Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.859.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) v2.g####.qq.com:80
- TCP(HTTP/1.1) webc####.for####.cc####.com:80
- TCP(HTTP/1.1) c.d####.mob.com:80
- TCP(HTTP/1.1) kln.g####.sina####.com:80
- TCP(HTTP/1.1) p2.so.q####.com:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) e0.ifen####.com.####.com:80
- TCP(HTTP/1.1) p3.so.q####.com:80
- TCP(HTTP/1.1) s####.tc.qq.com:80
- TCP(HTTP/1.1) c2.hoopc####.com.cn:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) i####.so.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) p.nanr####.net.####.com:80
- TCP(HTTP/1.1) m.d####.mob.com:80
- TCP(HTTP/1.1) src.r####.com.####.com:80
- TCP(HTTP/1.1) 2####.195.1.254:8080
- TCP(HTTP/1.1) www.hi####.cn:80
- TCP(HTTP/1.1) sdk.c####.com:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) idv####.qini####.com:80
- TCP(TLS/1.0) p.nanr####.net.####.com:443
- TCP(TLS/1.0) 2####.58.211.110:443
- TCP(TLS/1.0) ssls####.jom####.com:443
- TCP(TLS/1.0) s####.j####.cn:443
- UDP s.j####.cn:19000
- TCP 39.98.2####.253:7010
DNS requests:
- a####.exc.mob.com
- a####.u####.com
- api.s####.mob.com
- c.d####.mob.com
- c2.hoopc####.com.cn
- e0.ifen####.com
- g####.bdst####.com
- i####.so.com
- i1.sin####.cn
- imgc####.qq.com
- m.d####.mob.com
- mi.g####.qq.com
- os7eu####.bkt.clo####.com
- ovfd2####.bkt.clo####.com
- p####.ugd####.com
- p.nanr####.net
- p0.so.q####.com
- p2.so.q####.com
- p3.so.q####.com
- pic.b####.s####.com
- qp.yunanfu####.com
- qzones####.g####.cn
- s####.e.qq.com
- s####.j####.cn
- s.j####.cn
- sdk.c####.com
- sis.j####.io
- src.r####.com
- v2.g####.qq.com
- www.hi####.cn
- www.pe####.com.cn
HTTP GET requests:
- c2.hoopc####.com.cn/uploads/star/event/images/141121/e7a9cce6968098def01...
- e0.ifen####.com.####.com/10/2018/1117/95C73EE8EEAD9CF417263B5B7383427984...
- i####.so.com/j?src=####&q=####&pn=####&sn=####
- idv####.qini####.com/SplashActivityV38.json
- idv####.qini####.com/banner_class.json
- idv####.qini####.com/banner_home_v38.json
- idv####.qini####.com/banner_star.json
- idv####.qini####.com/classroom.json
- idv####.qini####.com/homev32.json
- idv####.qini####.com/qiuxing2.json
- kln.g####.sina####.com/ty/k/p/2011-02-21/U5555P6T12D5459357F44DT20110221...
- m.d####.mob.com/v2/cconf?appkey=####&plat=####&apppkg=####&appver=####&n...
- mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.appcache
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.html
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/banner_close_b...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg02.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg03.jpg
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg07.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close02.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close03.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon....
