Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.840.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) 74.1####.206.95:443
- TCP(TLS/1.0) st####.dc####.net.cn:443
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) safebro####.google####.com:443
- TCP(TLS/1.2) 1####.250.110.113:443
- TCP(TLS/1.2) 74.1####.206.95:443
- TCP(TLS/1.2) 1####.177.15.94:443
DNS requests:
- and####.google####.com
- m####.go####.com
- safebro####.google####.com
- st####.dc####.net.####.8
- st####.dc####.net.cn
HTTP POST requests:
- st####.dc####.net.cn:443/collect/crash
File system changes:
Creates the following files:
- /data/data/####/.cl
- /data/data/####/.fsgkea
- /data/data/####/.jg.ac
- /data/data/####/.jg.ri
- /data/data/####/.jg.store.report_pid
- /data/data/####/1f40dd659bfee8755f96a7a56005fc3e
- /data/data/####/2290f18db9f7cbc065b41a3a3d5acdb9
- /data/data/####/2b656667a1b13e3b4663ada23681060a
- /data/data/####/331e990e8e43e92ddf2becf93d026a35
- /data/data/####/54fb2bedf283aafcffad07666573a084
- /data/data/####/5bed6e2c6b4d002296642398eba3a2f8
- /data/data/####/6902c1fdb1211ed39b8df97c4f4f55ae
- /data/data/####/69c6e8debf47e3d37d97c0c4d8216ec2
- /data/data/####/7ea4266251191fbffcf7c815a6006837
- /data/data/####/8b5d90c8b527d625cafda7b0ca1df888
- /data/data/####/WebViewChromiumPrefs.xml
- /data/data/####/__UNI__EEDC0FB.xml
- /data/data/####/a6d02ca6ec554218c561574a55279eb1
- /data/data/####/aee3e7a9e7abe10bdd9251f6b3dde67a
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/classes.dex;classes4.dex
- /data/data/####/crash_dump.log
- /data/data/####/d85765cc44e769a7959e3bfe73653ee0
- /data/data/####/dd796b6c7411e070038616407d373d36
- /data/data/####/dso_deps
- /data/data/####/dso_lock
- /data/data/####/dso_manifest
- /data/data/####/dso_state
- /data/data/####/efe6f9d1aafd01eb9a72033a0cfc3309
- /data/data/####/f6fc2c932d8ac23289d105466b14a130
- /data/data/####/grp.prop
- /data/data/####/io.dcloud.H524F54C2_preferences.xml
- /data/data/####/libjiagu.so
- /data/data/####/libweexjsb.so
- /data/data/####/metrics_guid
- /data/data/####/pdr.xml
- /data/data/####/webview_data.lock
- /data/data/####/weex_default_settings.xml
- /data/misc/####/primary.prof
- /data/user_de/####/move_to_de_records.xml
Miscellaneous:
Executes the following shell scripts:
- <Package>:jse 37 38 1 /data/user/0/<Package>/app_crash/crash_dump.log
- <Package>:jse 46 39 1 /data/user/0/<Package>/app_crash/crash_dump.log
- <Package>:jse 72 87 1 /data/user/0/<Package>/app_crash/crash_dump.log
- <Package>:jse 85 87 1 /data/user/0/<Package>/app_crash/crash_dump.log
Loads the following dynamic libraries:
- libc++_shared
- libjiagu
- libweexcore
Uses the following algorithms to encrypt data:
- RSA-ECB-PKCS1Padding
Uses special library to hide executable bytecode.
Displays its own windows over windows of other apps.
