Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.RemoteCode.337.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) gr-i####.c####.ufi####.com:80
- TCP(HTTP/1.1) api.lig####.com:80
- TCP(TLS/1.0) rr18---####.g####.com:443
- TCP(TLS/1.0) gr-i####.c####.ufi####.com:443
- TCP(TLS/1.0) g####.com:443
- TCP(TLS/1.0) api.lig####.com:443
- TCP(TLS/1.0) 1####.250.150.94:443
- TCP(TLS/1.0) 64.2####.161.139:443
- TCP(TLS/1.0) and####.b####.qq.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) rr5---s####.g####.com:443
- TCP(TLS/1.0) rr16---####.g####.com:443
- TCP(TLS/1.0) firebas####.google####.com:443
- TCP(TLS/1.0) app-mea####.com:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.2) 1####.250.150.94:443
- TCP(TLS/1.2) app-mea####.com:443
- TCP(TLS/1.2) md####.google####.com:443
- TCP(TLS/1.2) 64.2####.161.139:443
- TCP arm.z####.cn:10016
- TCP arm.z####.cn:10020
- TCP arm.z####.cn:10007
- TCP api.lig####.com:443
- UDP p####.google####.com:443
- UDP md####.google####.com:443
DNS requests:
- and####.b####.qq.com
- and####.cli####.go####.com
- api.lig####.com
- app-mea####.com
- app.api.cx####.cn
- arm.z####.cn
- digital####.google####.com
- firebas####.google####.com
- g####.com
- gr-i####.c####.ufi####.com
- md####.google####.com
- p####.google####.com
- pla####.googleu####.com
- rr16---####.g####.com
- rr18---####.g####.com
- rr5---s####.g####.com
- www.google####.com
HTTP GET requests:
- api.lig####.com/static/indexbanner.png
- g####.com:443/mt-xiaocheng/TG/raw/科学工具/弹窗5
- gr-i####.c####.ufi####.com/upload/image/202107182351071491.jpg
- gr-i####.c####.ufi####.com/upload/image/202107182356571776.png
- gr-i####.c####.ufi####.com/upload/image/202107190025201989.png
- gr-i####.c####.ufi####.com/upload/image/202107190027121575.jpg
- gr-i####.c####.ufi####.com/upload/image/202107190028581457.png
- gr-i####.c####.ufi####.com/upload/image/202107190033181824.png
- gr-i####.c####.ufi####.com/upload/image/202107190044201877.png
- gr-i####.c####.ufi####.com/upload/image/202107190105421376.jpg
- gr-i####.c####.ufi####.com/upload/image/202107190106451434.jpg
- gr-i####.c####.ufi####.com/upload/image/202107191531071825.png
- gr-i####.c####.ufi####.com/upload/image/202107191535211749.png
- gr-i####.c####.ufi####.com/upload/image/202107191542071198.png
- gr-i####.c####.ufi####.com/upload/image/202107191543561816.png
- gr-i####.c####.ufi####.com/upload/image/202107191545451036.png
- gr-i####.c####.ufi####.com/upload/image/202107191548081683.jpg
- gr-i####.c####.ufi####.com/upload/image/202107191554331348.jpg
- gr-i####.c####.ufi####.com/upload/image/202210050025281921.jpg
- gr-i####.c####.ufi####.com/upload/image/202210050032391287.jpg
- gr-i####.c####.ufi####.com/upload/image/202210050034101137.jpg
- gr-i####.c####.ufi####.com/upload/image/202210050038211608.jpg
- gr-i####.c####.ufi####.com/upload/image/202210050046251708.png
- gr-i####.c####.ufi####.com/upload/image/202210050047541535.jpg
- gr-i####.c####.ufi####.com/upload/image/202210050050001819.jpg
- gr-i####.c####.ufi####.com:443/upload/image/suning-alipay.png
- gr-i####.c####.ufi####.com:443/upload/image/suning-wechat.png
File system changes:
Creates the following files:
- /data/data/####/.fsgkea
- /data/data/####/.jg.ac
- /data/data/####/.jg.ri
- /data/data/####/.jg.store.report_cf
- /data/data/####/.jg.store.report_pid
- /data/data/####/08fd66debe6e9f331996a8fc110e92a733854569a7cc273....0.tmp
- /data/data/####/1004
- /data/data/####/1b57cc87f0ad51945e1fef76b7c4f5e5d86df7a8ee9a694....0.tmp
- /data/data/####/1b57cc87f0ad51945e1fef76b7c4f5e5d86df7a8ee9a694...f6c2.0
- /data/data/####/1c272fc2b34cde6e3424d147781f9b9ae69d1c9dd73dcc4....0.tmp
- /data/data/####/1c272fc2b34cde6e3424d147781f9b9ae69d1c9dd73dcc4...leted)
- /data/data/####/85160662c4c5ed61e1ab238db0fda0c5c5f3e2b9e832e0f....0.tmp
- /data/data/####/8806617b61bab9ae57104df744b677524634cc1b1645f5a....0.tmp
- /data/data/####/8806617b61bab9ae57104df744b677524634cc1b1645f5a...2658.0
- /data/data/####/905484e13a53b19d29eb2df32322f92b4a8f28be3022904....0.tmp
- /data/data/####/905484e13a53b19d29eb2df32322f92b4a8f28be3022904...cf17.0
- /data/data/####/9568ce1b5eb68ae0814a6d5af222f5916181c3d71046fc7....0.tmp
- /data/data/####/9568ce1b5eb68ae0814a6d5af222f5916181c3d71046fc7...leted)
- /data/data/####/9e8b1a52044a7fbbbc99392a1dc63ae88778db384b3016a....0.tmp
- /data/data/####/9edc1b99d0f1af09d30a382052794c45dc5842ce813622d...3386.0
- /data/data/####/BUGLY_COMMON_VALUES.xml
- /data/data/####/SnHLpneBbaYS (deleted)
- /data/data/####/a338fbac1416adf6efe09025eda1640769e4d8752cafcfa....0.tmp
- /data/data/####/a338fbac1416adf6efe09025eda1640769e4d8752cafcfa...78c2.0
- /data/data/####/b1527a9776464edce5f3a4f4b811fe4feb9988894c141b3....0.tmp
- /data/data/####/b1527a9776464edce5f3a4f4b811fe4feb9988894c141b3...leted)
- /data/data/####/bd38b7cbf7a7f64b222b0fc42f12e751543ba31427ddb83...leted)
- /data/data/####/bugly_db_-journal
- /data/data/####/bugly_last_us_up_tm
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/classes.oat
- /data/data/####/crashrecord.xml
- /data/data/####/e82a90a390f035046578ef538694029161dba2879708942....0.tmp
- /data/data/####/e82a90a390f035046578ef538694029161dba2879708942...d4b6.0
- /data/data/####/ghpxvpQnhouQ (deleted)
- /data/data/####/journal
- /data/data/####/journal.tmp
- /data/data/####/libjiagu.so
- /data/data/####/local_crash_lock
- /data/data/####/native_record_lock
- /data/data/####/proc_auxv
- /data/misc/####/primary.prof
Miscellaneous:
Executes the following shell scripts:
- /system/bin/sh -c getprop
- getprop
Loads the following dynamic libraries:
- libBugly_Native
- libarm
- libjiagu
- libmmkv
Uses the following algorithms to encrypt data:
- RSA-ECB-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Uses special library to hide executable bytecode.
Displays its own windows over windows of other apps.
