Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) up####.sdk.jig####.cn:80
- TCP(HTTP/1.1) m####.me####.com:80
- TCP(HTTP/1.1) sh####.360t####.com:80
- TCP(HTTP/1.1) qos.l####.360.cn:80
- TCP(HTTP/1.1) trac####.v.tf.####.cn:80
- TCP(HTTP/1.1) api.k.36####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) p7.q####.com:80
- TCP(HTTP/1.1) app.v.k.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) s####.s.360.cn:80
- TCP(HTTP/1.1) p1.q####.com:80
- TCP(HTTP/1.1) u.api.l####.####.cn:80
- TCP(HTTP/1.1) ab####.m.s.####.cn:80
- TCP(HTTP/1.1) amdc####.m.ta####.com:80
- TCP(HTTP/1.1) sni.c####.q####.####.net:80
- TCP(HTTP/1.1) sdk.l####.360.cn:80
- TCP(HTTP/1.1) p.s.3####.cn:80
- TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
- TCP(HTTP/1.1) p4.q####.com:80
- TCP(HTTP/1.1) s####.l####.360.####.com:80
- TCP(HTTP/1.1) sh####.me####.com:80
- TCP(HTTP/1.1) k####.36####.com:80
- TCP(HTTP/1.1) m3.s.3####.cn:80
- TCP(SSL/3.0) p1.ssl.q####.com:443
- TCP(TLS/1.0) sdkc####.e.360.cn:443
- TCP(TLS/1.0) p1.ssl.q####.com:443
- TCP(TLS/1.0) m####.me####.com:443
- TCP(TLS/1.0) app.k.36####.com:443
- TCP(TLS/1.0) mdm.ope####.360.cn:443
- TCP(TLS/1.0) 2####.107.1.97:443
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) s####.tf.360.cn:443
- TCP(TLS/1.0) cc.p####.dc.####.cn:443
- TCP(TLS/1.0) api####.me####.com:443
- TCP(TLS/1.0) s####.j####.cn:443
- TCP(TLS/1.0) msg.umengc####.com:443
- TCP c####.g####.ig####.com:5225
- TCP 1####.121.49.89:7008
- TCP sdk.o####.t####.####.com:5224
- TCP ope####.m.ta####.com:443
- TCP umengj####.m.ta####.com:80
- UDP s.j####.cn:19000
- TCP 1####.163.230.186:80
DNS requests:
- 7j####.c####.z0.####.com
- a####.man.aliy####.com
- ab####.m.s.####.cn
- ag####.m.ta####.com
- amdc####.m.ta####.com
- api####.me####.com
- api.k.36####.com
- app.k.36####.com
- app.v.k.####.com
- c####.g####.ig####.com
- c-h####.g####.com
- cc.p####.dc.####.cn
- k####.36####.com
- m####.me####.com
- m3.s.3####.cn
- mdm.ope####.360.cn
- msg.umengc####.com
- p.s.3####.cn
- p0.q####.com
- p1.q####.com
- p1.q####.com
- p1.ssl.q####.com
- p10.qhi####.com
- p15.q####.com
- p2.q####.com
- p3.q####.com
- p4.q####.com
- p5.q####.com
- p6.q####.com
- p7.q####.com
- p8.q####.com
- p9.q####.com
- plb####.u####.com
- qos.l####.360.cn
- s####.j####.cn
- s####.l####.360.cn
- s####.s.360.cn
- s####.tf.360.cn
- s.j####.cn
- sdk.c####.ig####.com
- sdk.l####.360.cn
- sdk.l####.360.cn
- sdk.me####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sdkc####.e.360.cn
- sh####.360t####.com
- sh####.me####.com
- t####.me####.com
- trac####.v.tf.####.cn
- u####.u####.com
- u.api.l####.####.cn
- umen####.m.ta####.com
- umengj####.m.ta####.com
- up####.sdk.jig####.cn
HTTP GET requests:
- ab####.m.s.####.cn/abtest/cloud.so?appkey=####&dt=####&os=####&ov=####&m...
- app.v.k.####.com/vod-xinxiliu-tv-q2-bj/125939487_1-1526866655-015db6e8-0...
- app.v.k.####.com/vod-xinxiliu-tv-q3-bj/122376762_1-1525967177-1b7e05a9-4...
- k####.36####.com//k2/appconfig/getjar?appid=####&m=####&m2=####&ch=####&...
- k####.36####.com/hotrizon2/appConfig?os=####&use_gear=####&time=####&sys...
- k####.36####.com/hotrizon2/authorlist?pageSize=####&appid=####&curQid=##...
- k####.36####.com/hotrizon2/channelnew?m2=####&appid=####&m=####&ch=####&...
- k####.36####.com/hotrizon2/detail?os=####&requestNum=####&sys=####&appid...
- k####.36####.com/hotrizon2/list?svc=####&kw=####&os=####&ckw=####&sys=##...
- k####.36####.com/hotrizon2/list?svc=####&os=####&sys=####&direction=####...
- k####.36####.com/hotrizon2/myfollower?appid=####&maxOffset=####&m=####&m...
- k####.36####.com/hotrizon2/play?id=####&m2=####&strategy=####&appid=####...
- k####.36####.com/hotrizon2/play?os=####&userclick=####&sys=####&appid=##...
- k####.36####.com/hotrizon2/relate?os=####&sys=####&columns=####&appid=##...
- k####.36####.com/hotrizon2/topic/detail?id=####&appid=####&cdn_url=####&...