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon_...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/gdt_logo_black...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-ad.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/sdk_bg.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tc-gdt-sdk-ope...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20170821/b...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
- p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
- p.nanr####.net.####.com/uploads/allimg/160614/8433-160614152H7.jpg
- p2.so.q####.com/sdr/_240_/t01ca6b73389b0aef77.jpg
- p3.so.q####.com/sdr/_240_/t01d9b5038bb56159b8.jpg
- s####.tc.qq.com/gdt/0/DAAczHvABIABIAAHBctXgrAs2Gihtt.jpg/0?ck=####
- src.r####.com.####.com/kubo/dex/luomi10.249.dex
- v2.g####.qq.com/gdt_stats.fcg?viewid=####&i=####&os=####&xp=####
- webc####.for####.cc####.com/h/pic/20130701/23/6933623920640985043.jpg
- www.hi####.cn/pic/0/11/44/55/11445576_999814.jpg
- www.hi####.cn/pic/0/11/74/70/11747000_743843.jpg
HTTP POST requests:
- a####.exc.mob.com/errconf
- a####.u####.com/app_logs
- api.s####.mob.com/conf5
- api.s####.mob.com/conn
- api.s####.mob.com/log4
- c.d####.mob.com/v2/cdata
- s####.e.qq.com/activate
- s####.e.qq.com/msg
- sdk.c####.com/versiontapi.php?v=####&type=####
File system changes:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/.lock
- /data/data/####/.mrecord
- /data/data/####/.mrlock
- /data/data/####/.statistics
- /data/data/####/2a2f5fb34aab0021430decc4ba4b678cc813f1cee6c6c1e....0.tmp
- /data/data/####/33e26d769a372a74d22542011736aeab4bf299f1ecc08c0....0.tmp
- /data/data/####/352db024183e816b408a3736c47ca3754471b28c41ce6b8....0.tmp
- /data/data/####/38d8d5f61265a6e36135fcf69bcd264fa066b30c3f79d3f....0.tmp
- /data/data/####/6ab1b31dc1da9c280cd4174baccab1987f28046561b210b....0.tmp
- /data/data/####/6f5487f2fc12aebd0281e6315d8d770b1fe494f32cdd70b....0.tmp
- /data/data/####/78abb563ea8864111e2c6825684fbb59dede6041482e1a6....0.tmp
- /data/data/####/95503fcab728d436cc8625237b9ba22cc4c20aa28153653....0.tmp
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/DownloadTaskStore.db-journal
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/appPackageNames
- /data/data/####/c623d2d4014da925d1d18c2b4aaf10ed5cc51af884a2cf3....0.tmp
- /data/data/####/cn.jpush.android.user.profile.xml
- /data/data/####/cn.jpush.preferences.v2.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/dianrui_cache.xml
- /data/data/####/e768c3207e0563b21e03def041f38e3161effe004c9060a....0.tmp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/gdt_plugin.tmp
- /data/data/####/gdt_plugin.tmp.sig
- /data/data/####/gdt_suid
- /data/data/####/index
- /data/data/####/jg_so_upgrade_setting.xml
- /data/data/####/journal.tmp
- /data/data/####/jpush_device_info.xml
- /data/data/####/jpush_local_notification.db
- /data/data/####/jpush_local_notification.db-journal
- /data/data/####/jpush_stat_cache_history.json
- /data/data/####/jpush_statistics.db
- /data/data/####/jpush_statistics.db-journal
- /data/data/####/libjiagu.so
- /data/data/####/luomi261.dex
- /data/data/####/luomi_cache.xml
- /data/data/####/luomi_dex_ok_ok.dex
- /data/data/####/mob_commons_1.xml
- /data/data/####/mob_sdk_exception_1.xml
- /data/data/####/multidex.version.xml
- /data/data/####/news-journal
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/share_sdk_1.xml
- /data/data/####/sharesdk.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/update_lc
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.al
- /data/media/####/.dh-journal
- /data/media/####/.dhlock
- /data/media/####/.dic_lock
- /data/media/####/.dk
- /data/media/####/.duid
- /data/media/####/.globalLock
- /data/media/####/.nulal
- /data/media/####/.nulplt
- /data/media/####/.pkg_lock
- /data/media/####/.push_deviceid
- /data/media/####/.rcTag
- /data/media/####/.rc_lock
Miscellaneous:
Executes the following shell scripts:
- app_process /system/bin com.android.commands.pm.Pm list packages
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- pm list packages
- sh
Loads the following dynamic libraries:
- jpush220
- libjiagu
- neh
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
Uses the following algorithms to decrypt data:
- AES-ECB-NoPadding
- AES-ECB-PKCS7Padding
- RSA-ECB-PKCS1Padding
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Gets information about running apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
