Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) s####.s.360.cn:80
- TCP(HTTP/1.1) t####.me####.com:80
- TCP(HTTP/1.1) sh####.360t####.com:80
- TCP(HTTP/1.1) up####.sdk.jig####.cn:80
- TCP(HTTP/1.1) qos.l####.360.cn:80
- TCP(HTTP/1.1) p3.q####.com:80
- TCP(HTTP/1.1) trac####.v.tf.####.cn:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) app.v.k.####.com:80
- TCP(HTTP/1.1) 1####.131.87.5:80
- TCP(HTTP/1.1) sf3-ttc####.ps####.com:80
- TCP(HTTP/1.1) p1.q####.com:80
- TCP(HTTP/1.1) u.api.l####.####.cn:80
- TCP(HTTP/1.1) ab####.m.s.####.cn:80
- TCP(HTTP/1.1) amdc####.m.ta####.com:80
- TCP(HTTP/1.1) p8.q####.com:80
- TCP(HTTP/1.1) sdk.l####.360.cn:80
- TCP(HTTP/1.1) p.s.3####.cn:80
- TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
- TCP(HTTP/1.1) p4.q####.com:80
- TCP(HTTP/1.1) s####.l####.360.####.com:80
- TCP(HTTP/1.1) k####.36####.com:80
- TCP(HTTP/1.1) dsp.tou####.com:80
- TCP(HTTP/1.1) m3.s.3####.cn:80
- TCP(TLS/1.0) msg.umengc####.com:443
- TCP(TLS/1.0) s####.l####.360.####.com:443
- TCP(TLS/1.0) t####.me####.com:443
- TCP(TLS/1.0) app.k.36####.com:443
- TCP(TLS/1.0) 2####.107.1.97:443
- TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
- TCP(TLS/1.0) s####.tf.360.cn:443
- TCP(TLS/1.0) mdm.ope####.360.cn:443
- TCP(TLS/1.0) sdkc####.e.360.cn:443
- TCP(TLS/1.0) cc.p####.dc.####.cn:443
- TCP(TLS/1.0) api####.me####.com:443
- TCP(TLS/1.0) s####.j####.cn:443
- TCP sdk.o####.t####.####.com:5224
- TCP ope####.m.ta####.com:443
- TCP umengj####.m.ta####.com:80
- TCP 1####.163.230.183:443
- UDP s.j####.cn:19000
- TCP 1####.121.49.96:7011
DNS requests:
- a####.man.aliy####.com
- ab####.m.s.####.cn
- ag####.m.ta####.com
- amdc####.m.ta####.com
- api####.me####.com
- api.k.36####.com
- app.k.36####.com
- app.v.k.####.com
- cc.p####.dc.####.cn
- dsp.tou####.com
- k####.36####.com
- k####.36####.com
- m####.me####.com
- m3.s.3####.cn
- mdm.ope####.360.cn
- msg.umengc####.com
- p.s.3####.cn
- p0.q####.com
- p1.q####.com
- p10.qhi####.com
- p2.q####.com
- p3.q####.com
- p4.q####.com
- p5.q####.com
- p6.q####.com
- p7.q####.com
- p8.q####.com
- p9.q####.com
- plb####.u####.com
- qos.l####.360.cn
- s####.j####.cn
- s####.l####.360.cn
- s####.s.360.cn
- s####.tf.360.cn
- s.j####.cn
- sdk####.l####.360.cn
- sdk.c####.ig####.com
- sdk.l####.360.cn
- sdk.l####.360.cn
- sdk.me####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sdkc####.e.360.cn
- sf3-ttc####.ps####.com
- sh####.360t####.com
- sh####.me####.com
- t####.me####.com
- trac####.v.tf.####.cn
- u####.u####.com
- u.api.l####.####.cn
- umen####.m.ta####.com
- umengj####.m.ta####.com
- up####.sdk.jig####.cn
HTTP GET requests:
- ab####.m.s.####.cn/abtest/cloud.so?appkey=####&dt=####&os=####&ov=####&m...
- app.v.k.####.com/vod-xinxiliu-tv-q1-bj/85469644_1-1515996886-f325e76c-59...
- app.v.k.####.com/vod-xinxiliu-tv-q3-bj/142992323_1-1532232316-6037230f-0...
- dsp.tou####.com/api/max/ads/show?extra=####&price=####
- k####.36####.com//k2/appconfig/getjar?appid=####&m=####&m2=####&ch=####&...
- k####.36####.com/hotrizon2/appConfig?os=####&use_gear=####&time=####&sys...
- k####.36####.com/hotrizon2/channelnew?m2=####&appid=####&m=####&ch=####&...
- k####.36####.com/hotrizon2/list?svc=####&kw=####&os=####&ckw=####&sys=##...
- k####.36####.com/hotrizon2/list?svc=####&os=####&direction=####&sys=####...
- k####.36####.com/hotrizon2/list?svc=####&os=####&sys=####&direction=####...
- k####.36####.com/hotrizon2/myfollower?appid=####&maxOffset=####&m=####&m...
- k####.36####.com/hotrizon2/play?id=####&m2=####&strategy=####&appid=####...
- k####.36####.com/hotrizon2/timeline?os=####&direction=####&sys=####&m2=#...