- k####.36####.com/k2/api/privacy/config?appid=####&m=####&m2=####&ch=####...
- k####.36####.com/k2/appconfig/getAbRole?os=####&time=####&sys=####&m2=##...
- k####.36####.com/k2/appconfig/getNewinfo?appid=####&m=####&m2=####&ch=##...
- k####.36####.com/k2/appconfig/getRedpackPop?appid=####&m=####&m2=####&ch...
- k####.36####.com/k2/appconfig/getplugin?appid=####&m=####&m2=####&ch=###...
- k####.36####.com/k2/appconfig/getpopup?appid=####&m=####&m2=####&ch=####...
- k####.36####.com/k2/hotrizon2/aconfig?appid=####&m=####&m2=####&ch=####&...
- k####.36####.com/k2/hotrizon2/gettime?os=####&sys=####&m2=####&appid=###...
- m####.me####.com/rtb?type=####&d=####&b=####&p=####&l=####&s=####&m=####...
- p1.q####.com/dr/160_160_/t01b7662a12cbb2f6d7.png
- p1.q####.com/dr/_100_70/t0100f8c60b50620e28.jpg
- p1.q####.com/dr/_100_70/t0105d6cf9b508f72c8.jpg
- p1.q####.com/dr/_100_70/t0111b109389b1fbd77.jpg
- p1.q####.com/dr/_100_70/t0111bef4461a06b667.jpg
- p1.q####.com/dr/_100_70/t011a386935e86576cd.jpg
- p1.q####.com/dr/_100_70/t011ef6ec2f92b140a9.jpg
- p1.q####.com/dr/_100_70/t01341324e0e2dabe26.jpg
- p1.q####.com/dr/_100_70/t0134141695cc2cacc5.jpg
- p1.q####.com/dr/_100_70/t0135146172340c91e9.jpg
- p1.q####.com/dr/_100_70/t01640c530685b9a6a6.jpg
- p1.q####.com/dr/_100_70/t016d2a018d2698020f.jpg
- p1.q####.com/dr/_100_70/t017667cd632c5b10ac.jpg
- p1.q####.com/dr/_100_70/t01918bd113f5634dc5.jpg
- p1.q####.com/dr/_100_70/t019f0551e039492a64.jpg
- p1.q####.com/dr/_100_70/t01aeb99d1c37a92589.jpg
- p1.q####.com/dr/_100_70/t01afa6063f23d50ef8.jpg
- p1.q####.com/dr/_100_70/t01ccc35c2f97b2ac0b.jpg
- p1.q####.com/dr/_280_50/t0117cf080d9354c2fe.webp
- p1.q####.com/dr/_280_50/t0131364d86e9955e94.webp
- p1.q####.com/dr/_280_50/t013936e2e33d992cc1.webp
- p1.q####.com/dr/_280_50/t01540dd5e0c8ec10dd.webp
- p1.q####.com/dr/_280_50/t0164358436716c536e.webp
- p1.q####.com/dr/_280_50/t01db4b3dee4b76222e.webp
- p1.q####.com/dr/_280_50/t01ddc51d9741bb8d48.webp
- p1.q####.com/t01153c265593f3258e.jpg
- p1.q####.com/t013db82533aa9e5a9a.jpg
- p1.q####.com/t0163f8ce8a13b06477.png
- p1.q####.com/t0183a3cda5f684871e.png
- p1.q####.com/t018a091efca6865662.jpg
- p1.q####.com/t019394dd4b2d1e1505.jpg
- p1.q####.com/t01c284e24d09f6b14d.jpg
- p1.q####.com/t01e69681fa8d4220ab.jpg
- p1.q####.com/video/568_320_70/t01030f946adc4661c1.webp
- p1.q####.com/video/568_320_70/t011efe6da4a730edef.webp
- p1.q####.com/video/568_320_70/t01353c14196912e2b3.webp
- p1.q####.com/video/568_320_70/t013aba5be64eff50cb.webp
- p1.q####.com/video/568_320_70/t014401cad353ab6d77.webp
- p1.q####.com/video/568_320_70/t0159659f8ff9601078.webp
- p1.q####.com/video/568_320_70/t015a8f011472c4eecc.webp
- p1.q####.com/video/568_320_70/t015c1b282782945ceb.webp
- p1.q####.com/video/568_320_70/t015d95c3fc086e151e.webp
- p1.q####.com/video/568_320_70/t015e0d1db585c63c9e.webp
- p1.q####.com/video/568_320_70/t0164358436716c536e.webp
- p1.q####.com/video/568_320_70/t01736a77f3c4e8fe19.webp
- p1.q####.com/video/568_320_70/t01798ac7c822564ab5.webp
- p1.q####.com/video/568_320_70/t017ed1cc98388069bd.webp
- p1.q####.com/video/568_320_70/t017f7586ce4a4e44b9.webp
- p1.q####.com/video/568_320_70/t0185b3f056d2da8bc0.webp
- p1.q####.com/video/568_320_70/t0188e58f8ed61229ad.webp
- p1.q####.com/video/568_320_70/t019a05c798cbd993cf.webp
- p1.q####.com/video/568_320_70/t019aca0160f9f34b26.webp
- p1.q####.com/video/568_320_70/t019ba585e9f2c427c4.webp
- p1.q####.com/video/568_320_70/t019effca24808ef210.webp
- p1.q####.com/video/568_320_70/t01a221ad668d61d489.webp
- p1.q####.com/video/568_320_70/t01a7ad435d0c069506.webp
- p1.q####.com/video/568_320_70/t01a9f1142611129069.webp
- p1.q####.com/video/568_320_70/t01c607bf9b78278770.webp
- p1.q####.com/video/568_320_70/t01c9a89f26ce3377ab.webp
