Adware.Gexin.6026

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) pub-####.qin####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) tengf####.c####.sensors####.cn:8006
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) beacon####.aliy####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(TLS/1.0) ada####.m.ta####.com:443
TCP(TLS/1.0) waws-pr####.vip.azurewe####.####.net:443
TCP(TLS/1.0) schedul####.yo####.com:443
TCP(TLS/1.0) cdn-sta####.azure####.net.####.net:443
TCP(TLS/1.0) 1####.217.20.110:443
TCP(TLS/1.0) sh.wagbr####.ta####.com:443
TCP c####.g####.ig####.com:5225
TCP sdk.o####.t####.####.com:5224

DNS requests:

7j####.c####.z0.####.com
a####.man.aliy####.com
a####.u####.com
ada####.ut.ta####.com
adas####.ut.ta####.com
beacon####.aliy####.com
c####.g####.ig####.com
c-h####.g####.com
code####.azurewe####.net
codepus####.azure####.net
pub-####.qin####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
tengf####.c####.sensors####.cn
tj.youza####.com

HTTP GET requests:

pub-####.qin####.com/tdata_EDT356
t####.c####.q####.####.com/tdata_BAI450
t####.c####.q####.####.com/tdata_YJA893
tengf####.c####.sensors####.cn:8006/config/Android.conf?project=####
ti####.c####.l####.####.com/config/hz-hzv3.conf

HTTP POST requests:

a####.u####.com/app_logs
beacon####.aliy####.com/beacon/fetch/config/byappkey
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
tengf####.c####.sensors####.cn:8006/sa?project=####&token=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/Alvin2.xml
/data/data/####/CodePush.xml
/data/data/####/ContextData.xml
/data/data/####/MultiDex.lock
/data/data/####/PranceCookiePrefsFile.db-journal
/data/data/####/Prance_Main_db-journal
/data/data/####/Prance_Read_History_db-journal
/data/data/####/Prance_User_db-journal
/data/data/####/RKStorage-journal
/data/data/####/UTCommon.xml
/data/data/####/a203c4a8cc8d
/data/data/####/allcircle_click_tip@2x.png
/data/data/####/allcircle_click_tip@3x.png
/data/data/####/allcircle_icon@2x.png
/data/data/####/allcircle_icon@3x.png
/data/data/####/ap.Lock
/data/data/####/app.json
/data/data/####/arrow@2x.png
/data/data/####/arrow@3x.png
/data/data/####/article_state_new_icon@2x.png
/data/data/####/article_state_new_icon@3x.png
/data/data/####/article_state_top_icon@2x.png
/data/data/####/article_state_top_icon@3x.png
/data/data/####/article_title_array_icon@2x.png
/data/data/####/article_title_array_icon@3x.png
/data/data/####/back-icon-mask.png
/data/data/####/back-icon.png
/data/data/####/back-icon@2x.png
/data/data/####/back-icon@3x.png
/data/data/####/bbs_attention_add@2x.png
/data/data/####/bbs_attention_add@3x.png
/data/data/####/bbs_attention_cancle@2x.png
/data/data/####/bbs_attention_cancle@3x.png
/data/data/####/bbs_attention_cancle_allcircle@2x.png
/data/data/####/bbs_attention_cancle_allcircle@3x.png
/data/data/####/bbs_btn_blue@2x.png
/data/data/####/bbs_btn_blue@3x.png
/data/data/####/bbs_circle_look_all@2x.png
/data/data/####/bbs_circle_look_all@3x.png
/data/data/####/bbs_create_float_btn@2x.png
/data/data/####/bbs_create_float_btn@3x.png
/data/data/####/bbs_focus_index_all_circle_icon@2x.png
/data/data/####/bbs_focus_index_all_circle_icon@3x.png
/data/data/####/bbs_focus_index_circle_add_icon@2x.png
/data/data/####/bbs_focus_index_circle_add_icon@3x.png
/data/data/####/bbs_focus_index_circle_remove_icon@2x.png
/data/data/####/bbs_focus_index_circle_remove_icon@3x.png
/data/data/####/bbs_look_all@2x.png
/data/data/####/bbs_look_all@3x.png
/data/data/####/bbs_post_detail_more_icon@2x.png
/data/data/####/bbs_post_detail_more_icon@3x.png
/data/data/####/bbs_post_index_add_icon@2x.png
/data/data/####/bbs_post_index_add_icon@3x.png
/data/data/####/bbs_post_index_anonymous_normal_icon@2x.png
/data/data/####/bbs_post_index_anonymous_normal_icon@3x.png
/data/data/####/bbs_post_index_anonymous_press_icon@2x.png
/data/data/####/bbs_post_index_anonymous_press_icon@3x.png
/data/data/####/bbs_post_index_delete_circle_icon@2x.png
/data/data/####/bbs_post_index_delete_circle_icon@3x.png
/data/data/####/bbs_post_index_delete_img_icon@2x.png
/data/data/####/bbs_post_index_delete_img_icon@3x.png
/data/data/####/bbs_post_index_down_arrow@2x.png
/data/data/####/bbs_post_index_down_arrow@3x.png
/data/data/####/bbs_post_index_img_icon@2x.png
/data/data/####/bbs_post_index_img_icon@3x.png
/data/data/####/bbs_post_index_topic_icon@2x.png
/data/data/####/bbs_post_index_topic_icon@3x.png
/data/data/####/bbs_post_index_topic_press_icon@2x.png
/data/data/####/bbs_post_index_topic_press_icon@3x.png
/data/data/####/bbs_post_my@2x.png
/data/data/####/bbs_post_my@3x.png
/data/data/####/bbs_reply_icon@2x.png
/data/data/####/bbs_reply_icon@3x.png
/data/data/####/bbs_title_hot_icon@2x.png
/data/data/####/bbs_title_hot_icon@3x.png
/data/data/####/bbs_title_top_icon@2x.png
/data/data/####/bbs_title_top_icon@3x.png
/data/data/####/big_placehoder@2x.png
/data/data/####/big_placehoder@3x.png
/data/data/####/bj_vip_icon@2x.png
/data/data/####/bj_vip_icon@3x.png
/data/data/####/bugly_db_-journal
/data/data/####/cache_download_switch_btn_start@2x.png
/data/data/####/cache_download_switch_btn_start@3x.png
/data/data/####/cache_download_switch_btn_start_disable@2x.png
/data/data/####/cache_download_switch_btn_start_disable@3x.png
/data/data/####/cache_download_switch_btn_stop@2x.png
/data/data/####/cache_download_switch_btn_stop@3x.png
/data/data/####/cache_download_switch_btn_stop_disable@2x.png
/data/data/####/cache_download_switch_btn_stop_disable@3x.png
/data/data/####/cache_downloaded@2x.png
/data/data/####/cache_downloaded@3x.png
/data/data/####/cache_downloading@2x.png
/data/data/####/cache_downloading@3x.png
/data/data/####/cache_more_schedule_icon_disable@2x.png
/data/data/####/cache_more_schedule_icon_disable@3x.png
/data/data/####/cache_more_schedule_icon_normal@2x.png
/data/data/####/cache_more_schedule_icon_normal@3x.png
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/checkbox_checked@2x.png
/data/data/####/checkbox_checked@3x.png
/data/data/####/checkbox_normal@2x.png
/data/data/####/checkbox_normal@3x.png
/data/data/####/checkbox_pressed@2x.png
/data/data/####/checkbox_pressed@3x.png
/data/data/####/checkbox_unchecked@2x.png
/data/data/####/checkbox_unchecked@3x.png
/data/data/####/circle_click_tip@2x.png
/data/data/####/circle_click_tip@3x.png
/data/data/####/circle_icon@2x.png
/data/data/####/circle_icon@3x.png
/data/data/####/circle_placeholder@2x.png
/data/data/####/codepush.json
/data/data/####/coin@2x.png
/data/data/####/coin@3x.png
