Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Xiny.20
Downloads the following detected threats from the Web:
- Android.Xiny.20
Network activity:
Connecting to:
- s####.####.com
- y####.####.cn
- g####.####.com
- h####.####.com
- i####.####.com
- d####.####.cn
- 7j####.####.com
- p####.####.com
- c-h####.####.com
- d####.####.com
- dce####.####.com
- b####.####.com
HTTP GET requests:
- dce####.####.com/api/games/226762
- i####.####.com/uploads/icons/2/8/28241c224e2477713405bcfe24e56db4.png
- i####.####.com/uploads/icons/6/c/6caf6461588d249f598fb1781ead6065.png
- i####.####.com/uploads/icons/e/b/eb110e727b03a988d580f85b69d6fc6b.png
- i####.####.com/uploads/icons/a/f/af583e681e4b6425710757faedbf4b95.png
- i####.####.com/uploads/carousels/3/4/341dc70ce70abfec36808509a5aac66b.jpg
- dce####.####.com/api/start
- dce####.####.com/api/games/226762/gifts?page=####
- d####.####.com/api/game/getrescnt?package=####&app_id=####&channel_id=##...
- i####.####.com/uploads/icons/a/8/a8d82aa10c9607653a5933669e0398d2.png
- i####.####.com/uploads/icons/1/5/15441e4b1c15f3d827f4ed9e972790a9.png
- i####.####.com/uploads/screenshoots/f/f/ff52c7cb102bcbf496cf280cf28369b3...
- i####.####.com/uploads/icons/a/b/ab8159d1fda652d35582e7f8ca7f901c.png
- i####.####.com/uploads/icons/3/b/3bf5b74db9535bbbb9a830ce986a1cfe.png
- i####.####.com/launch/b/8/b8f098176a8444a4aae8a7bcd343ae4f.jpg
- dce####.####.com/api/games/226762/comments?page=####
- 7j####.####.com/tdata_Now710
- i####.####.com/uploads/icons/8/c/8c7f866e4ffffba5888b17c23097f0d1.png
- i####.####.com/uploads/icons/6/8/68bb4ad3afb1b46e2d083e03d6d573cd.png
- 7j####.####.com/tdata_JOf603
- i####.####.com/uploads/icons/1/a/1a407ee814a5bfd0ad126ba2c6499e33.png
- dce####.####.com/api/v2/group/search/by_game_id/226762
- s####.####.com/config/hz-hzv3.conf
- i####.####.com/uploads/screenshoots/c/5/c5691889e942c152ddcd8ef21d4c634a...
- i####.####.com/uploads/icons/6/f/6fe58f37120fc0ffe6bb939137a4b4a0.png
- dce####.####.com/api/index?pagesize=####&page=####
- i####.####.com/uploads/screenshoots/6/c/6c528bdf03e8788b7deaf408ab702ef5...
- i####.####.com/uploads/icons/8/3/838b8223dc2fbf5e0260026437469b12.png
- y####.####.cn/k2?protocol=####&version=####&cid=####
- i####.####.com/uploads/screenshoots/6/e/6e204ea9bd4a6be55da9acd606a02e87...
- i####.####.com/uploads/icons/2/0/20f82013ab2f1da78a0b735708b79e16.png
- 7j####.####.com/tdata_HZp166
- i####.####.com/uploads/icons/d/3/d3d79ed95eb074768a6a27383c0734d1.png
- i####.####.com/uploads/icons/f/c/fce114ec985a9f922e74ce98e0ae05c6.png
- g####.####.com/img/0/512_512/1d93dd9a4a782e043407790afb0ccae9.png
- dce####.####.com/api/clients/releases/latest
- dce####.####.com/api/popup
- i####.####.com/uploads/icons/0/9/09509fa49bb1ca04635b54f2982fa12f.png
- i####.####.com/uploads/cats/b/7/b72242221e976434f57c7db9cfefab69.png
- i####.####.com/uploads/icons/3/a/3aa10481d2282dd7ad394b1bef0694b8.png
- i####.####.com/uploads/icons/2/1/21954f9c2124cd6cbdc3c44e2f143745.png
- dce####.####.com/api/ranking?type=####&page=####
- i####.####.com/uploads/icons/8/a/8a6c0b9c1a78e693c616c83fad487701.png
- i####.####.com/gcenter.json
- i####.####.com/uploads/screenshoots/8/6/8670895f26738b093c08def5666225b8...