- p1.q####.com/video/568_320_70/t01d34ede4171b9a9e9.webp
- p1.q####.com/video/568_320_70/t01ddc51d9741bb8d48.webp
- p1.q####.com/video/568_320_70/t01e8821f61d4d7b4d3.webp
- p1.q####.com/video/568_320_70/t01ebe6d2c5b0068cd1.webp
- p1.q####.com/video/568_320_70/t01f0aae8c4c76fbc3d.webp
- p1.q####.com/video/568_320_70/t01f7c1b03ca5db8004.webp
- p1.q####.com/video/568_320_70/t01f9a6759bc4143cc6.webp
- p4.q####.com/dr/_100_70/t014712319fe167166e.jpg
- p4.q####.com/t019e9bdf43f2666ada.jpg
- p4.q####.com/t01c1ff533a19145140.jpg
- p7.q####.com/dr/_100_70/t0106b7815aa0893da2.jpg
- p7.q####.com/dr/_100_70/t0127435528d02bfd06.jpg
- p7.q####.com/dr/_100_70/t013e884bce5a7ce830.jpg
- p7.q####.com/dr/_100_70/t01880e5d9069476645.png
- p7.q####.com/dr/_100_70/t019ce19bdd9a8c13e9.jpg
- p7.q####.com/dr/_100_70/t01a451a86096d12d2c.jpg
- p7.q####.com/dr/_100_70/t01ac1f4ce4e7fa1d21.png
- p7.q####.com/dr/_100_70/t01bf1167c91d526282.jpg
- p7.q####.com/dr/_100_70/t01c33c058ffd824bda.jpg
- p7.q####.com/dr/_100_70/t01c75a637a71c8fdd7.jpg
- p7.q####.com/t014515d492273d10f5.png
- p7.q####.com/t0147eeb331a280d627.jpg
- p7.q####.com/t016b0b36a4a463d4af.jpg
- p7.q####.com/t0178bccfe750f110a1.jpg
- p7.q####.com/t018a76b42c2a942173.jpg
- p7.q####.com/t019f6478307ad0eea6.jpg
- p7.q####.com/t01a9d2894050c3de93.png
- p7.q####.com/t01adc2726ee548525e.jpg
- p7.q####.com/t01ae70f3f6372b712d.jpg
- p7.q####.com/t01aff0ffb7213be2b1.png
- p7.q####.com/t01f9458c7931fe73bc.jpg
- p7.q####.com/t01fef189e19456f75b.png
- p7.q####.com/video/568_320_70/t0101294fb4853c3381.webp
- p7.q####.com/video/568_320_70/t010c612141b3a1d71c.webp
- p7.q####.com/video/568_320_70/t0117cf080d9354c2fe.webp
- p7.q####.com/video/568_320_70/t0120a23d8793714a17.webp
- p7.q####.com/video/568_320_70/t0131364d86e9955e94.webp
- p7.q####.com/video/568_320_70/t01327581a8472bcd3e.webp
- p7.q####.com/video/568_320_70/t013936e2e33d992cc1.webp
- p7.q####.com/video/568_320_70/t01540dd5e0c8ec10dd.webp
- p7.q####.com/video/568_320_70/t016641bf6266d04057.webp
- p7.q####.com/video/568_320_70/t0169a0e63242817fd0.webp
- p7.q####.com/video/568_320_70/t016d0d916aab17aa02.webp
- p7.q####.com/video/568_320_70/t017a6db1b7b4fb9cd0.webp
- p7.q####.com/video/568_320_70/t017b218099bfc1778e.webp
- p7.q####.com/video/568_320_70/t017ba9f7365495f4d7.webp
- p7.q####.com/video/568_320_70/t017dbb0a8bef824e1c.webp
- p7.q####.com/video/568_320_70/t0185d951b8744cae96.webp
- p7.q####.com/video/568_320_70/t01876884aa4594f4ce.webp
- p7.q####.com/video/568_320_70/t019077ef965d35d4c3.webp
- p7.q####.com/video/568_320_70/t0194d4651d5fdd0090.webp
- p7.q####.com/video/568_320_70/t0199f5e69b6cf2a3d4.webp
- p7.q####.com/video/568_320_70/t019e236a9fb3992abd.webp
- p7.q####.com/video/568_320_70/t01a6b435620ebb0647.webp
- p7.q####.com/video/568_320_70/t01addf8cea4c562b60.webp
- p7.q####.com/video/568_320_70/t01ae80048bedc1f047.webp
- p7.q####.com/video/568_320_70/t01b1e2b1c758f7b805.webp
- p7.q####.com/video/568_320_70/t01b9ff87b9547c4329.webp
- p7.q####.com/video/568_320_70/t01c1ce1951e654d7d4.webp
- p7.q####.com/video/568_320_70/t01c76e733fdfeab828.webp
- p7.q####.com/video/568_320_70/t01d3e40c55de7327cf.webp
- p7.q####.com/video/568_320_70/t01d4f496277be8227a.webp
- p7.q####.com/video/568_320_70/t01d5c65d8af73c5c51.webp
- p7.q####.com/video/568_320_70/t01da781e08fa661362.webp
- p7.q####.com/video/568_320_70/t01db4b3dee4b76222e.webp
- p7.q####.com/video/568_320_70/t01ee3dc163493d1b00.webp
- p7.q####.com/video/568_320_70/t01f119252f6b6bc70e.webp
- p7.q####.com/video/568_320_70/t01f3eb618607ff96d5.webp
- p7.q####.com/video/568_320_70/t01f4761b05106a084d.webp
- p7.q####.com/video/568_320_70/t01fc8380fdb685572e.webp
- p7.q####.com/video/568_320_70/t01ffbc0d415ad3d16f.webp
- qos.l####.360.cn/vc.gif?&bid=####&pid=####&ver=####&c_ver=####&os=####&m...
