Android.MulDrop.1039

Technical information

Malicious functions:

Prompts to install third-party applications.

Network activity:

Connecting to:

s####.####.com
ap####.####.com
ta####.com
t####.####.com
p####.####.com
s####.####.cn
c####.####.com
d####.####.com
l####.####.com
m####.####.com
a####.####.com
b####.####.com

HTTP GET requests:

c####.####.com/group1/M00/01/7D/oYYBAFcsLxWAIBHTAAA8LDGJXVk398.jpg
ap####.####.com/v2/Util/GetHolidayCalendar?machineCode=####&version=####&imei=####&system=####&lang=####&channel=####
ap####.####.com/portal/asfee/getAslt?lang=####
ap####.####.com/portal/animation/getSourceUrl?version=####&imei=####&system=####&deviceToken=####&lang=####&regId=####&channel=####
m####.####.com/?sprefer=####
c####.####.com/uploads/201512/567a1478e8fa8.jpg
c####.####.com/uploads/201603/a6508e4e2d7761ebf6d437f6146227b7.jpg
ap####.####.com/apiphpconf/getYcfStatus.php?version=####&imei=####&system=####&deviceToken=####&lang=####&regId=####&channel=####
ap####.####.com/portal/asfee/getAslt?system=####&deviceToken=####&imei=####&machineCode=####&lang=####&channel=####&regId=####&version=####
c####.####.com/caconf?appkey=####&plat=####&apppkg=####&appver=####&networktype=####
c####.####.com/group1/M00/01/9C/oYYBAFcz2gGAGmVyAABAiIP0y6k707.jpg
ap####.####.com/v2/Tag/PackageTagList?machineCode=####&version=####&imei=####&system=####&lang=####&channel=####
ta####.com/
ap####.####.com/api/common/mergeConfig?version=####&imei=####&system=####&deviceToken=####&lang=####&regId=####&channel=####
ap####.####.com/portal/scenic/ScenicIndex?version=####&imei=####&system=####&deviceToken=####&lang=####&regId=####&cityCode=####&channel=####
c####.####.com/group1/M00/03/65/oYYBAFei6-mALNyGAABRP3ueu2w715.jpg
c####.####.com/group1/M00/01/2E/ooYBAFcYhNmAQPSuAABEUO6QqGk960.jpg
ap####.####.com/portal/caidan/indexInfo?version=####&imei=####&system=####&deviceToken=####&lang=####&regId=####&channel=####
ap####.####.com/you/advertiselist/AdList?column=####&area_code=####&version=####&imei=####&system=####&deviceToken=####&lang=####&regId=####&channel=#...
c####.####.com/download/android/yaochufa_smartisan.apk?version=####
ap####.####.com/you/advertiselist/Promotion?column=####&version=####&imei=####&system=####&deviceToken=####&lang=####&regId=####&cityCode=####&channel...
ap####.####.com/playpoint/qualitySimple?userId=####&pageIndex=####&version=####&imei=####&currentCityCode=####&system=####&deviceToken=####&lang=####&...
ap####.####.com/util/appLatestVersion?version=####&imei=####&system=####&deviceToken=####&lang=####&regId=####&channel=####
ap####.####.com/notify/msgcenter/updatetag?userId=####&version=####&tag=####&imei=####&system=####&deviceToken=####&lang=####&regId=####&channel=####
ap####.####.com/v2/Position/GetCityList?machineCode=####&version=####&imei=####&system=####&lang=####&channel=####

HTTP POST requests:

a####.####.com/errconf
b####.####.com/jiagu/mark/upgrade
s####.####.com/pkl16.html
d####.####.com/dinfo
b####.####.com/jiagu/t/infos
p####.####.com/jiagu/msgs
t####.####.com/kafkahttp/kafka/log
a####.####.com/conn
s####.####.cn/v2/report
a####.####.com/log4
a####.####.com/conf5
l####.####.com/sdk.php
c####.####.com/ca
a####.####.com/data2
l####.####.com/offline_loc
d####.####.com/dsign