- k####.36####.com/k2/api/privacy/config?os=####&time=####&sys=####&m2=###...
- k####.36####.com/k2/appconfig/getAbRole?os=####&time=####&sys=####&m2=##...
- k####.36####.com/k2/appconfig/getNewinfo?appid=####&m=####&m2=####&ch=##...
- k####.36####.com/k2/appconfig/getRedpackPop?appid=####&m=####&m2=####&ch...
- k####.36####.com/k2/appconfig/getplugin?appid=####&m=####&m2=####&ch=###...
- k####.36####.com/k2/appconfig/getpopup?appid=####&m=####&m2=####&ch=####...
- k####.36####.com/k2/hotrizon2/aconfig?appid=####&m=####&m2=####&ch=####&...
- k####.36####.com/k2/hotrizon2/gettime?os=####&sys=####&m2=####&appid=###...
- p1.q####.com/dr/_100_70/t010337601bce505d30.jpg
- p1.q####.com/dr/_100_70/t0106f423ce3e57e63f.jpg
- p1.q####.com/dr/_100_70/t010994c2942c709452.jpg
- p1.q####.com/dr/_100_70/t010db6316df570a249.jpg
- p1.q####.com/dr/_100_70/t010f885063167636ca.jpg
- p1.q####.com/dr/_100_70/t011f5c9bfb5c2799b0.jpg
- p1.q####.com/dr/_100_70/t012c5af66898efa47a.png
- p1.q####.com/dr/_100_70/t013927b98baecd4ab8.jpg
- p1.q####.com/dr/_100_70/t01465689b82edb4cbb.png
- p1.q####.com/dr/_100_70/t0185f12464d5798e87.jpg
- p1.q####.com/dr/_100_70/t018fd363a2879acbbc.jpg
- p1.q####.com/dr/_100_70/t01a35bd457eed27390.jpg
- p1.q####.com/dr/_100_70/t01b121fd2c9c01cea6.jpg
- p1.q####.com/dr/_100_70/t01ccc35c2f97b2ac0b.jpg
- p1.q####.com/dr/_100_70/t01f24b00cc014d6769.jpg
- p1.q####.com/dr/_100_70/t01f60baae0c3fd8cc3.jpg
- p1.q####.com/dr/_280_50/t015e006dbc5d0005c9.webp
- p1.q####.com/dr/_280_50/t01c30bd1777952476d.webp
- p1.q####.com/t01107682d7a90472b5.jpg
- p1.q####.com/t01153c265593f3258e.jpg
- p1.q####.com/t018a091efca6865662.jpg
- p1.q####.com/t01b1843258cc20984d.jpg
- p1.q####.com/video/568_320_70/t01013b44935205fef3.webp
- p1.q####.com/video/568_320_70/t0111bf09e49053a9bf.webp
- p1.q####.com/video/568_320_70/t0111db08bb1f743355.webp
- p1.q####.com/video/568_320_70/t0113d6f44fbd6d8a18.webp
- p1.q####.com/video/568_320_70/t012172cc1909fd9e70.webp
- p1.q####.com/video/568_320_70/t012b27b2439479c6ac.webp
- p1.q####.com/video/568_320_70/t0139be5f44a4711f0d.webp
- p1.q####.com/video/568_320_70/t013d08226ffd3a4e70.webp
- p1.q####.com/video/568_320_70/t013d87bbc4e32de84d.webp
- p1.q####.com/video/568_320_70/t01474437db08e57127.webp
- p1.q####.com/video/568_320_70/t0148a4e1f317770bb6.webp
- p1.q####.com/video/568_320_70/t0150f5ded61f89a65a.webp
- p1.q####.com/video/568_320_70/t015380ca06a2f53e7f.webp
- p1.q####.com/video/568_320_70/t01571170b31ed7f583.webp
- p1.q####.com/video/568_320_70/t015e006dbc5d0005c9.webp
- p1.q####.com/video/568_320_70/t0165788cc52e953866.webp
- p1.q####.com/video/568_320_70/t01697818b39cd6be8e.webp
- p1.q####.com/video/568_320_70/t016d9441ab76574a50.webp
- p1.q####.com/video/568_320_70/t01785ab090f6ffaa0f.webp
- p1.q####.com/video/568_320_70/t017d8ef788d23ffe20.webp
- p1.q####.com/video/568_320_70/t0181a0346f80ccfc32.webp
- p1.q####.com/video/568_320_70/t0192c1a077c0a7fe8f.webp
- p1.q####.com/video/568_320_70/t01a2fc265728ce5ae7.webp
- p1.q####.com/video/568_320_70/t01adb44b715b5875af.webp
- p1.q####.com/video/568_320_70/t01b01bee9a249770a0.webp
- p1.q####.com/video/568_320_70/t01b5eb9afb8c1b4e6b.webp
- p1.q####.com/video/568_320_70/t01b7eccb39d897c3ff.webp
- p1.q####.com/video/568_320_70/t01b7ef02d2b90030d2.webp
- p1.q####.com/video/568_320_70/t01b8daae9c89ff544f.webp
- p1.q####.com/video/568_320_70/t01c04a190f8afcd288.webp
- p1.q####.com/video/568_320_70/t01c30bd1777952476d.webp
- p1.q####.com/video/568_320_70/t01c33d13f9f10c5c3b.webp
