
- TCP(TLS/1.2) digital####.google####.com:443
- TCP(TLS/1.2) 64.2####.164.94:443
- UDP digital####.google####.com:443
DNS requests:
- and####.b####.qq.com
- and####.cli####.go####.com
- api.gua####.tv
- digital####.google####.com
- f####.gst####.com
- img.guaz####.com
- m####.go####.com
- md####.google####.com
- p####.google####.com
- pla####.googleu####.com
- rr18---####.g####.com
- rr2---s####.g####.com
- rr9---s####.g####.com
- sdk.z####.cn
- www.go####.com
HTTP GET requests:
- img.guaz####.com:443/video/cover/20230902/7461da256263a819e7209dfd358d2e...
- img.guaz####.com:443/video/cover/20230907/4eb10fdb10f064e7a92f82e6424dd9...
- img.guaz####.com:443/video/cover/20230919/ef514381de7a72d94a25959978959b...
- img.guaz####.com:443/video/cover/20231002/de6fa603b69dc7cd34310c02fdee05...
- img.guaz####.com:443/video/cover/20231003/d95b5a6b4cfe4119ac23b56e0453c8...
- img.guaz####.com:443/video/cover/20231007/fe20496d7754105eb4e41d5eee6c6a...
- img.guaz####.com:443/video/cover/20231008/5ee2b7c8d4bf76eeb557c656086fff...
- img.guaz####.com:443/video/cover/20231011/7957aa64ee2fa9da9db9af1d035b2a...
- img.guaz####.com:443/video/cover/20231012/cc6d7c0a0a3e93e704116753b50691...
- img.guaz####.com:443/video/cover/20231012/f96c50a247e06490c9a7eeb4b7842c...
- img.guaz####.com:443/video/cover/20231013/138d9e5cdd6ed0bf051a559ac5e46e...
- img.guaz####.com:443/video/cover/20231013/1469c41a8cc29a975e2d71527feeeb...
- img.guaz####.com:443/video/cover/20231013/5ce656268b7c30a3d075c4281ab818...
- img.guaz####.com:443/video/cover/20231013/fb64c8249af261018f71e87887dbc5...
- img.guaz####.com:443/video/cover/20231014/0e8978d5630ef2124e7e1d87d2ddde...
- img.guaz####.com:443/video/cover/20231014/1417a70ce486796578fde28ced2323...
- img.guaz####.com:443/video/cover/20231016/34feb822b9e608c8d0f02e2052afe2...
- img.guaz####.com:443/video/cover/20231016/d10b77d6796de736515cf34e511d67...
- img.guaz####.com:443/video/cover/20231016/fe56cd6c6ce7d827486d40cf2f5c2b...
- img.guaz####.com:443/video/cover/20231018/2e0f6056dbe83642b400dbc0d959b5...
- img.guaz####.com:443/video/cover/20231019/d4c8ed6dd3521fe75dba3197cd8538...