Modified file system:

Creates the following files:

/data/data/####/files/.jiagu.lock
/data/data/####/cache/image_cache/v2.ols100.1/59/el9Y9Q6ZsJI4E-CRoZuSE_GPT2E.1817763379.tmp
/data/data/####/cache/image_cache/v2.ols100.1/99/g03DXiIyOVPsv22QrJPf8OR7H10.337605369.tmp
/sdcard/Mob/.db_accache
/data/data/####/cache/image_cache/v2.ols100.1/24/YiBf6AHBgssyQxVW4qiSfzMvUcM.-915571128.tmp
/data/data/####/cache/webviewCacheChromium/data_3
/data/data/####/cache/webviewCacheChromium/data_2
/data/data/####/cache/webviewCacheChromium/data_1
/data/data/####/cache/webviewCacheChromium/data_0
/data/data/####/databases/webviewCookiesChromium.db-journal
/data/data/####/shared_prefs/HDRGetter.xml
/data/data/####/shared_prefs/statistics_info_tdb.xml
/sdcard/data/.push_deviceid
/data/data/####/files/ofld/ofl_location.db-journal
/data/data/####/shared_prefs/Cache_Cities_static_areaList.xml.bak
/data/data/####/shared_prefs/Cache_Cities_historyAreaList.xml.bak
/data/data/####/shared_prefs/bottomBanner_cache_t_db.xml.bak
/data/data/####/shared_prefs/umeng_general_config.xml
/data/data/####/cache/image_cache/v2.ols100.1/92/ICd8Tv3cVJaJJtZN6zoNUy1gJEk.747578757.tmp
/data/data/####/shared_prefs/jpush_device_info.xml
/data/data/####/shared_prefs/cn.jpush.android.user.profile.xml.bak
/data/data/####/databases/webview.db-journal
/data/data/####/shared_prefs/share_sdk_1.xml
/sdcard/Mob/.duid
/data/data/####/files/.lock
/data/data/####/cache/image_cache/v2.ols100.1/54/wBQuaHY-9b9O7SeGCuQWwEkNJh4.-1075724518.tmp
/data/data/####/cache/webviewCacheChromium/index
/sdcard/baidu/tempdata/conlts.dat
/sdcard/baidu/tempdata/ls.db
/data/data/####/files/libcuid.so
/data/data/####/cache/webviewCacheChromium/f_00000a
/data/data/####/cache/image_cache/v2.ols100.1/33/8-TvUlGMJI9Mv7yU8R4iYrJcV-Q.36614627.tmp
/data/data/####/cache/webviewCacheChromium/f_00000b
/data/data/####/cache/webviewCacheChromium/f_00000e
/data/data/####/cache/webviewCacheChromium/f_00000d
/data/data/####/cache/webviewCacheChromium/f_00000f
/data/data/####/databases/jpush_local_notification.db-journal
/data/data/####/shared_prefs/jg_core_control.xml.bak
/data/data/####/shared_prefs/HomeBanner_cache_t_db.xml.bak
/data/data/####/databases/zhuge-journal
/data/data/####/shared_prefs/HomeBanner_cache_t_db.xml
/data/data/####/cache/image_cache/v2.ols100.1/20/6WqiM8qFmN78YNu4v77yUYcr9qA.-956483043.tmp
/data/data/####/cache/image_cache/v2.ols100.1/39/uUN7ENmilQ9LGtltHRkRTro3fHk.1977290412.tmp
/sdcard/Android/data/####/cache/6n2w9d962c1r72avn3xs6jz8h.tmp
/data/data/####/shared_prefs/bottomBanner_cache_t_db.xml
/data/data/####/shared_prefs/cn.jpush.preferences.v2.xml.bak
/data/data/####/cache/image_cache/v2.ols100.1/46/X3UCM6GFsTAjdJ-rXmPT2Q5sixY.-348542854.tmp
/data/data/####/shared_prefs/Cache_Cities_areaList.xml
/sdcard/Mob/.db_rtcache
/data/data/####/cache/image_cache/v2.ols100.1/12/XkEyK0TmrlYm3f7FfZ8GYiDJxyk.-2092506131.tmp