- p1.q####.com/video/568_320_70/t01c4dc0bf1f8f93f78.webp
- p1.q####.com/video/568_320_70/t01cc80cb9dd5ad05a2.webp
- p1.q####.com/video/568_320_70/t01cfbbcc63b85b9565.webp
- p1.q####.com/video/568_320_70/t01dc7ab8bfe21870f5.webp
- p1.q####.com/video/568_320_70/t01ef4f1d2e8ec9fe8a.webp
- p3.q####.com/dr/_100_70/t0100517d9c4836ab27.jpg
- p3.q####.com/dr/_100_70/t010d44a5c30eace11d.png
- p3.q####.com/dr/_100_70/t0126ca18fcfd08edfb.jpg
- p3.q####.com/dr/_100_70/t012c154c8fd7af949d.jpg
- p3.q####.com/dr/_100_70/t01448f36d6d50abd73.jpg
- p3.q####.com/dr/_100_70/t0152f1e30ab6883c48.jpg
- p3.q####.com/dr/_100_70/t01610ce907f6555ab4.jpg
- p3.q####.com/dr/_100_70/t017037ac66bbed1a72.jpg
- p3.q####.com/dr/_100_70/t01765ed9eb8faeb7a9.jpg
- p3.q####.com/dr/_100_70/t018c6c3d713198cdf3.jpg
- p3.q####.com/dr/_100_70/t01a7f952e4c780edb7.jpg
- p3.q####.com/dr/_100_70/t01bdafbf05a3413357.jpg
- p3.q####.com/dr/_100_70/t01bf88044e56176805.jpg
- p3.q####.com/t013db82533aa9e5a9a.jpg
- p3.q####.com/t018a76b42c2a942173.jpg
- p3.q####.com/t018a9cc33fe4135800.jpg
- p3.q####.com/t018b84477deb7d90c0.png
- p3.q####.com/t019ed52be13850ecf0.jpg
- p3.q####.com/t01a0b25dc057eb86a8.jpg
- p3.q####.com/t01ae4aad20279e7f68.png
- p3.q####.com/t01ae70f3f6372b712d.jpg
- p3.q####.com/t01c1ff533a19145140.jpg
- p3.q####.com/t01c284e24d09f6b14d.jpg
- p3.q####.com/t01d30c0f76d6516c09.png
- p3.q####.com/t01e69681fa8d4220ab.jpg
- p3.q####.com/t01f9458c7931fe73bc.jpg
- p3.q####.com/video/568_320_70/t01007b278874a1b884.webp
- p3.q####.com/video/568_320_70/t010adfe4f60ff21e06.webp
- p3.q####.com/video/568_320_70/t011acab8cef6f5ba78.webp
- p3.q####.com/video/568_320_70/t01212c0bc82fcf9743.webp
- p3.q####.com/video/568_320_70/t01226447d1786f6aa6.webp
- p3.q####.com/video/568_320_70/t012bc662830fde62b9.webp
- p3.q####.com/video/568_320_70/t0153191e6a12c2b547.webp
- p3.q####.com/video/568_320_70/t01573616ac2a513932.webp
- p3.q####.com/video/568_320_70/t0158087eea2b02dc9f.webp
- p3.q####.com/video/568_320_70/t016244154a8ca132ba.webp
- p3.q####.com/video/568_320_70/t016edc4bcbe02b46dd.webp
- p3.q####.com/video/568_320_70/t0176fe531ea312ad81.webp
- p3.q####.com/video/568_320_70/t01774aad16da0f2f1b.webp
- p3.q####.com/video/568_320_70/t0188ef798b737b592c.webp
- p3.q####.com/video/568_320_70/t0197d47bb8efe36a19.webp
- p3.q####.com/video/568_320_70/t019bf68d2f526883d7.webp
- p3.q####.com/video/568_320_70/t01c175fa6591e8e5ce.webp
- p3.q####.com/video/568_320_70/t01cec09900fb4ebf21.webp
- p3.q####.com/video/568_320_70/t01d5d6df6fed8d3e0c.webp
- p3.q####.com/video/568_320_70/t01dd0ba87522bb854a.webp
- p3.q####.com/video/568_320_70/t01e6ba839e90a6a4fb.webp
- p3.q####.com/video/568_320_70/t01e940ee1e413fb694.webp
- p3.q####.com/video/568_320_70/t01e9d669c38e00db31.webp
- p3.q####.com/video/568_320_70/t01eed707778a5da1b6.webp
- p4.q####.com/t0173ac48e79ebb6d73.png
- p8.q####.com/dr/_100_70/t013a044c43cf8e0536.png
- p8.q####.com/dr/_100_70/t01769565276d37ae88.jpg
- p8.q####.com/dr/_100_70/t01ded153605a3c6be3.jpg
- p8.q####.com/dr/_280_50/t010adfe4f60ff21e06.webp
- p8.q####.com/dr/_280_50/t01697818b39cd6be8e.webp
- p8.q####.com/dr/_280_50/t01cec09900fb4ebf21.webp
- p8.q####.com/t0147eeb331a280d627.jpg
- p8.q####.com/t0178bccfe750f110a1.jpg
- p8.q####.com/t019f6478307ad0eea6.jpg
- p8.q####.com/t01e6fe6ace7d9f7459.jpg
- p8.q####.com/t01f0970329b0fe4159.jpg
- p8.q####.com/video/568_320_70/t010dc9b920ef0fcc7b.webp
- p8.q####.com/video/568_320_70/t013a8b9983bd51e262.webp
- qos.l####.360.cn/vc.gif?&bid=####&pid=####&ver=####&c_ver=####&os=####&m...