- s####.l####.360.####.com/Object.getFile/livecloudsdk/YW5kcm9pZF9wbHVnaW5...
- s####.l####.360.####.com/Object.getFile/livecloudsdk/cGx1Z2luX3lmX3AycF8...
- s####.s.360.cn/ak/6766aa2750c19aad2fa1b32f36ed4aee.html?m2=####
- s####.s.360.cn/su/index.php?k=####&av=####&slv=####&sv=####&be=####&cv=#...
- sdk.l####.360.cn/codec?os=####&tm=####&model=####&r=####&package=####&pi...
- sdk.l####.360.cn/rtc?os=####&tm=####&model=####&r=####&package=####&pid=...
- sdk.l####.360.cn/sdkconf/videoplace?sign=####&u=####&version=####&sdk_ve...
- sdk.l####.360.cn/xinxiliu_tv_android_10228.conf?os=####&tm=####&r=####&p...
- sh####.360t####.com/171122/c867c6e2f627a813302a3a0d0d891203/FZLTHK.TTF
- sni.c####.q####.####.net/config/hz-hzv3.conf
- sni.c####.q####.####.net/tdata_jVg168
- sni.c####.q####.####.net/tdata_pSF696
- trac####.v.tf.####.cn/s?type=####&r=####&tid=####&finfo=####&enup=####&m...
- u.api.l####.####.cn/comment/hot?client_id=####&url=####&page_key=####&fr...
- u.api.l####.####.cn/comment/lists?client_id=####&url=####&type=####&star...
HTTP POST requests:
- amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
- api.k.36####.com/k2/api/lockscreen/config?os=####&time=####&sys=####&m2=...
- c-h####.g####.com/api.php?format=####&t=####
- k####.36####.com/hotrizon2/report2?os=####&time=####&sys=####&m2=####&ap...
- k####.36####.com/k2/appconfig/getjarlist?appid=####&curEnv=####&m=####&m...
- k####.36####.com/k2/hotrizon2/getSInfo?os=####&sys=####&psw2=d-####&ssid...
- m3.s.3####.cn/api/v1/newid
- p.s.3####.cn/pstat/plog.php
- p.s.3####.cn/update/update.php?p=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sh####.me####.com/adsdk?pver=####&skey=Fo####
- sh####.me####.com/adsdk?pver=####&skey=GV####
- sh####.me####.com/adsdk?pver=####&skey=LM####
- sh####.me####.com/adsdk?pver=####&skey=R9####
- sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
- u.api.l####.####.cn/comment/lists
- up####.sdk.jig####.cn/v1/push/sdk/postlist
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/2033145970-602345128
- /data/data/####/2289E276CADF4B0EFDC814915ACD4CDE.png
- /data/data/####/93f9d21a-10f1-493c-8eed-121f0cc3eae2
- /data/data/####/ACCS_BINDumeng;5a56c9198f4a9d0c2f0001a8.xml
- /data/data/####/ACCS_SDK.xml
- /data/data/####/ACCS_SDK_CHANNEL.xml
- /data/data/####/AGOO_BIND.xml
- /data/data/####/AKTorchDownload.db
- /data/data/####/AKTorchDownload.db-journal
- /data/data/####/Agoo_AppStore.xml
- /data/data/####/Alliance.xml
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/DaemonServer
- /data/data/####/JPushSA_Config.xml
- /data/data/####/MENU_CACHE.xml
- /data/data/####/MessageStore.db-journal
- /data/data/####/MsgLogStore.db-journal
- /data/data/####/PendantConfig.xml
- /data/data/####/QHDeviceFile
- /data/data/####/QHDeviceID.lock
- /data/data/####/QH_DeviceSDK.xml
- /data/data/####/QH_SDK_M2.xml
- /data/data/####/QH_SDK_UserData42998cf32d552343bc8e460416382dca.xml
- /data/data/####/QH_SDK_UserData6766aa2750c19aad2fa1b32f36ed4aee.xml
- /data/data/####/QH_SDK_sessionID42998cf32d552343bc8e460416382dca.xml
- /data/data/####/TAB_CACHE.xml
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/Y29tLmxpZ2h0c2t5LnZpZGVv.tick.lock
- /data/data/####/ab_test_config.xml
- /data/data/####/abtest_base_sp_filename42998cf32d552343bc8e4604...ca.xml
- /data/data/####/accs.db-journal
- /data/data/####/ad_config_file.xml
- /data/data/####/agoo.pid
- /data/data/####/android_player_20180716_200959_000.log_0
- /data/data/####/appPackageNames_v2
- /data/data/####/app_globel_config_file.xml
- /data/data/####/auth_guide_config_sdk.xml
- /data/data/####/banner.db-journal
- /data/data/####/cache.ttf
- /data/data/####/channel_webview.db-journal
