Adware.Panda.597

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Panda.1.origin
Adware.Panda.8.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) a.appj####.com:80
TCP(TLS/1.0) 2####.58.208.110:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) ssl.google-####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) 2####.58.211.106:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) www.google####.com:443
TCP(TLS/1.2) 1####.217.17.67:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) 2####.58.208.110:443

DNS requests:

a.appj####.com
and####.google####.com
instant####.google####.com
md####.google####.com
p####.google####.com
safebro####.google####.com
sett####.crashly####.com
ssl.google-####.com
www.google####.com

HTTP POST requests:

a.appj####.com/ad-service/ad/mark

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/5F54482503A8-0001-0C3C-BB3DE298EB9DBeginSession.cls_temp
/data/data/####/5F54482503A8-0001-0C3C-BB3DE298EB9DSessionApp.cls_temp
/data/data/####/5F54482503A8-0001-0C3C-BB3DE298EB9DSessionOS.cls_temp
/data/data/####/5F54482B0121-0001-0C9F-BB3DE298EB9DBeginSession.cls_temp
/data/data/####/5F54482B0121-0001-0C9F-BB3DE298EB9DSessionApp.cls_temp
/data/data/####/5F54482B0121-0001-0C9F-BB3DE298EB9DSessionDevice.cls_temp
/data/data/####/5F54482B0121-0001-0C9F-BB3DE298EB9DSessionOS.cls_temp
/data/data/####/5F54482B0121-0001-0C9F-BB3DE298EB9Duser.meta
/data/data/####/9847dd484a0e1bc195a48c2703e8b8e7.dex
/data/data/####/9847dd484a0e1bc195a48c2703e8b8e7.dex.flock (deleted)
/data/data/####/DIALOG_PREF_FILE.xml
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/alarm_snooze_pref_file.xml
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/crashalytics_uid.xml
/data/data/####/crashlytics-userlog-5F54482B0121-0001-0C9F-BB3D...D.temp
/data/data/####/fliclib
/data/data/####/fliclib-journal
/data/data/####/gaClientId
/data/data/####/initialization_marker
/data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.andr...ng.xml
/data/data/####/jg_app_update_settings_random.xml
/data/data/####/libjiagu.so
/data/data/####/mbanner_db-journal
/data/data/####/mexit_db-journal
/data/data/####/mmini_db-journal
/data/data/####/mpush_db-journal
/data/data/####/mrdata.db-journal
/data/data/####/mscreen_db-journal
/data/data/####/mspeed_db-journal
/data/data/####/proc_auxv
/data/data/####/session_analytics.tap (deleted)
/data/data/####/session_analytics.tap.tmp
/data/media/####/9847dd484a0e1bc195a48c2703e8b8e7.zip
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes2.dex --oat-file=<Package Folder>/.jiagu/classes.oat
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/storage/emulated/0/.cache/<Package>/9847dd484a0e1bc195a48c2703e8b8e7.zip --oat-fd=58 --oat-location=/data/user/0/<Package>/app_dex/9847dd484a0e1bc195a48c2703e8b8e7.dex --compiler-filter=speed
chmod 755 /data/user/0/<Package>/files/libjiagu.so

Uses the following algorithms to encrypt data: