Technical information
Malicious functions:
Removes its shortcut from the home screen.
Network activity:
Connecting to:
- s####.####.com
- reso####.####.net
- 7j####.####.com
- c-h####.####.com
- pub-####.####.com
- m####.####.com
- a####.####.com
HTTP GET requests:
- s####.####.com/config/hz-hzv3.conf
- a####.####.com/rest/api3.do?ttid=####&t=####&imei=####&appKey=####&v=###...
- a####.####.com/rest/api3.do?ttid=####&t=####&deviceId=####&imei=####&app...
- a####.####.com/spdyip/?appkey=####&ttid=####&deviceId=####&imei=####&nt=...
- 7j####.####.com/tdata_QNF844
- 7j####.####.com/tdata_BVg411
- reso####.####.net/gslb/?ver=####&type=####&conpt=####&uuid=####&list=###...
- 7j####.####.com/tdata_yju115
- a####.####.com/rest/api3.do?t=####&deviceId=####&imei=####&appKey=####&v...
- pub-####.####.com/tdata_EDT356
HTTP POST requests:
- s####.####.com/api.php?format=####&t=####
- c-h####.####.com/api.php?format=####&t=####
- m####.####.com/v2/register
Modified file system:
Creates the following files:
- <Package Folder>/shared_prefs/Setting.xml
- <Package Folder>/database/pushinfo.db
- <Package Folder>/files/init.pid
- <Package Folder>/shared_prefs/AGOO_HOST.xml
- <Package Folder>/files/run.pid
- <Package Folder>/shared_prefs/com.baidu.pushservice.BIND_CACHE.xml
- <Package Folder>/shared_prefs/mipush.xml.bak
- <Package Folder>/databases/jpush_local_notification.db-journal
- <Package Folder>/shared_prefs/clear_db.xml
- <Package Folder>/files/tdata_QNF844
- <Package Folder>/shared_prefs/umeng_general_config.xml
- <Package Folder>/databases/pushsdk.db-journal
- <Package Folder>/files/jpush_stat_cache_history.json
- <Package Folder>/shared_prefs/AppStore.xml.bak
- <Package Folder>/shared_prefs/XMPushServiceConfig.xml
- <Package Folder>/shared_prefs/pst.xml
- <Package Folder>/shared_prefs/jpush_device_info.xml
- <Package Folder>/files/<Package>;pushservice
- <Package Folder>/shared_prefs/PhoneUtil.xml
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml.bak
- <Package Folder>/databases/jpush_statistics.db-journal
- <Package Folder>/files/agoo.pid
- <Package Folder>/shared_prefs/cn.jpush.preferences.v2.xml
- <Package Folder>/files/bdpush_modeconfig.json
- <Package Folder>/shared_prefs/pushclient.xml
- <Package Folder>/shared_prefs/mipush_extra.xml
- <Package Folder>/files/DaemonServer
- <Package Folder>/shared_prefs/pst.xml.bak
- <Package Folder>/shared_prefs/AGOO_CONNECT.xml
- <Package Folder>/shared_prefs/mipush_account.xml
- <Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml.bak
- <Package Folder>/shared_prefs/umeng_general_config.xml.bak
- <Package Folder>/.jiagu/libjiagu.so
- <Package Folder>/files/tdata_yju115
- <Package Folder>/files/.jglogs/.jg.ic
- <Package Folder>/files/tdata_QNF844.jar
- <Package Folder>/shared_prefs/cn.jpush.android.user.profile.xml
- <Package Folder>/shared_prefs/bindSoftId.xml
- <Package Folder>/databases/cc/cc.db-journal
- <Package Folder>/files/ee6acd4f53e6
- <Package Folder>/databases/plugin-journal
- <Package Folder>/shared_prefs/umeng_message_state.xml
- <Package Folder>/shared_prefs/mipush_extra.xml.bak
- <Package Folder>/database/pushinfo.db-journal
- <Package Folder>/shared_prefs/ContextData.xml
- <Package Folder>/shared_prefs/<Package>.self_push_sync.xml
- <Package Folder>/shared_prefs/AppStore.xml
- <Package Folder>/databases/pushstat_5.2.0.db
- <Package Folder>/shared_prefs/pref_registered_pkg_names.xml
- <Package Folder>/files/libcuid.so
- <Package Folder>/shared_prefs/<Package>.push_sync.xml
- <Package Folder>/databases/UmengLocalNotificationStore.db-journal
- <Package Folder>/files/tdata_yju115.jar
- <Package Folder>/files/push.pid
- <Package Folder>/shared_prefs/Alvin2.xml
- <Package Folder>/shared_prefs/mipush.xml
- <Package Folder>/files/appPackageNames
- <Package Folder>/databases/pushgdm.db-journal
- <Package Folder>/shared_prefs/gx_sp.xml
- <Package Folder>/databases/jpush_statistics.db
- <Package Folder>/databases/cc/cc.db
- <Package Folder>/databases/pushg.db-journal
- <Package Folder>/files/init_c1.pid
- <Package Folder>/databases/jpush_local_notification.db
- <Package Folder>/files/mobclick_agent_cached_<Package>416
- <Package Folder>/databases/MsgLogStore.db-journal
- <Package Folder>/databases/pushstat_5.2.0.db-journal
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 755 /data/data/####/.jiagu/libjiagu.so
- sh
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.umeng.message.UmengService --es cockroach cockroach-PPreotect --es pack <Package> --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder
- cat /sys/class/net/wlan0/address
- app_process / <Package>.activity.ai --nice-name=<Package>.process
- <dexopt>
- id
- chmod 500 <Package Folder>/files/DaemonServer
Uses special library to hide executable bytecode.
Contains functionality to send SMS messages automatically.