- /data/data/####/cloud_config_file.xml
- /data/data/####/cloud_push_config_file.xml
- /data/data/####/cloud_switch_cache
- /data/data/####/cn.jpush.android.user.profile.xml
- /data/data/####/cn.jpush.preferences.v2.rid.xml
- /data/data/####/cn.jpush.preferences.v2.xml
- /data/data/####/com.qihoo.livecloud.settings.GPWebrtcSettings.pref.xml
- /data/data/####/core_update
- /data/data/####/core_update_locker
- /data/data/####/critical_service_config.xml
- /data/data/####/daemon_webview.db-journal
- /data/data/####/dbfocus-journal
- /data/data/####/device_collector
- /data/data/####/device_collector_locker
- /data/data/####/download-journal
- /data/data/####/dso_deps
- /data/data/####/dso_lock
- /data/data/####/dso_manifest
- /data/data/####/dso_state
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f3c90394-f389-4d09-9704-8de1d5964eaa
- /data/data/####/fc964d56-9798-49ab-929d-e67e65bc725a
- /data/data/####/finalcore.jar
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/hotrizon_sharepref.xml
- /data/data/####/http_cookie.xml
- /data/data/####/httpdns_config_cache.xml
- /data/data/####/i==1.2.0&&1.2.28_1531771768355_envelope.log
- /data/data/####/info.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/jpush_device_info.xml
- /data/data/####/jpush_local_notification.db
- /data/data/####/jpush_local_notification.db-journal
- /data/data/####/jpush_local_notification.db-wal
- /data/data/####/jpush_stat_cache.json
- /data/data/####/jpush_stat_cache_history.json
- /data/data/####/jpush_statistics.db
- /data/data/####/jpush_statistics.db-journal
- /data/data/####/jpush_statistics.db-shm (deleted)
- /data/data/####/jpush_statistics.db-wal
- /data/data/####/jpushservice_webview.db-journal
- /data/data/####/libdvrender.so.tmp
- /data/data/####/libjiagu-71411075.so
- /data/data/####/libjplayer.so.tmp
- /data/data/####/liblocalserver.so.tmp
- /data/data/####/libmyssl.so.1.1.tmp
- /data/data/####/libtranscore.so.tmp
- /data/data/####/libviewer.so.tmp
- /data/data/####/libyfnet_360.so.tmp
- /data/data/####/light_sky_avast.xml
- /data/data/####/localserver_2.0.3.18042602.zip
- /data/data/####/locker
- /data/data/####/log_reupload_task
- /data/data/####/log_reupload_task_locker
- /data/data/####/message.db-journal
- /data/data/####/message_accs_db
- /data/data/####/message_accs_db-journal
- /data/data/####/msg_queue
- /data/data/####/msplugin_ksp.xml
- /data/data/####/multidex.version.xml
- /data/data/####/p.l
- /data/data/####/player_20180716_201003_000.log_0
- /data/data/####/player_record_2.0.3.18051401.zip
- /data/data/####/privacy_config_file.xml
- /data/data/####/profile_task
- /data/data/####/profile_task_locker
- /data/data/####/profile_torch_platform
- /data/data/####/push.db-journal
- /data/data/####/push.pid
- /data/data/####/push_share.xml
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qhvc_plugin.xml
- /data/data/####/qhvc_plugin.xml.bak
- /data/data/####/qpush_msg.xml
- /data/data/####/run.pid
- /data/data/####/safe_user_info_file.xml
- /data/data/####/screen_conf.xml
- /data/data/####/session_base_sp_filename42998cf32d552343bc8e460...ca.xml
- /data/data/####/session_base_sp_filenameandroidID.xml
- /data/data/####/share_data.xml
- /data/data/####/shortcut_badger_sharepref.xml
- /data/data/####/sp.livecloud.database.xml
- /data/data/####/sp_file_recommend_upload.xml
- /data/data/####/tab_request_name.xml
- /data/data/####/tdata_jVg168
- /data/data/####/tdata_jVg168.jar
- /data/data/####/tdata_pSF696
- /data/data/####/tdata_pSF696.jar
- /data/data/####/tools_2.0.3.18051401.zip
- /data/data/####/torch_sdk_config.xml
- /data/data/####/trans_20180716_201003_000.log_0
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/uninstall_apk
