Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Egame.1
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) unip####.wos####.cn:8080
- TCP(HTTP/1.1) un####.wos####.cn:8061
- TCP(HTTP/1.1) unipa####.wos####.cn:8080
- TCP(HTTP/1.1) se####.wos####.cn:81
DNS requests:
- se####.wos####.cn
- un####.wos####.cn
- unip####.wos####.cn
- unipa####.wos####.cn
HTTP GET requests:
- unip####.wos####.cn:8080/SDKStoreManager/upload/upZip/1537540550424.zip
- unipa####.wos####.cn:8080/SDKStoreManager/sdkRequest/sdkupdate.do?sdktyp...
HTTP POST requests:
- se####.wos####.cn:81/unipay/precheck
- un####.wos####.cn:8061/logserver/unipay/unipayLogin
File system changes:
Creates the following files:
- /data/data/####/4.1.0L2111B0913_resource_400.apk
- /data/data/####/MiguPay.Sdk20.Lib_26002_2C0CBBCBE5256201F65BD11...1E.dat
- /data/data/####/appsdkmg0_.jar
- /data/data/####/libjiagu.so
- /data/data/####/login
- /data/data/####/mg20css.dat
- /data/data/####/mg20dss.dat
- /data/data/####/mg20irid.dat
- /data/data/####/msg_store.xml
- /data/data/####/sdk_load_info.xml
- /data/data/####/unicom_cl.xml
- /data/data/####/unicom_cl.xml.bak
- /data/media/####/data0.dat
- /data/media/####/data1.dat
Miscellaneous:
Executes the following shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
Loads the following dynamic libraries:
- libjiagu
- libmg20p_03.08.01_01
- me_unipay
- megjb
- mg20pbase
Uses the following algorithms to encrypt data:
- DESede-CBC-NoPadding
Uses the following algorithms to decrypt data:
- RSA-ECB-PKCS1Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
