Technical information
Malicious functions:
Sends SMS messages:
- 4446: SHNMB 7533 SDK0073NG12601P001J001U706I####ED
Sends data on received text messages to remote host.
Network activity:
Connecting to:
- s####.####.com
- e####.####.com:9090
- m####.####.com:9900
- e####.####.com
- m####.####.com
- a####.####.com
HTTP GET requests:
- m####.####.com/video/photo/11.jpg
- m####.####.com/video/photo/94.jpg
- m####.####.com/video/photo/6.jpg
- e####.####.com/wapbill/Allfeecnf.jsp?kehuid=####&chanpid=####&mcc=####&plmn=####&xiangid=####&vid=####&ruanid=####&chuanhao=####
- m####.####.com/video/photo/109.jpg
- m####.####.com/video/photo/98.jpg
- e####.####.com:9090/sdkcp/sale_static_newcp.jsp?kehuid=####&chanpid=####&xiangid=####&chuanhao=####&jiqi=####&ruanid=####&Cptime=####&net=####
- m####.####.com/video/photo/74.jpg
- m####.####.com/video/photo/5.jpg
- m####.####.com/video/v/32.mp4
- e####.####.com/wapbill/Bfeecnf.jsp?kehuid=####&xiangid=####&chanpid=####&ruanid=####&jifid=####&chuanhao=####&jiqi=####&dangwei=####
- m####.####.com/video/photo/106.jpg
- e####.####.com/sdkcp/user_visit_appcp.jsp?kehuid=####&chanpid=####&xiangid=####&chuanhao=####&jiqi=####&ruanid=####&Cptime=####
- m####.####.com/video/photo/100.jpg
- m####.####.com/video/photo/9.jpg
- e####.####.com/sdkcp/sub_payquery.jsp?kehuid=####&xiangid=####&chanpid=####&ruanid=####&chuanhao=####&mosc=####&sendtp=####&subtype=####&jiqi=####&pri...
HTTP POST requests:
- s####.####.com/pkl16.html
- a####.####.com/jiagu/t/infos
- m####.####.com:9900/mon
- a####.####.com/ad-service/ad/mark
- m####.####.com/v_init
- m####.####.com/v_loading
- a####.####.com/jiagu/mark/upgrade
Modified file system:
Creates the following files:
- /data/data/####/files/.jiagu.lock
- /data/data/####/shared_prefs/my_data.xml.bak
- /data/data/####/databases/pg.db-journal
- /data/data/####/shared_prefs/jg_core_control.xml.bak
- /data/data/####/cache/picasso-cache/241e1aec09ab92cb48bc108b112b8e83.0.tmp
- /data/data/####/shared_prefs/toPayActivityTimes.xml
- /data/data/####/shared_prefs/myActivityName.xml
- /data/data/####/cache/picasso-cache/06f7e1a71f4b86c4d3e1c87ed76782b0.0.tmp
- /data/data/####/shared_prefs/jg_app_update_settings_random.xml
- /data/data/####/cache/picasso-cache/14e6399f3e8d6fc669e366fd352c438d.1.tmp
- /data/data/####/files/.jglogs/.jg.ri
- /data/data/####/cache/picasso-cache/4221a9e739b31a400f0f28d235381713.0
- /data/data/####/cache/picasso-cache/4221a9e739b31a400f0f28d235381713.1
- /data/data/####/files/libjiagu.so
- /data/data/####/databases/pg.db
- /data/data/####/cache/picasso-cache/f25b9b2c67898ef1116b79327ffeaf7f.1.tmp
- /data/data/####/cache/picasso-cache/6ed4db93c75c645c5d17a145f094d236.1.tmp
- /data/data/####/cache/picasso-cache/c65f644db91251ea703820f1a9457a90.0.tmp
- /data/data/####/files/.jglogs/.jg.ac
- /data/data/####/cache/picasso-cache/c92f2ce4a1ca05f368e79621189208cf.0.tmp
- /data/data/####/databases/webview.db-journal
- /data/data/####/shared_prefs/jg_core_control.xml
- /data/data/####/files/.jglogs/.log3
- /data/data/####/shared_prefs/toPayActivityTimes.xml.bak
- /data/data/####/shared_prefs/my_data.xml
- /data/data/####/cache/picasso-cache/f25b9b2c67898ef1116b79327ffeaf7f.0.tmp
- /data/data/####/cache/picasso-cache/29e11b47647aefca8fd75807da550d9d.0.tmp
- /data/data/####/cache/picasso-cache/c65f644db91251ea703820f1a9457a90.1.tmp
- /data/data/####/files/.jglogs/.jg.ic
- /data/data/####/cache/picasso-cache/journal.tmp
- /data/data/####/cache/picasso-cache/14e6399f3e8d6fc669e366fd352c438d.0.tmp
- /data/data/####/cache/picasso-cache/241e1aec09ab92cb48bc108b112b8e83.1.tmp
- /data/data/####/cache/picasso-cache/6ed4db93c75c645c5d17a145f094d236.0.tmp
- /data/data/####/cache/picasso-cache/c8ce00c9a4ed85900b2ffab7ad51cb1d.1
- /data/data/####/cache/picasso-cache/c8ce00c9a4ed85900b2ffab7ad51cb1d.0
- /data/data/####/cache/picasso-cache/c92f2ce4a1ca05f368e79621189208cf.1.tmp
- /data/data/####/cache/picasso-cache/06f7e1a71f4b86c4d3e1c87ed76782b0.1.tmp
- /data/data/####/cache/picasso-cache/29e11b47647aefca8fd75807da550d9d.1.tmp
Miscellaneous:
Executes next shell scripts:
- chmod 755 /data/data/####/files/libjiagu.so
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