- /data/data/####/uninstall_apk_locker
- /data/data/####/universalPopup.xml
- /data/data/####/videolist.db-journal
- /data/data/####/waitingDown
- /data/data/####/waitingDown_locker
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/yf_p2p_201804191558.zip
- /data/media/####/-5CN-WzRvqJL26_NnRRswGnTETo.649228499.tmp
- /data/media/####/-8aJnDdszCOb0QeVmxpWcyMHP7Q.1634477449.tmp
- /data/media/####/-A2ZIo1to1cYSx2cuvQCf48IBVs.277849015.tmp
- /data/media/####/-Nhl5_AhhfaViBNEbN8uU6ULo3Q.342801662.tmp
- /data/media/####/-qozHbkH7mTB5J1DgreYSf6fvuc.1232321253.tmp
- /data/media/####/-z9BvOWy3D5GnkZfHfZCct9vOAc.762722504.tmp
- /data/media/####/.a.dat
- /data/media/####/.adfwe.dat
- /data/media/####/.cca.dat
- /data/media/####/.deviceId
- /data/media/####/.iddata
- /data/media/####/.nomedia
- /data/media/####/.push_deviceid
- /data/media/####/.sfp
- /data/media/####/.testf
- /data/media/####/.umm.dat
- /data/media/####/0-ZrrCB6UU_dh50rFlZzs-L0Y_I.-758047677.tmp
- /data/media/####/08xkmZSPQxCU01goVExWdJn7x1s.1072716863.tmp
- /data/media/####/1ZgvC52z-fH48gdWm6x8EDvX5tA.-1766979393.tmp
- /data/media/####/1v-3aKWlhvYKblSCzIvPXk87G5s.-1335736097.tmp
- /data/media/####/2IswnZ1EArSiAk07nJIkPitGoWc.-1061839155.tmp
- /data/media/####/2LfCRSOKsC8dL9s8noTnStZWp1U.333001400.tmp
- /data/media/####/2kU_wgXvBL3SbtePBSYRVJY3UaQ.509820583.tmp
- /data/media/####/2qigdaefon8otFZ8Xt3qzp-X8E8.-1378184698.tmp
- /data/media/####/3_GNjYezWHNSQAFhiAw1oAoKgK4.98418078.tmp
- /data/media/####/3dVQuwvlVZPCNKM95pqBZW2gwRE.325424646.tmp
- /data/media/####/3ip03DkmsgR2TNNqfbzNPHVTcdI.1199623859.tmp
- /data/media/####/42998cf32d552343bc8e460416382dca
- /data/media/####/4956511faa5b4d73a8fe2c4891d0649c
- /data/media/####/4EUzvXdNia6pbKGVDdU7U1SY6oY.-107648406.tmp
- /data/media/####/5Ko0CF9T8Zor2UIs2NjRkxckssg.-424929151.tmp
- /data/media/####/5UR91GU6P5kJZI0r34fctFGM9hw.-896663304.tmp
- /data/media/####/5yRsWnK9BAxronkFtDJvyuAx5cw.2106802682.tmp
- /data/media/####/6766aa2750c19aad2fa1b32f36ed4aee
- /data/media/####/6VzzC07JSEQODUKPvcU_1em1xjk.-844059976.tmp
- /data/media/####/6ZmMqbzBIiUZ5pE71xbj8cQKWkw.1089907231.tmp
- /data/media/####/6pjsCxdL-ZsQrPJ17McSV33GwzU.822066262.tmp
- /data/media/####/7-dtgSzM_yiKCyzxjB_aFjFMs-U.417757386.tmp
- /data/media/####/81MMx8fGAvqfngu_BlmQBceD9uk.1330386132.tmp
- /data/media/####/852d4861abd04098997505cde55b46e4
- /data/media/####/85Yy2hgpypQsb9xPqnV3P0wF_nc.402209786.tmp
- /data/media/####/8Oa0zDF7oLYT6TLINLKKQbx18Xo.1023628349.tmp
- /data/media/####/9LFcQhZJT8uNLhVpkITn9YC6TeE.1574974876.tmp
- /data/media/####/Alvin2.xml
- /data/media/####/BTpQzYYEh9L_GU1krcpPQWhUKuY.817005863.tmp
- /data/media/####/BisFqSW8ssULDS-xzmH_giy_pEc.-540686352.tmp
- /data/media/####/CIgcEyBIQ8l3_elh01RL_qDSGWQ.-402075655.tmp
- /data/media/####/CdLy40kKCwzd3JjV3WwBpqzR10g.1769200609.tmp
- /data/media/####/ContextData.xml
- /data/media/####/E1Vb4U8YZb9PtAlQyH38UfwE-Go.375467913.tmp
- /data/media/####/ECYPAOirD13_fBWM2wVA63Q_dlY.-506875631.tmp
- /data/media/####/EQ7IIA54v4wDgMg_5QYEp96zDKE.-1937866400.tmp
- /data/media/####/E_GEbbk2s9CN0Iu4kftiCWIuGO0.-570269298.tmp
- /data/media/####/Ej2WFOqiMnnt5qjZv72o8PRftms.1135476055.tmp
- /data/media/####/Fl0so6DhH2tGJzR3p9Gz-jM-ZEo.819354389.tmp
- /data/media/####/Ftbf_s3eQqTKjRx9pQmmoPGgylY.1378878796.tmp
- /data/media/####/G1haZWkx24HDBNWI0F9nLW8ihzU.-126935871.tmp
- /data/media/####/G2PFRWD73Ljpi21BJJD7BhitBfU.-821816998.tmp
- /data/media/####/GRnVFa6D3-SSDuGlynnDbbeDko8.1152334459.tmp
- /data/media/####/GXsf_2WR2Vb4qo3dSLH_4vLgOvk.479405510.tmp
- /data/media/####/GeJGGOcOryfEv2XGeIrhraFz1uE.2062805632.tmp
- /data/media/####/Gi237f0nHbG7g4WiRB3nDuAgYcE.-1121497727.tmp