- d####.####.cn/jarFile/SDKAutoUpdate/hot.jar
- i####.####.com/uploads/icons/2/d/2d9d457b1b647d8004c459da65cb8cbe.png
- i####.####.com/uploads/carousels/5/b/5b3a6385772e6e76d02a8097465cff89.jpg
HTTP POST requests:
- b####.####.com/jiagu/mark/upgrade
- s####.####.com/pkl16.html
- d####.####.com/api/sdk/reportactive?cuid=####&svr=####&ovr=####&device=#...
- p####.####.com/jiagu/msgs
- b####.####.com/jiagu/t/infos
- h####.####.com/app.gif
- s####.####.com/api.php?format=####&t=####
- y####.####.cn/k1?requestId=####&g=####
- dce####.####.com/api/games/manage
- d####.####.com/api/sdk/reportapplist?cuid=####&svr=####&ovr=####&device=...
- c-h####.####.com/api.php?format=####&t=####
- d####.####.com/api/sdk/activate?cuid=####&svr=####&ovr=####&device=####&...
- dce####.####.com/
Modified file system:
Creates the following files:
- /data/data/####/files/.jiagu.lock
- /data/data/####/shared_prefs/TrineaAndroidCommon.xml
- /data/data/####/cache/image_manager_disk_cache/a775c92ae3786c2a8bc4c57c4cd44ea54288b810e2ed0d9acd59f5df1db7b926.0.tmp
- /data/data/####/databases/download.db
- /data/data/####/cache/image_manager_disk_cache/bbee5980ebc63c56b44200d32da978ae2de3733a320bf01a37030e426c7349d5.0.tmp
- /data/data/####/shared_prefs/tbs_download_config.xml.bak
- /data/data/####/shared_prefs/gx_sp.xml
- /data/data/####/files/init.pid
- /data/data/####/cache/image_manager_disk_cache/87bf72ce7518e3d4a00805311767c710a2ff3d78b4b5f28696d07ee4d14e9270.0.tmp
- /data/data/####/shared_prefs/####_preferences.xml.bak
- /sdcard/backups/system/.timestamp
- /data/data/####/databases/pushsdk.db-journal
- /data/data/####/app_tbs/share/core_info
- /data/data/####/databases/Staistics-journal
- /data/data/####/databases/pushg.db-journal
- /data/data/####/cache/image_manager_disk_cache/6dc3b9a823565955ae531d0eeacac10c1a25aa5677558c569b3008e0fe9de6ff.0.tmp
- /data/data/####/cache/image_manager_disk_cache/3a2451439d7c33b20800b7f31bc2545b402975cf95dc3f0f19f7a9b8a54e2976.0.tmp
- /sdcard/libs/####.db
- /data/data/####/shared_prefs/loadingImg.xml
- /data/data/####/cache/image_manager_disk_cache/c024dc183151135bbf269d4200460f5436dab808ef279a59fec537c85251c629.0.tmp
- /data/data/####/files/__local_stat_cache.json
- /data/data/####/files/__local_ap_info_cache.json
- /data/data/####/databases/hjdata.db
- /data/data/####/app_jgls/.log.ls
- /data/data/####/cache/image_manager_disk_cache/c8a6dd06f27f033feeaffec7d4696d00d11c382bfbeca91577340c11f73868e3.0.tmp
- /data/data/####/databases/increment.db-journal
- /data/data/####/cache/image_manager_disk_cache/f8b2516c76141292c5a3279ec6cf5b74530b3964dd9d9bebb79e59382d26ba40.0.tmp
- /data/data/####/files/init_c.pid
- /sdcard/backups/.SystemConfig/.cuid2
- /data/data/####/databases/downloadswc
- /data/data/####/shared_prefs/hj_datasdk_settings.xml
- /data/data/####/cache/image_manager_disk_cache/dc2c0bfe4b9232508012c8132dacb0023ed311df9f82c9f842603fcf8720fba7.0.tmp
- /sdcard/backups/system/.confd
- /data/data/####/files/libcuid.so
- /data/data/####/files/run.pid
- /data/data/####/shared_prefs/setting.xml