/data/data/####/databases/jpush_statistics.db-journal
/data/data/####/cache/image_cache/v2.ols100.1/36/tGiP2D7Bh2T1aSkwb4CzygKrdSY.2081018136.tmp
/data/data/####/cache/image_cache/v2.ols100.1/50/5oOUQSVO_bPpVcQ2YddkSAejcMY.-1164831931.tmp
/data/data/####/files/jpush_stat_cache_history.json
/data/data/####/cache/image_cache/v2.ols100.1/13/cmOtXEqVdbi4KbWny-Zv0Su_3O8.-27959441.tmp
/data/data/####/files/.jglogs/.jg.ac
/data/data/####/cache/webviewCacheChromium/f_000009
/data/data/####/cache/webviewCacheChromium/f_000008
/data/data/####/shared_prefs/appconfiguration_tab_db.xml.bak
/data/data/####/files/lldt/firll.dat
/data/data/####/cache/webviewCacheChromium/f_000001
/data/data/####/cache/webviewCacheChromium/f_000003
/data/data/####/cache/webviewCacheChromium/f_000002
/data/data/####/cache/webviewCacheChromium/f_000005
/data/data/####/cache/webviewCacheChromium/f_000004
/data/data/####/cache/webviewCacheChromium/f_000007
/data/data/####/cache/image_cache/v2.ols100.1/27/fmTjOKSC9LkCahOynpEhxM1oR1Y.-1364676583.tmp
/sdcard/Android/data/####/cache/.nomedia
/data/data/####/files/.jglogs/.jg.ic
/data/data/####/files/ofld/ofl_location.db
/sdcard/Mob/.dk
/data/data/####/shared_prefs/all_config_db.xml
/data/data/####/cache/image_cache/v2.ols100.1/0/fKvHDAxOdYP8-Vhvzzvjo5uxURU.-107741789.tmp
/data/data/####/.jiagu/libjiagu.so
/data/data/####/databases/yaochufa-journal
/data/data/####/shared_prefs/mob_sdk_exception_1.xml
/data/data/####/shared_prefs/location_info_t_db.xml
/sdcard/Mob/.pkg_lock
/sdcard/Mob/.globalLock
/data/data/####/shared_prefs/share_sdk_1.xml.bak
/sdcard/baidu/tempdata/ls.db-journal
/sdcard/backups/.SystemConfig/.cuid2
/data/data/####/files/.statistics
/data/data/####/cache/webviewCacheChromium/f_000018
/data/data/####/cache/webviewCacheChromium/f_000016
/data/data/####/cache/webviewCacheChromium/f_000017
/data/data/####/cache/webviewCacheChromium/f_000014
/data/data/####/cache/webviewCacheChromium/f_000015
/data/data/####/cache/webviewCacheChromium/f_000012
/data/data/####/cache/webviewCacheChromium/f_000013
/data/data/####/cache/webviewCacheChromium/f_000010
/data/data/####/cache/webviewCacheChromium/f_000011
/data/data/####/files/ofld/ofl.config
/data/data/####/databases/cc/cc.db-journal
/data/data/####/shared_prefs/####b744d4b142c942c09cdc5095ba060824.xml
/data/data/####/shared_prefs/Cache_Cities_areaList.xml.bak
/sdcard/Android/data/####/cache/4ql1ns7i3bzbmp7bvx3pfel2k.tmp
/data/data/####/shared_prefs/Cache_Cities_historyAreaList.xml
/data/data/####/cache/webviewCacheChromium/f_000006
/data/data/####/databases/sharesdk.db-journal
/data/data/####/shared_prefs/Cache_Cities_hotList.xml.bak
/data/data/####/cache/image_cache/v2.ols100.1/46/olS6J4j7GIg44u4g01j3Feu-Yko.-159225235.tmp
/sdcard/yaochufa/apk/yaochufa.apk
/data/data/####/shared_prefs/appconfiguration_tab_db.xml