- /data/media/####/Id7iboJjUZ4aV51js6deRRCoYLk.-1804682519.tmp
- /data/media/####/J10pucb0kRRkUgnhpOMK2ONuhgM.-1088084826.tmp
- /data/media/####/JRhr88EYHkmhJdzBbb0z8fsy7Ts.-686620898.tmp
- /data/media/####/JXpEox5VzLdmCAgWHmfsVhvT5E4.211229020.tmp
- /data/media/####/Jc9txNghdDfPAfx-dbLshopkkRY.-1611792890.tmp
- /data/media/####/JrLzhvUyb1VVhWKEpfNF-4N0aNA.514983607.tmp
- /data/media/####/KHMhfq2KFwWJ85kbJVm2fCPHPZE.-161850625.tmp
- /data/media/####/KRhT9YQLxDMv-Tf2FKbEESD2OOY.-996204601.tmp
- /data/media/####/L5OssIKnc-jrDOJS7A17KV3OeWc.-351298641.tmp
- /data/media/####/M-OBaAs_IvIdygnai7QqLPWeZVY.790705320.tmp
- /data/media/####/MdzkIMMnw-Pqb_s9BIRWUNs4v1g.-1375202296.tmp
- /data/media/####/MmzbPDjXP-dNW0ZXVCQkGTLeKlY.561457980.tmp
- /data/media/####/Myz
- /data/media/####/Myz (deleted)
- /data/media/####/OBsFdNaPqU7Efx_jWRsSbOorSBk.149442375.tmp
- /data/media/####/OWd
- /data/media/####/OWd (deleted)
- /data/media/####/ObSeS7_8bVQlBDWrxQRDYwnLrM0.-1168107808.tmp
- /data/media/####/Oz42lF-hS714zNOeUEuTvu5xT6g.-1992003881.tmp
- /data/media/####/Q87anp1KfNPNrBFuzmTElJDDxRg.2081140748.tmp
- /data/media/####/QhKNCU1kZrQyJ2rvzy52Olzk9MA.927626504.tmp
- /data/media/####/Qt6RAt3fQzVpYav-E6MTKs3Jwo8.781709470.tmp
- /data/media/####/RS0NVhpUI-otDFqzMJJc0dlFCFk.1419833692.tmp
- /data/media/####/Rjo-RcXDilrztuOPsUn9u7biRl0.-294592207.tmp
- /data/media/####/Rz2kxzHC0O-oVz_J4d2u8ddenD8.-1802984376.tmp
- /data/media/####/SZbmc9C47mjolKZcxJQxOfQQpNA.-1318568550.tmp
- /data/media/####/Sj4b6Idkip7_E86T25xedyDzABc.-579184917.tmp
- /data/media/####/T3YMUPFxwAx6Yrjfdu-tPCsgKyw.-1911435815.tmp
- /data/media/####/TxzzzoGvt37gLdabTKuGfJEtU-c.599555618.tmp
- /data/media/####/Tzd6eXZkz-4uV5jrfFMaeusZTC8.-1029129137.tmp
- /data/media/####/UNI
- /data/media/####/UNI (deleted)
- /data/media/####/VVE6oN4OggNpl7Klr6BcacCg87k.779056090.tmp
- /data/media/####/W1s2y4DvoyLbSH5Y_ml_RWXx5Sc.-1688305760.tmp
- /data/media/####/WLKu_qjSWjQkh3L4DlAsi_3g58o.-807816849.tmp
- /data/media/####/WYyIhksfybSdr2grMzvle2mm4Y8.918861195.tmp
- /data/media/####/Xa_oO2jPxWspdy69ZPU_TecPrBQ.316311992.tmp
- /data/media/####/Y29tLmxpZ2h0c2t5LnZpZGVv
- /data/media/####/Y29tLmxpZ2h0c2t5LnZpZGVv (deleted)
- /data/media/####/YbGYwvRGqR5FAcYGmcvmegl0LTg.1676959318.tmp
- /data/media/####/Z1yu-iSyueD-AN06f-IrmydQkaw.-786130393.tmp
- /data/media/####/ZDEJK7udFnoLRkm8hY-gFuRLako.1881013531.tmp
- /data/media/####/__VERSION__
- /data/media/####/_h1qx_9bVU7IbxglKTvNLm9LubY.1107647845.tmp
- /data/media/####/afCUgf3ykKe9n_0PPTr1V5ALEFE.-1802453624.tmp
- /data/media/####/app.db
- /data/media/####/avast_done
- /data/media/####/b05ce39c1fe9e72dc1df70989e7e6d14
- /data/media/####/bWx7_PVMij7AcdNAXWtEIX8_Gkc.-750663804.tmp
- /data/media/####/cNyUIhmd76eeXK0_kp6BPlffSVQ.1990319126.tmp
- /data/media/####/cSmJ9D9SQrqVe658RlkejQBvAjc.1665077700.tmp
- /data/media/####/cab660cb03c646eeaa4fc12f83377738
- /data/media/####/ch-we-pOEZTvabSarUfAizAPG24.285314508.tmp
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.lightsky.video.bin
- /data/media/####/com.lightsky.video.db
- /data/media/####/crnJfdNxIdvj0yPcr7tdyD4HilI.1874401300.tmp
- /data/media/####/d1I0rimxMRWG_AJaN1fKaY47p4E.-1340428411.tmp
- /data/media/####/d3d71ca1a234461f864e3f254c225d6c
- /data/media/####/dAmYCst1wyvXZ0Vd7Cbvz1Ncnu0.1541228902.tmp
- /data/media/####/d_S6WCpuNp3a63PsI-FDFRuvwyc.-1104017833.tmp
- /data/media/####/data.lock
- /data/media/####/deviceToken
- /data/media/####/ekr6TsWCKekxB_K_xY2V4u3kLrI.1883000273.tmp
- /data/media/####/hRfoR0jJ0OYeIpeJ5JQ032lGzrs.1995251487.tmp
- /data/media/####/hm5VRTfunbb6_3uvaIO5ZlWXJ5w.1718211340.tmp
- /data/media/####/j8V6LpZbrX_Wn_ov2GaOxqJhpmU.-314864607.tmp