- /data/data/####/shared_prefs/hj_datasdk_settings.xml.bak
- /data/data/####/databases/Staistics
- /data/data/####/cache/image_manager_disk_cache/a09723f002cdccf3826952fa825e8d264e160617ec90378db22bcc8006814239.0.tmp
- /data/data/####/shared_prefs/a.xml.bak
- /data/data/####/shared_prefs/setting.xml.bak
- /data/data/####/shared_prefs/version.xml
- /sdcard/dt/restime.dat
- /data/data/####/cache/image_manager_disk_cache/e3b5641dee18905b3e7eedd0136cd5c41c24181b57d27df41cb525c0ed9139e7.0.tmp
- /data/data/####/shared_prefs/jg_core_setting.xml
- /data/data/####/shared_prefs/requisite.xml
- /data/data/####/cache/image_manager_disk_cache/4354aabc85f0b39958c034c8114bb922e7dda4fc9ba672d61fd740cb9fe426e0.0.tmp
- /data/data/####/files/.jglogs/.jg.ac
- /data/data/####/cache/image_manager_disk_cache/6c211c9cdc0948368a7b67649dd569525c09681fa075ebbed2f38cb9ce7af9a5.0.tmp
- /data/data/####/shared_prefs/tbs_download_config.xml
- /data/data/####/cache/image_manager_disk_cache/8edfd12a388dc1615aacdc8e37811e8907a1b85b0fde9cdac0e5cc559f5e18af.0.tmp
- /sdcard/huanju/data/config.properties
- /data/data/####/databases/hjdata.db-journal
- /data/data/####/files/push.pid
- /data/data/####/.jiagu/libjiagu.so
- /sdcard/TiantianGame/cachePic/4a570cf96e8d61234a33351445ebace5
- /data/data/####/cache/image_manager_disk_cache/79bb0eb137d7bf0e866c60f90fd4f5d0d2d6a21fef8c1af4f5f8a1d60d2fe6ba.0.tmp
- /data/data/####/cache/image_manager_disk_cache/29fcc986723fbad75b8849bd1a6384ad84f3a9c533b9bcc16fb3a393f668de58.0.tmp
- /data/data/####/shared_prefs/jg_core_setting.xml.bak
- /data/data/####/cache/image_manager_disk_cache/d19a8c7d171a17d582328a97388f38b23c09c6827e99c0ea763ea6c17e4f2733.0.tmp
- /data/data/####/cache/image_manager_disk_cache/d2014a04cbedcfbe3aba62fe2feefa7754d1af49989ee8076b0ec5f971626b1b.0.tmp
- /sdcard/Android/data/.nomedia
- /sdcard/system/tmp/local/tdata_Now710
- /data/data/####/cache/image_manager_disk_cache/7b9f7325d7e2713b85437685e79da5ff828f6cd56c9e1f049162deed5108d9ee.0.tmp
- /data/data/####/shared_prefs/packverson.xml
- /data/data/####/cache/image_manager_disk_cache/0de228aa597e133fe11d254cfb0af4543f2fcfe81532c6f186ed6661e50e57c2.0.tmp
- /data/data/####/shared_prefs/versionUpdate.xml
- /data/data/####/databases/favorite
- /data/data/####/databases/download.db-journal
- /data/data/####/app_jgls/.log.lock
- /data/data/####/shared_prefs/loadingImg.xml.bak
- /data/data/####/shared_prefs/st.xml
- /data/data/####/files/.jglogs/.log3
- /data/data/####/files/__local_last_session.json
- /data/data/####/cache/image_manager_disk_cache/2a1baf330e76386c14fadc4cba3107d2eed22ddad444f24ef5b11535d6266e86.0.tmp
- /data/data/####/files/__send_data_1493729796378
- /data/data/####/shared_prefs/LTBL_Game.xml
- /data/data/####/cache/image_manager_disk_cache/b08db63dfb7b723eacfec548daec49411aac98948943d764b4496a1de77ba10a.0.tmp
- /data/data/####/files/__send_data_1493729820895
- /data/data/####/app_tbs/core_private/tbscoreinstall.txt
- /data/data/####/cache/image_manager_disk_cache/b734c4b1321102748214e5103e6cf8ada41bfc6fa5cfee65afabad39db7d442e.0.tmp
