Android.Packed.21222

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.414.origin

Network activity:

Connecting to:

s####.####.com
1####.####.131:8080
f####.####.com
p####.####.com
a####.####.com

HTTP GET requests:

f####.####.com/f/wf0215.dat
1####.####.131:8080/spotService/a.jsp?k=####
f####.####.com/f/3xqg.jpg
f####.####.com/f/3x01.jpg

HTTP POST requests:

p####.####.com/jiagu/msgs
a####.####.com/jiagu/mark/upgrade
s####.####.com/pkl16.html
a####.####.com/jiagu/t/infos
a####.####.com/ad-service/ad/mark

Modified file system:

Creates the following files:

/data/data/####/files/.jiagu.lock
/data/data/####/files/01493728894540.jar
/data/data/####/shared_prefs/^_`a^.xml
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/cache/ads-1689461315.jar
/data/data/####/shared_prefs/^_`ab.xml
/data/data/####/shared_prefs/jg_core_control.xml.bak
/data/data/####/libs/.lock
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/databases/Videos.db-journal
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/databases/webviewCookiesChromium.db-journal
/sdcard/w/i_356507059351895/3xqg.jpg.data
/data/data/####/shared_prefs/jg_app_update_settings_random.xml
/data/data/####/databases/a1.db-journal
/data/data/####/shared_prefs/c1356507059351895.xml
/data/data/####/shared_prefs/1001.xml
/data/data/####/files/.jglogs/.jg.ri
/data/data/####/files/.jglogs/.log3
/data/data/####/shared_prefs/b1356507059351895.xml
/data/data/####/files/.jglogs/.jg.ac
/data/data/####/databases/webview.db-journal
/data/data/####/shared_prefs/jg_core_control.xml
/data/data/####/libs/libarm.so
/data/data/####/app_jgls/.log.lock
/data/data/####/shared_prefs/a1356507059351895.xml
/data/data/####/databases/Videos.db
/data/data/####/shared_prefs/a1356507059351895.xml.bak
/data/data/####/shared_prefs/a1.xml
/data/data/####/files/.jglogs/.jg.ic
/data/data/####/app_jgls/.log.ls
/data/data/####/shared_prefs/videopref.xml
/data/data/####/shared_prefs/c1356507059351895.xml.bak
/data/data/####/shared_prefs/d1356507059351895.xml
/sdcard/w/i_356507059351895/3x01.jpg.data
/sdcard/w/i_356507059351895/_c.dat
/data/data/####/shared_prefs/f1356507059351895.xml
/data/data/####/cache/webviewCacheChromium/index
/data/data/####/.jiagu/libjiagu.so

Sets the 'executable' attribute to the following files:

/data/data/####/.jiagu/libjiagu.so

Miscellaneous:

Executes next shell scripts:

ps
chmod 755 /data/data/####/.jiagu/libjiagu.so
/system/bin/dexopt --dex 27 48 40 5728 /data/data/####/cache/ads-1689461315.jar 1127773026 1289983756 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system
/system/bin/dexopt --dex 27 46 40 151656 /data/data/####/files/01493728894540.jar 1231519046 -986440253 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /syst

Uses special library to hide executable bytecode.

Contains functionality to send SMS messages automatically.