- /data/media/####/jcHKo62mtnfbrq0x1G__2TXeUU8.2027925443.tmp
- /data/media/####/jcSAOr9jGZwkhQZMXMgqUBAFH0c.1900638007.tmp
- /data/media/####/k2Y2LuvV2_rzWRb0zBE1f6lp0Iw.-1728606940.tmp
- /data/media/####/l84Kq74HXmrxFYFkAP4maxR7_c4.-1916606307.tmp
- /data/media/####/mk4oFl1QPAVxo5l_Z99UnwK5E2U.1816095548.tmp
- /data/media/####/mx73zzQsJapIn3ZhbizhaW0rw7Y.2086205622.tmp
- /data/media/####/nhouN1fdKBlJKeLrekD8UR5X9Pk.-1423567455.tmp
- /data/media/####/oZkk9bSIxmmMAYAgi4g78xiUM68.-1541493456.tmp
- /data/media/####/osFlFXrqJeTiT1wDWjikNNG_dh8.1569282608.tmp
- /data/media/####/ovQ8m6jLihjhH8MpKZ_5mJ3lZS0.442126315.tmp
- /data/media/####/p9Jf4UL7NAXfCiqsmJ3qcuxkNDQ.-540793701.tmp
- /data/media/####/pG62HJRTWZRCetr3mYWxbGbKsiY.815925143.tmp
- /data/media/####/pPRUX7N3hoAUkpr_TG5vK5EOlx4.-2112106406.tmp
- /data/media/####/pYlw4NqBmxIFWDfReU3aybKJ7b4.-2096175365.tmp
- /data/media/####/paZjwg61syU16-IgBk_pqxnCNqo.-674305653.tmp
- /data/media/####/pep3HmdTPGIW5VhAnp_K2kGg1hI.-177431312.tmp
- /data/media/####/qEz8SXwyaoK3dIBhhVI-BRqeL1k.-1778407305.tmp
- /data/media/####/qLEWOszDfdfG3lcCGWKMJwd1360.516795348.tmp
- /data/media/####/report.lock
- /data/media/####/rfGRdL3PfqmIACedOWVP3M1PW6M.1783585912.tmp
- /data/media/####/s-ZrUE4Ltnv2GmFWeJ0716LQUo0.-70970969.tmp
- /data/media/####/sKAxpN8O2Ds1_4q9BZpgeraHMkE.1995639449.tmp
- /data/media/####/sWaYtrIY7VYr0L-OrujWHbDeEL0.-915727671.tmp
- /data/media/####/smw04JmxqgTH_Swc64eIRIbcrik.1475016999.tmp
- /data/media/####/suWzxTMJb4CiSerLgPjptgEVIKA.1814123035.tmp
- /data/media/####/tbUqcAgZxM0z0NSGp5TyuSwi--s.-504554149.tmp
- /data/media/####/tdata_jVg168
- /data/media/####/tdata_pSF696
- /data/media/####/test.log
- /data/media/####/uTK9xc46lbGRGKFVKfaNGnFUIMk.-1804181268.tmp
- /data/media/####/uninstall_apk_list
- /data/media/####/v9HWpfUhKhDjbBrURPFIFqHCwf4.-551879379.tmp
- /data/media/####/wMa0GlSlBQ-U7yTuQ3HY1ctCg1U.124720658.tmp
- /data/media/####/wYdTDiXXHCwjCmW2lwKKexs1MYo.-401928493.tmp
- /data/media/####/x-7BN5NIM3LsSIITxxMe64ko5f4.1573918129.tmp
- /data/media/####/x6hpyNy9JyPUW8zZ-8r8O6KfAhE.-1867642465.tmp
- /data/media/####/xUm-uHLZseen7-xzU1dB1QKFots.-752696131.tmp
- /data/media/####/xqj
- /data/media/####/xqj (deleted)
- /data/media/####/yTn
- /data/media/####/yTn (deleted)
- /data/media/####/yiDEbnuRI0nmWDX1xnqwPzJ32k0.-92821539.tmp
- /data/media/####/zbPhwlo-bGZhBz2Yv4GYRrPfwnE.-1748405218.tmp
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/xbin/which su
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5a56c9198f4a9d0c2f0001a8","utdid":"W0z7drnDBYMDAGdzx1Hl6VKk","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.qihoo.qpush.sdk.GeTuiPushService 24825 300 0
- cat /proc/version
- chmod 500 <Package Folder>/files/DaemonServer
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu-71411075.so
- ls /
- ls /sys/class/thermal
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.qihoo.qpush.sdk.GeTuiPushService 24825 300 0
Loads the following dynamic libraries:
- GPBreakpad
- getuiext2
- jcore120
- libdvrender
- libimagepipeline
- libjiagu-71411075
- libjplayer
- liblocalserver
- libtranscore
- libviewer
- libyfnet_360
- tnet-3.1
Uses the following algorithms to encrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
- DES
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-None-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-NoPadding
- DES
Uses elevated priveleges.
Uses special library to hide executable bytecode.
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Gains access to information about running applications.
Gains access to information about accounts (Google, Facebook, etc.) registered on the device.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.