- s####.l####.360.####.com/Object.getFile/livecloudsdk/YW5kcm9pZF9wbHVnaW5...
- s####.l####.360.####.com/Object.getFile/livecloudsdk/cGx1Z2luX3lmX3AycF8...
- s####.s.360.cn/ak/6766aa2750c19aad2fa1b32f36ed4aee.html?m2=####
- s####.s.360.cn/su/index.php?k=####&av=####&slv=####&sv=####&be=####&cv=#...
- sdk.l####.360.cn/codec?os=####&tm=####&model=####&r=####&package=####&pi...
- sdk.l####.360.cn/rtc?os=####&tm=####&model=####&r=####&package=####&pid=...
- sdk.l####.360.cn/sdkconf/videoplace?sign=####&u=####&version=####&sdk_ve...
- sdk.l####.360.cn/xinxiliu_tv_android_10228.conf?os=####&tm=####&r=####&p...
- sf3-ttc####.ps####.com/obj/ad.union.api/bebee1c7e7a11f703c4ec3039341f35f
- sh####.360t####.com/171122/c867c6e2f627a813302a3a0d0d891203/FZLTHK.TTF
- t####.me####.com/rtb?type=####&d=####&b=####&p=####&l=####&s=####&m=####...
- trac####.v.tf.####.cn/s?type=####&r=####&tid=####&finfo=####&enup=####&m...
HTTP POST requests:
- amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
- k####.36####.com/hotrizon2/report2?os=####&time=####&sys=####&m2=####&ap...
- k####.36####.com/k2/appconfig/getjarlist?appid=####&curEnv=####&m=####&m...
- k####.36####.com/k2/hotrizon2/getSInfo?os=####&sys=####&psw2=Su####&ssid...
- m3.s.3####.cn/api/v1/newid
- p.s.3####.cn/pstat/plog.php
- p.s.3####.cn/update/update.php?p=####
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
- t####.me####.com/adsdk?pver=####&skey=VZ####
- t####.me####.com/adsdk?pver=####&skey=X2####
- t####.me####.com/adsdk?pver=####&skey=aF####
- t####.me####.com/adsdk?pver=####&skey=uW####
- u.api.l####.####.cn/comment/lists
- up####.sdk.jig####.cn/v1/push/sdk/postlist
Modified file system:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/2033145970-602345128
- /data/data/####/4C3228E7AF86AF0BB35D594104950CAD.png
- /data/data/####/6926aaad-bd15-46fa-bc97-f7a1f0a73369
- /data/data/####/835640d1-d17c-447f-b24d-79eb77210139
- /data/data/####/ACCS_BINDumeng;5a56c9198f4a9d0c2f0001a8.xml
- /data/data/####/ACCS_SDK.xml
- /data/data/####/ACCS_SDK_CHANNEL.xml
- /data/data/####/AGOO_BIND.xml
- /data/data/####/AKTorchDownload.db
- /data/data/####/AKTorchDownload.db-journal
- /data/data/####/Agoo_AppStore.xml
- /data/data/####/Alliance.xml
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/DaemonServer
- /data/data/####/FZ.TTF
- /data/data/####/JPushSA_Config.xml
- /data/data/####/MENU_CACHE.xml
- /data/data/####/MessageStore.db-journal
- /data/data/####/MsgLogStore.db-journal
- /data/data/####/PendantConfig.xml
- /data/data/####/QHA_JSON_PERSISTER_42998cf32d552343bc8e460416382dca
- /data/data/####/QHDeviceFile
- /data/data/####/QHDeviceID.lock
- /data/data/####/QH_DeviceSDK.xml
- /data/data/####/QH_SDK_M2.xml
- /data/data/####/QH_SDK_UserData42998cf32d552343bc8e460416382dca.xml
- /data/data/####/QH_SDK_UserData6766aa2750c19aad2fa1b32f36ed4aee.xml
- /data/data/####/QH_SDK_sessionID42998cf32d552343bc8e460416382dca.xml
- /data/data/####/TAB_CACHE.xml
- /data/data/####/UM_PROBE_DATA.xml
- /data/data/####/Y29tLmxpZ2h0c2t5LnZpZGVv.tick.lock
- /data/data/####/ab_test_config.xml
- /data/data/####/abtest_base_sp_filename42998cf32d552343bc8e4604...ca.xml
- /data/data/####/accs.db-journal
- /data/data/####/ad_config_file.xml
- /data/data/####/ad_config_file.xml.bak
- /data/data/####/agoo.pid
- /data/data/####/android_player_20180725_175710_000.log_0
- /data/data/####/appPackageNames_v2
- /data/data/####/app_globel_config_file.xml
- /data/data/####/auth_guide_config_sdk.xml
- /data/data/####/banner.db-journal
- /data/data/####/cache.ttf
- /data/data/####/channel_webview.db-journal
- /data/data/####/cloud_config_file.xml
- /data/data/####/cloud_config_file.xml.bak
- /data/data/####/cloud_config_file.xml.bak (deleted)
- /data/data/####/cloud_push_config_file.xml
- /data/data/####/cloud_switch_cache
- /data/data/####/cn.jpush.android.user.profile.xml
- /data/data/####/cn.jpush.preferences.v2.rid.xml
- /data/data/####/cn.jpush.preferences.v2.xml
- /data/data/####/com.qihoo.livecloud.settings.GPWebrtcSettings.pref.xml
- /data/data/####/core_update
- /data/data/####/core_update_locker
- /data/data/####/critical_service_config.xml
- /data/data/####/d4c5a805-2060-4959-b082-363a2b8c7bb9
- /data/data/####/d8d0960b-ca73-46ef-8e2e-429996d4662c
- /data/data/####/daemon_webview.db-journal
- /data/data/####/dbfocus-journal
- /data/data/####/device_collector
- /data/data/####/device_collector_locker
- /data/data/####/download-journal
- /data/data/####/dso_deps
- /data/data/####/dso_lock
- /data/data/####/dso_manifest
- /data/data/####/dso_state
- /data/data/####/e596ff80-ba73-4a6d-a511-c0e07b14299f
- /data/data/####/e95b1564-773a-4289-af73-cea1ccdb80a2
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/finalcore.jar
- /data/data/####/getui_sp.xml
- /data/data/####/hotrizon_sharepref.xml
- /data/data/####/http_cookie.xml
- /data/data/####/httpdns_config_cache.xml
- /data/data/####/i==1.2.0&&1.2.28_1532541406348_envelope.log
- /data/data/####/info.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/jpush_device_info.xml
- /data/data/####/jpush_local_notification.db
- /data/data/####/jpush_local_notification.db-journal
- /data/data/####/jpush_local_notification.db-wal
- /data/data/####/jpush_stat_cache.json
- /data/data/####/jpush_stat_cache_history.json
- /data/data/####/jpush_statistics.db
- /data/data/####/jpush_statistics.db-journal
- /data/data/####/jpush_statistics.db-shm (deleted)
- /data/data/####/jpush_statistics.db-wal
- /data/data/####/jpushservice_webview.db-journal
- /data/data/####/libdvrender.so.tmp
- /data/data/####/libjiagu-71411075.so
- /data/data/####/libjplayer.so.tmp
- /data/data/####/liblocalserver.so.tmp
- /data/data/####/libmyssl.so.1.1.tmp
- /data/data/####/libtranscore.so.tmp
- /data/data/####/libviewer.so.tmp
- /data/data/####/libyfnet_360.so.tmp
- /data/data/####/light_sky_avast.xml
- /data/data/####/localserver_2.0.3.18042602.zip
- /data/data/####/locker
- /data/data/####/log_reupload_task
- /data/data/####/log_reupload_task_locker
- /data/data/####/message.db-journal
- /data/data/####/message_accs_db
- /data/data/####/message_accs_db-journal
- /data/data/####/msg_queue
- /data/data/####/msplugin_ksp.xml
- /data/data/####/multidex.version.xml
- /data/data/####/p.l
- /data/data/####/player_20180725_175732_000.log_0
- /data/data/####/player_record_2.0.3.18051401.zip
- /data/data/####/privacy_config_file.xml
- /data/data/####/profile_task
- /data/data/####/profile_task_locker
- /data/data/####/profile_torch_platform
- /data/data/####/push.db-journal
- /data/data/####/push.pid
- /data/data/####/push_share.xml
- /data/data/####/pushsdk.db-journal
- /data/data/####/qhvc_plugin.xml
- /data/data/####/qpush_msg.xml
- /data/data/####/run.pid
- /data/data/####/safe_user_info_file.xml
- /data/data/####/session_base_sp_filename42998cf32d552343bc8e460...ca.xml
- /data/data/####/session_base_sp_filenameandroidID.xml
- /data/data/####/share_data.xml
- /data/data/####/sp.livecloud.database.xml
- /data/data/####/sp_file_recommend_upload.xml
- /data/data/####/tab_request_name.xml
- /data/data/####/tools_2.0.3.18051401.zip
- /data/data/####/torch_sdk_config.xml