- /data/data/####/cache/image_manager_disk_cache/0ad056106dc3b752f8f588d5e191527a45fd882e25cde7403cfbacee147eedae.0.tmp
- /sdcard/huanju/.cuid
- /data/data/####/databases/downloadswc-journal
- /data/data/####/databases/wakeup_silence_user.db-journal
- /data/data/####/shared_prefs/####_preferences.xml
- /data/data/####/cache/image_manager_disk_cache/5f8ad9e4866e5d651130da7463a9d44b59c3c548a7a5c0a9d5705e59595072b7.0.tmp
- /data/data/####/cache/image_manager_disk_cache/f3234d401f4348511d20152c65077662f843cdb09fd7f7d3c06e091f3df8c36f.0.tmp
- /data/data/####/databases/favorite-journal
- /sdcard/Download/bu/4.8_hot.jar.tmp
- /data/data/####/cache/image_manager_disk_cache/ee2e244a0cf0c06a0e054eb4ddb9111aaa013de589c90c840be0decd8b246b69.0.tmp
- /data/data/####/shared_prefs/configs.xml
- /data/data/####/cache/image_manager_disk_cache/42f13fb070221ecddb74b3f1c666d86f12e92c96535997360d727f70f209560b.0.tmp
- /data/data/####/cache/image_manager_disk_cache/2676570e7e8c59d2cad74d8933927002bd7604a6703c4f25bbf18b8d873a4e02.0.tmp
- /sdcard/libs/com.igexin.sdk.deviceId.db
- /data/data/####/files/tdata_Now710.jar
- /data/data/####/files/tdata_Now710
- /sdcard/backups/system/.confd-journal
- /data/data/####/shared_prefs/a.xml
- /data/data/####/files/.jglogs/.jg.ri
- /data/data/####/cache/image_manager_disk_cache/915e6b876e02c24547f35729f9e5c55f2ecc8556ed532f726c64d24ab0516083.0.tmp
- /data/data/####/shared_prefs/W_Key.xml
- /data/data/####/app_tbs/core_private/tbslock.txt
- /data/data/####/cache/image_manager_disk_cache/journal.tmp
- /sdcard/libs/app.db
- /data/data/####/shared_prefs/__Baidu_Stat_SDK_SendRem.xml
- /sdcard/Android/data/####/files/tbslog/tbslog.txt
- /data/data/####/cache/image_manager_disk_cache/6130a39ec2baf06b78305997557d63554ba53b749492477ad2c2b9ee23589557.0.tmp
- /sdcard/backups/.SystemConfig/.cuid
Sets the 'executable' attribute to the following files:
- /data/data/####/.jiagu/libjiagu.so
Miscellaneous:
Executes next shell scripts:
- ps
- /system/bin/app_process /system/bin com.android.commands.am.Am start -n com.android.settings/com.android.settings.cyanogenmod.superuser.RequestActivity --es socket /dev/com.android.settings/.socket2132 --user 0
- chmod 755 /data/data/####/.jiagu/libjiagu.so
- su
- /system/bin/dexopt --dex 27 83 40 111712 /storage/emulated/0/download/bu/4.8_hot.jar 1252293479 -1887743774 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /system/framework/frame
- getprop ro.product.cpu.abi
- sh
- getprop ro.miui.ui.version.name
- /system/bin/dexopt --dex 27 58 40 367276 /data/data/####/files/tdata_Now710.jar 1250380577 1845301131 45 /system/framework/core.jar /system/framework/core-junit.jar /system/framework/bouncycastle.jar /system/framework/ext.jar /s
- /system/bin/app_process /system/bin com.android.commands.am.Am broadcast -n com.android.settings/com.android.settings.cyanogenmod.superuser.SuReceiver --ei binary_version 16 --es from_name u0_a44 --es desired_name --ei uid 10044 --ei desired_uid 0 --es c
Uses elevated priveleges.
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