/data/data/####/shared_prefs/jg_core_control.xml
/data/data/####/shared_prefs/####.xml
/data/data/####/shared_prefs/location_info_t_db.xml.bak
/data/data/####/cache/image_cache/v2.ols100.1/70/ZeK5sUFbuwosx2Vh5IXt2C7v_3s.316098915.tmp
/data/data/####/shared_prefs/HomeScenicCity_cache_t_db.xml.bak
/data/data/####/shared_prefs/holiday_info_db.xml
/sdcard/test.0
/sdcard/baidu/tempdata/ller.dat
/data/data/####/shared_prefs/all_config_db.xml.bak
/sdcard/Mob/.rc_lock
/data/data/####/cache/image_cache/v2.ols100.1/83/C1Ynougdz7ZPz1eIV7sQLkSjLyw.971446553.tmp
/data/data/####/shared_prefs/multidex.version.xml
/data/data/####/cache/image_cache/v2.ols100.1/37/a5d4rn5PB2DTAZLybUJfJ9MManU.1501578020.tmp
/data/data/####/shared_prefs/holiday_info_db.xml.bak
/data/data/####/databases/jpush_statistics.db
/data/data/####/shared_prefs/####_preferences.xml
/data/data/####/databases/yaochufa
/data/data/####/files/.jglogs/.log3
/data/data/####/cache/image_cache/v2.ols100.1/43/gHPeLnMobyE-tYqX0U5nZ9oYmCk.1047821958.tmp
/data/data/####/databases/cc/cc.db
/data/data/####/shared_prefs/city_info_sp_db.xml.bak
/data/data/####/shared_prefs/HomeScenicCity_cache_t_db.xml
/data/data/####/cache/image_cache/v2.ols100.1/79/YdkKNCxkCpA1m0OgnoEdRyYmZBQ.1736193634.tmp
/data/data/####/shared_prefs/city_info_sp_db.xml
/data/data/####/shared_prefs/cn.jpush.android.user.profile.xml
/data/data/####/files/.jglogs/.jg.ri
/data/data/####/databases/jpush_local_notification.db
/data/data/####/cache/image_cache/v2.ols100.1/7/rrMVQy6MfS72L03HAaQfQMxOAfo.712277238.tmp
/data/data/####/shared_prefs/cn.jpush.preferences.v2.xml
/data/data/####/files/ofld/ofl_statistics.db-journal
/data/data/####/files/ofld/ofl_statistics.db
/data/data/####/shared_prefs/Cache_Cities_static_areaList.xml
/data/data/####/shared_prefs/mob_sdk_exception_1.xml.bak
/data/data/####/shared_prefs/####b744d4b142c942c09cdc5095ba060824.xml.bak
/data/data/####/shared_prefs/umeng_general_config.xml.bak
/data/data/####/shared_prefs/Cache_Cities_hotList.xml
/data/data/####/cache/image_cache/v2.ols100.1/76/ZrAS1HsDwvT4-ph8GIELnc38nJo.-2031248725.tmp
/data/data/####/databases/zhuge
/data/data/####/files/mobclick_agent_cached_####69
/data/data/####/shared_prefs/general_pre.xml
/sdcard/backups/.SystemConfig/.cuid
/data/data/####/cache/webviewCacheChromium/f_00000c
/data/data/####/cache/image_cache/v2.ols100.1/84/u7mH-tDLwDbPnN-zQTIG9X-9dYI.1873455472.tmp

Sets the 'executable' attribute to the following files:

/data/data/####/.jiagu/libjiagu.so

Miscellaneous:

Executes next shell scripts:

ps
chmod 755 /data/data/####/.jiagu/libjiagu.so
top -d 0 -n 1

Uses special library to hide executable bytecode.

Contains functionality to send SMS messages automatically.

Technologies

Begriffe

Schulung und Training

Mythen

Technical information

Curing recommendations

Free trial