- /data/data/####/trans_20180725_175732_000.log_0
- /data/data/####/um_pri.xml
- /data/data/####/umdat.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_message_state.xml
- /data/data/####/uninstall_apk
- /data/data/####/uninstall_apk_locker
- /data/data/####/universalPopup.xml
- /data/data/####/videolist.db-journal
- /data/data/####/waitingDown
- /data/data/####/waitingDown_locker
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/yf_p2p_201804191558.zip
- /data/media/####/-rfHKqtGxxTj1QqvAH9TGJu3mSs.-828220373.tmp
- /data/media/####/.a.dat
- /data/media/####/.adfwe.dat
- /data/media/####/.cca.dat
- /data/media/####/.deviceId
- /data/media/####/.iddata
- /data/media/####/.nomedia
- /data/media/####/.push_deviceid
- /data/media/####/.sfp
- /data/media/####/.testf
- /data/media/####/.umm.dat
- /data/media/####/04B4DM4qNJh3AgzLb5GbJApNJzg.1385911459.tmp
- /data/media/####/06pV7Vft7EvBQ5uWtDmGTByc6T8.1002438937.tmp
- /data/media/####/0t4IxWR4b9dpLSnJ8epJMlmmRuQ.-1364107856.tmp
- /data/media/####/17sfHvQDCZXMqr2dDn4XWmbHSSs.315569735.tmp
- /data/media/####/1vjcHVQqib_f9Ov5r-sRBazh8Rw.1324112969.tmp
- /data/media/####/3ND
- /data/media/####/3ND (deleted)
- /data/media/####/3TN9JeE7Z5mbb718lSlYzQezgFI.822292847.tmp
- /data/media/####/3wLiHea3StRKRqLCql1E3ovDGNo.-918593081.tmp
- /data/media/####/42998cf32d552343bc8e460416382dca
- /data/media/####/4YfMtZeUP1udcEaIaCXigt9lGd4.303937558.tmp
- /data/media/####/5TP3ITsM6W1S3w0ukSRFTg6xsU4.1038559652.tmp
- /data/media/####/5UR91GU6P5kJZI0r34fctFGM9hw.-1544373453.tmp
- /data/media/####/5jRRzhGCMCCzEHtAoNYj5q7lPDU.-60118127.tmp
- /data/media/####/5kL027FOD8DGZFZAnzUNwaMYCVY.798634318.tmp
- /data/media/####/5kYdKGGi4PH0Et7Si7GnSvQ-iGs.1174582508.tmp
- /data/media/####/6766aa2750c19aad2fa1b32f36ed4aee
- /data/media/####/6766aa2750c19aad2fa1b32f36ed4aee (deleted)
- /data/media/####/6766aa2750c19aad2fa1b32f36ed4aee.tmp
- /data/media/####/6779af6859594356bf1044b670211a07
- /data/media/####/6GAfhj31m0GsGWHjYZzv6JdH09w.-1718230920.tmp
- /data/media/####/6VzzC07JSEQODUKPvcU_1em1xjk.-1763691222.tmp
- /data/media/####/6kRnzzQspMe_oD2_jfdKXIfSK08.1295787729.tmp
- /data/media/####/78hIP-UibgfmCTxk2n52kT98MTg.204842762.tmp
- /data/media/####/7B_J1ItGz0rS66yV5BW1ynBT2P0.-533363279.tmp
- /data/media/####/7gOiSgBTDx13FSAJKMZmlJoCRM0.-111781829.tmp
- /data/media/####/8323875654cf4117a46fc2db644947c2
- /data/media/####/8RVNy-FOCmqzTnndd_0-nlDPxCg.-1376816236.tmp
- /data/media/####/8rZQAfd-GlVJVspVmBSHe7VGgIQ.1427807361.tmp
- /data/media/####/94ad997f662147ba9e4c6c74eedab3c8
- /data/media/####/A5S7euAxcHqnxwmlh40OsnpZ1xA.1513730491.tmp
- /data/media/####/Alvin2.xml
- /data/media/####/AnVQe2emSbskzgMwcGU9vOj_rdI.1454496154.tmp
- /data/media/####/AvVevOYCmrf-trWcum33Sh62saI.636954442.tmp
- /data/media/####/BZj3SsL_zrKjtSPmE7fPvPa13fY.-387674043.tmp
- /data/media/####/Clhct9GKaHXmRw7sqmhXx4o0mzg.-1629207792.tmp
- /data/media/####/ContextData.xml
- /data/media/####/CvqwaZ3iCFBDzCAe8nYbg9uSEWM.1702346225.tmp
- /data/media/####/DurRUtAbU4TQ7DiLjZsCidst3MQ.-1668249070.tmp
- /data/media/####/F7Dn5S-U5qq_v4wkLQMATJAJW5A.1612792345.tmp
- /data/media/####/FqnSXu7Vb3kqNtQ1JpbAVCYxqrc.641762568.tmp
- /data/media/####/FswxI1ixBeWHQZosjZxBabtNw9w.1040145506.tmp
- /data/media/####/Fw--GWjT7pAXUzj_nn4Nr71LDIs.1282379609.tmp
- /data/media/####/GE-FfCLYJ1cxt65hPHK_kz7jORs.224371065.tmp
- /data/media/####/GFIuapEou3PmPbLpPUemyVOklBU.-1134668329.tmp
- /data/media/####/GgOoCBOr8n1taOKEf1PgOsvuZT0.-306576834.tmp
- /data/media/####/Gi237f0nHbG7g4WiRB3nDuAgYcE.1598747483.tmp