HTTP POST requests:
- and####.b####.qq.com:443/rqd/async?aid=####
- api.gua####.tv/service/check-setting
- api.gua####.tv/video/filter
File system changes:
Creates the following files:
- /data/data/####/.fsgkea
- /data/data/####/.jg.ac
- /data/data/####/.jg.ri
- /data/data/####/.jg.store.report_cf
- /data/data/####/.jg.store.report_pid
- /data/data/####/1004
- /data/data/####/105f96cc3c0ebe65e1ed397cb5977998082c9dd2079ebeb...222f.0
- /data/data/####/1187fdac97c5fbeae252d7e3ca5f1f68c534ffc9ba34b3a....0.tmp
- /data/data/####/1187fdac97c5fbeae252d7e3ca5f1f68c534ffc9ba34b3a...8c51.0
- /data/data/####/1a502d569787c5d8d38a8037a7306c9d55e975907e1bcf0....0.tmp
- /data/data/####/1a502d569787c5d8d38a8037a7306c9d55e975907e1bcf0...244f.0
- /data/data/####/338ff5c7a0880d9f8f0e833ddfb5990f0e0f5c3e0c3d143....0.tmp
- /data/data/####/338ff5c7a0880d9f8f0e833ddfb5990f0e0f5c3e0c3d143...ad9a.0
- /data/data/####/35abbbe9cbac87c48ecde2e37786c75128fd98c6be93200....0.tmp
- /data/data/####/35abbbe9cbac87c48ecde2e37786c75128fd98c6be93200...b5ca.0
- /data/data/####/45439302783aa10f04ad48e8d2472f3b3eef0ff7c61d55e...1e9f.0
- /data/data/####/58f569495c9168dd4fa164f49bcae01aa0a77b7d6327d5b....0.tmp
- /data/data/####/6af448f5903e0ef76c95637a5c5e3d67ce0e41adfa42fb4....0.tmp
- /data/data/####/703e4251718f930cb0b846c59bd12531c798683dad8f138....0.tmp
- /data/data/####/7d5bd98ddcbd71908f739439b880c93579db09bc6dda6db....0.tmp
- /data/data/####/7d5bd98ddcbd71908f739439b880c93579db09bc6dda6db...1650.0
- /data/data/####/91c445aa3c84d2d4ac7bbe9069b080fedeba7fcdfebeec7....0.tmp
- /data/data/####/947d815a438f2cd4d397bd34870518e8dd6dc3c22b1ca1f....0.tmp
- /data/data/####/95885030b0d160136b44906eaf0d578493cee02c219aea6....0.tmp
- /data/data/####/95885030b0d160136b44906eaf0d578493cee02c219aea6...6c36.0
- /data/data/####/9843fe43ab6194a4ac55c71c892175d9783edff50d9de83....0.tmp
- /data/data/####/9843fe43ab6194a4ac55c71c892175d9783edff50d9de83...225d.0
- /data/data/####/b036c9c3728e231307186ba2fd85884d9659090495b46b9....0.tmp
- /data/data/####/b036c9c3728e231307186ba2fd85884d9659090495b46b9...ac2f.0
- /data/data/####/b1a3c04f72a1eccbac0d3c5236d320f7d8221bd63886270....0.tmp
- /data/data/####/b1a3c04f72a1eccbac0d3c5236d320f7d8221bd63886270...4c29.0
- /data/data/####/be5cef14b6bd35802a038f4db942ed9b17205687cfed260....0.tmp
- /data/data/####/be5cef14b6bd35802a038f4db942ed9b17205687cfed260...6155.0
- /data/data/####/bugly_db_-journal
- /data/data/####/c183541bc656db89e32cd0dbd18318d0d434e8dd394b832....0.tmp
- /data/data/####/c183541bc656db89e32cd0dbd18318d0d434e8dd394b832...39c1.0
- /data/data/####/c39e1f3bee4f4763e598d5fa735215461d131376d088071....0.tmp
- /data/data/####/c39e1f3bee4f4763e598d5fa735215461d131376d088071...effa.0
- /data/data/####/c3e8783989c7921ec989874f76df27dc8c11c1507963a18...8a6f.0
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/classes.oat
- /data/data/####/crashrecord.xml
- /data/data/####/d5d979d093d990d2815c43c79218e6dc130c43d82566bc2....0.tmp
- /data/data/####/d5d979d093d990d2815c43c79218e6dc130c43d82566bc2...72c6.0
- /data/data/####/device_id.xml.xml
- /data/data/####/e1a6088c63de0eda34f923e9f72f2e0dc98e99c51702e3a....0.tmp
- /data/data/####/e1a6088c63de0eda34f923e9f72f2e0dc98e99c51702e3a...9530.0
- /data/data/####/fanqieshumanstring.xml.xml
- /data/data/####/jgobfppppp (deleted)
- /data/data/####/journal
- /data/data/####/libjiagu.so
- /data/data/####/local_crash_lock
- /data/data/####/local_crash_lock (deleted)
- /data/data/####/native_record_lock
- /data/data/####/native_record_lock (deleted)
- /data/data/####/proc_auxv
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- /system/bin/sh -c getprop
- getprop
Loads the following dynamic libraries:
- libBugly
- libjiagu
Uses special library to hide executable bytecode.
Displays its own windows over windows of other apps.