- /data/media/####/GuaETviUGJkVkVKLEywuE_1VXIQ.-1954648863.tmp
- /data/media/####/HCFu4Rnsdniu4n9y0lU2juJU5Hg.-882791451.tmp
- /data/media/####/HY_hI7cpBH_w_0vW9us1z-O7KNE.1688123895.tmp
- /data/media/####/Hdu3ZhF31ZNp1pREP1WfCsPm4Is.630265556.tmp
- /data/media/####/IEDiQlBH4--sWp8b27V6O0eyjP8.779566163.tmp
- /data/media/####/ITZ0F29ChbWak6HBdVv3T1Jb_48.393745029.tmp
- /data/media/####/KZ6gyyCO6sHpq7aULs-Hflmkh1w.88597966.tmp
- /data/media/####/LiHkRyUIirATgMSXgPH4B0NvdA0.1924192611.tmp
- /data/media/####/Lrz13Y_qWh0cOQjUs3OMXrWQ4Mc.-358322042.tmp
- /data/media/####/MDedLd4Q9kmXKPG0C7jiB_JqdB8.-468288157.tmp
- /data/media/####/MdzkIMMnw-Pqb_s9BIRWUNs4v1g.775332645.tmp
- /data/media/####/NuN4GdojQgRemi3OCz6z9FScFDA.-1007686613.tmp
- /data/media/####/O2-spYNTmI-vfDVMjt5dcDPZjbw.356990705.tmp
- /data/media/####/O5O
- /data/media/####/O5O (deleted)
- /data/media/####/O5Q5kIU7-0JTlquzdMXicXaPML8.828271169.tmp
- /data/media/####/OBsFdNaPqU7Efx_jWRsSbOorSBk.-327707835.tmp
- /data/media/####/OOPKgleLkt9JlwmsaJwtg68TP-U.1235873328.tmp
- /data/media/####/OnLLOU9zW6GA0EJI2GmMUvWI_UY.887637466.tmp
- /data/media/####/PXGdgBpVxH327ipknn9PLp0Rlqw.1445205720.tmp
- /data/media/####/PZZVxpDpRpD_ULzlCdrB1PljBAY.1694568699.tmp
- /data/media/####/PvpUyV2xdwHN9CvBZyOOX3UoU2I.-121034668.tmp
- /data/media/####/QNJLMmEtuIEql7hB-JJ2_TOWxIM.1703949903.tmp
- /data/media/####/Qt6RAt3fQzVpYav-E6MTKs3Jwo8.-1906267508.tmp
- /data/media/####/R8KpHH-e6o-Aq2fpJaWpekK-kv0.251343434.tmp
- /data/media/####/SvVM0BaVRVEht3p6jHMg44RtJPw.794712660.tmp
- /data/media/####/TOWK07coavPZnkCJJDzCUW4Mid0.258571366.tmp
- /data/media/####/TroRiXhPpxaTTm9gLPGp8PmyE-Y.-575378213.tmp
- /data/media/####/U57AJzbH1W34vaW5TMKhSVg8Gfg.1401658478.tmp
- /data/media/####/U68JezBRN6YPDNHMm7RXBCXhC84.215789981.tmp
- /data/media/####/UAwe8mkoClu1j3ozAFM6y6kOSAw.-1708793380.tmp
- /data/media/####/URSnCi-lMd6lVBqDzB5pR16_WU4.1778863490.tmp
- /data/media/####/VVE6oN4OggNpl7Klr6BcacCg87k.782654868.tmp
- /data/media/####/VbDau2fvxI5lsU5iEmVLDyknHn4.-2132409444.tmp
- /data/media/####/Vx4mb1EvPbFYOy0Pw6SE22D7ZUA.720890298.tmp
- /data/media/####/W1s2y4DvoyLbSH5Y_ml_RWXx5Sc.236764193.tmp
- /data/media/####/WPtXvvEJD_jweg92PLKnlywxpH0.-992562811.tmp
- /data/media/####/WYyIhksfybSdr2grMzvle2mm4Y8.-602057376.tmp
- /data/media/####/WiaGGB-3ibi_xA1RPeNAR6JrS6c.1775574585.tmp
- /data/media/####/Wu0
- /data/media/####/Wu0 (deleted)
- /data/media/####/Y29tLmxpZ2h0c2t5LnZpZGVv
- /data/media/####/Y29tLmxpZ2h0c2t5LnZpZGVv (deleted)
- /data/media/####/Y_OLZvdy_jMbtK5Tlz9Rbfwc2IE.-1671422694.tmp
- /data/media/####/Ybdly0sWP0jSk6sE6Pow8T0BJdM.-1832993972.tmp
- /data/media/####/YcF5SAyzq8m3-5vjAPSy26KUQ8Q.-1261933305.tmp
- /data/media/####/YnRCnTldSlUOwvZufqhb3aOvgL0.-585804533.tmp
- /data/media/####/YtPRhrggenO00jz3td3HdRpt-zk.-2028332596.tmp
- /data/media/####/_0vRe5nT7XAbg3moOp6yYab_XKI.-511227070.tmp
- /data/media/####/__VERSION__
- /data/media/####/ahS7fRc7uYgrws2lgyDDWGKyfHU.1591274123.tmp
- /data/media/####/avast_done
- /data/media/####/awKO8q_foG2pITOBhG0YBBScsdg.15386873.tmp
- /data/media/####/b05ce39c1fe9e72dc1df70989e7e6d14
- /data/media/####/bgLrxEp3EkitjQMZdw64iy2lj8Y.1363544666.tmp
- /data/media/####/biDKgJhNxd_wogTti_n_yEKbvLU.868805854.tmp
- /data/media/####/cC2pyKKei0EvhioBr2kqWoIm5n8.-696233613.tmp
- /data/media/####/cfIOnVrZ1R87i-FzW2dRzPlrL3g.1166405504.tmp
- /data/media/####/com.lightsky.video.bin
- /data/media/####/data.lock
- /data/media/####/ddocsjdY84FK3sdJ_jJ1iCPyGHw.1266751472.tmp
- /data/media/####/deviceToken
- /data/media/####/e6be4aabcb904ce6b2634f44477cf45d
- /data/media/####/e6jYhB_rvzrwN8Za8qCxlORcuSc.951489858.tmp
- /data/media/####/e6jYhB_rvzrwN8Za8qCxlORcuSc.cnt
- /data/media/####/eZSXW15Yg-xk9bkp0ut225bqkCA.-1254397734.tmp
- /data/media/####/fGgPJjQm0JCqQev0AbbpCCcGQc0.1791530997.tmp
- /data/media/####/fLkYePAZloaVmUf3B1ItC4k8AYU.1357246609.tmp
- /data/media/####/f_wgMHyv9X34OWpaef8j2QYedww.-1107743841.tmp
- /data/media/####/gDZLE-nbAQ_3nX2AvF5hY9mu4DM.97852879.tmp
- /data/media/####/gjkeN4XthL0_pGzbQrj0ncXbcuA.-1726751352.tmp
- /data/media/####/gsrfQkStoFSQEIL3Qzi1YHCW9y0.83047697.tmp
- /data/media/####/h-JHxdB_LAP7kMV3TVZBScRn-rc.1096264553.tmp
- /data/media/####/hwZtwvhC1ST5ANIrOG7rByAwAOk.-1468970128.tmp
- /data/media/####/iTF4dqmfhbzkeiW-NdQnYTWP-Io.153601181.tmp
- /data/media/####/jaRPitCNnQ9aQLDJGAjPAT_B1Us.-593805110.tmp
- /data/media/####/jcSAOr9jGZwkhQZMXMgqUBAFH0c.-185559908.tmp
- /data/media/####/k7iesEu2PchEMCEvONchTc4gBoI.-1030144632.tmp
- /data/media/####/m_pp8fxx-YT3pQcpydb-lPnGE6A.-1772878415.tmp
- /data/media/####/n8Yu_2f08c32wq5tC1gF2Zo94DQ.549039823.tmp
- /data/media/####/nElyFMAJCyUA-gNvl4K58n4KQhQ.692027142.tmp
- /data/media/####/nIU
- /data/media/####/nIU (deleted)
- /data/media/####/o7lOzARJ5efBdrlGvfJBYCfNIUM.1426026060.tmp
- /data/media/####/oCAw3RjQYxVTe-YeDQXkhHKtuJk.2093829763.tmp
- /data/media/####/oUOLW1iEAfEabFXoJfLOW47-9yI.728774127.tmp
- /data/media/####/pIbuUuzZYsyoCYw2SFb60ItCdmo.1864202836.tmp
- /data/media/####/pksBO2aZol1nLJ9Mb7s5Nmx0yHc.-1793726556.tmp
- /data/media/####/qLEWOszDfdfG3lcCGWKMJwd1360.-1461388740.tmp
- /data/media/####/report.lock
- /data/media/####/s4LDyrwUXQ4ic-EFqYDeIwT6PuU.2083667604.tmp
- /data/media/####/sY7HutvCb3sbojHPGUyTeKn-Oe0.-971653367.tmp
- /data/media/####/sjQum8Qdi7jTPd4z-Jo13Lm4oAc.115873278.tmp
- /data/media/####/u9wKs8VcfXS7IXlU_psnFomRfho.1364558647.tmp
- /data/media/####/uninstall_apk_list
- /data/media/####/w1gRJlJ-3UYRp-p5clENi6K7I9Q.52438124.tmp
- /data/media/####/w8n6whVgx8GnjBYo55B0wQQiFyY.302164190.tmp
- /data/media/####/wNPbM64Irg5yPTQwM9tjWpvK2Rk.897743377.tmp
- /data/media/####/xUm-uHLZseen7-xzU1dB1QKFots.-658945504.tmp
- /data/media/####/xXbAGmzT44ZIBjF8b9KHCb73K5w.424751117.tmp
- /data/media/####/yiDEbnuRI0nmWDX1xnqwPzJ32k0.-1318396688.tmp
- /data/media/####/z7_a7GFG1srlP8RgiYavHUAtxlk.1074861433.tmp
- /data/media/####/zIq
- /data/media/####/zIq (deleted)
Miscellaneous:
Executes next shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- /system/xbin/which su
- <Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5a56c9198f4a9d0c2f0001a8","utdid":"W1i53CWXVAQDAGdzx1Gg+x1+","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
- cat /proc/version
- chmod 755 <Package Folder>/.jiagu/libjiagu-71411075.so
- ls -l <Package Folder>
- ls /
- ls /sys/class/thermal
- sh
Loads the following dynamic libraries:
- GPBreakpad
- getuiext2
- jcore120
- libdvrender
- libimagepipeline
- libjiagu-71411075
- libjplayer
- liblocalserver
- libtranscore
- libviewer
- tnet-3.1
Uses the following algorithms to encrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
- DES
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- RSA-None-PKCS1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-NoPadding
- DES
Uses elevated priveleges.
Uses special library to hide executable bytecode.
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about installed applications.
Gains access to information about running applications.
Gains access to information about accounts (Google, Facebook, etc.) registered on the device.
Adds tasks to the system scheduler.
Displays its own windows over windows of other applications.