/data/data/####/com.prance.app-journal
/data/data/####/com.prance.app_preferences.xml
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/com.youzan.mobile.AnalyticsPrefs.xml
/data/data/####/community_ishidden@2x.png
/data/data/####/community_ishidden@3x.png
/data/data/####/community_nohidden@2x.png
/data/data/####/community_nohidden@3x.png
/data/data/####/community_reply@2x.png
/data/data/####/community_reply@3x.png
/data/data/####/course_cache_list_icon@2x.png
/data/data/####/course_cache_list_icon@3x.png
/data/data/####/crashrecord.xml
/data/data/####/daydayup_recommendation_icon@2x.png
/data/data/####/daydayup_recommendation_icon@3x.png
/data/data/####/default_avatar@2x.png
/data/data/####/default_avatar@3x.png
/data/data/####/download.zip
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/edit_clear_icon@2x.png
/data/data/####/edit_clear_icon@3x.png
/data/data/####/empty_evaluate_icon@2x.png
/data/data/####/empty_evaluate_icon@3x.png
/data/data/####/empty_no_cache_icon@2x.png
/data/data/####/empty_no_cache_icon@3x.png
/data/data/####/empty_no_ware_icon@2x.png
/data/data/####/empty_no_ware_icon@3x.png
/data/data/####/empty_start@2x.png
/data/data/####/empty_start@3x.png
/data/data/####/events
/data/data/####/events-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exchange_icon_1@2x.png
/data/data/####/exchange_icon_1@3x.png
/data/data/####/exchange_icon_2@2x.png
/data/data/####/exchange_icon_2@3x.png
/data/data/####/exchange_icon_3@2x.png
/data/data/####/exchange_icon_3@3x.png
/data/data/####/exchange_icon_4@3x.png
/data/data/####/exid.dat
/data/data/####/favorite_media_icon@2x.png
/data/data/####/favorite_media_icon@3x.png
/data/data/####/fetch_empty_icon_new@2x.png
/data/data/####/fetch_empty_icon_new@3x.png
/data/data/####/fetch_fail_icon@2x.png
/data/data/####/fetch_fail_icon@3x.png
/data/data/####/fetch_fail_icon_new@2x.png
/data/data/####/fetch_fail_icon_new@3x.png
/data/data/####/focus_index_circle_item_bg1@2x.png
/data/data/####/focus_index_circle_item_bg1@3x.png
/data/data/####/focus_index_circle_item_bg2@2x.png
/data/data/####/focus_index_circle_item_bg2@3x.png
/data/data/####/focus_index_circle_item_bg3@2x.png
/data/data/####/focus_index_circle_item_bg3@3x.png
/data/data/####/focus_index_circle_item_bg4@2x.png
/data/data/####/focus_index_circle_item_bg4@3x.png
/data/data/####/gdaemon_20161017
/data/data/####/get_coin_icon@2x.png
/data/data/####/get_coin_icon@3x.png
/data/data/####/get_coin_icon_completed@2x.png
/data/data/####/get_coin_icon_completed@3x.png
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/home_article_cell_icon@2x.png
/data/data/####/home_article_cell_icon@3x.png
/data/data/####/home_audio_cell_icon@2x.png
/data/data/####/home_audio_cell_icon@3x.png
/data/data/####/home_bj_vip_bg@2x.png
/data/data/####/home_bj_vip_bg@3x.png
/data/data/####/home_community_msg_cancle@2x.png
/data/data/####/home_community_msg_cancle@3x.png
/data/data/####/home_community_msg_icon@2x.png
/data/data/####/home_community_msg_icon@3x.png
/data/data/####/home_course_hot@2x.png
/data/data/####/home_course_hot@3x.png
/data/data/####/home_course_rationing_icon@2x.png
/data/data/####/home_course_rationing_icon@3x.png
/data/data/####/home_course_rationing_icon_1@2x.png
/data/data/####/home_course_rationing_icon_1@3x.png
/data/data/####/home_course_subcribing@2x.png
/data/data/####/home_course_subcribing@3x.png
/data/data/####/home_course_tuan@2x.png
/data/data/####/home_course_tuan@3x.png
/data/data/####/home_everyday_article_icon@2x.png
/data/data/####/home_everyday_article_icon@3x.png
/data/data/####/home_everyday_audio_icon@2x.png
/data/data/####/home_everyday_audio_icon@3x.png
/data/data/####/home_everyday_study_item_icon@2x.png
/data/data/####/home_everyday_study_item_icon@3x.png
/data/data/####/home_group_title_more_icon@2x.png
/data/data/####/home_group_title_more_icon@3x.png
/data/data/####/home_item_meeting_icon@2x.png
/data/data/####/home_item_meeting_icon@3x.png
/data/data/####/home_living_bgview@2x.png
/data/data/####/home_living_bgview@3x.png
/data/data/####/home_living_living_icon@2x.png
/data/data/####/home_living_living_icon@3x.png
/data/data/####/home_living_waiting_icon@2x.png
/data/data/####/home_living_waiting_icon@3x.png
/data/data/####/home_media_progress_ion@2x.png
/data/data/####/home_media_progress_ion@3x.png
/data/data/####/home_meng_icon_bbs@2x.png
/data/data/####/home_meng_icon_bbs@3x.png
/data/data/####/home_meng_icon_bbs_word@2x.png
/data/data/####/home_meng_icon_bbs_word@3x.png
/data/data/####/home_nd_vip_bg@2x.png
/data/data/####/home_nd_vip_bg@3x.png
/data/data/####/home_new_user_task_icon@2x.png
/data/data/####/home_new_user_task_icon@3x.png
/data/data/####/home_series_course_bg@2x.png
/data/data/####/home_series_course_bg@3x.png
/data/data/####/home_tab_course_icon_normal@2x.png
/data/data/####/home_tab_course_icon_normal@3x.png
/data/data/####/home_tab_course_icon_selected@2x.png
/data/data/####/home_tab_course_icon_selected@3x.png
/data/data/####/home_tab_home_icon_normal@2x.png
/data/data/####/home_tab_home_icon_normal@3x.png
/data/data/####/home_tab_home_icon_selected@2x.png
/data/data/####/home_tab_home_icon_selected@3x.png
/data/data/####/home_tab_my_icon_normal@2x.png
/data/data/####/home_tab_my_icon_normal@3x.png
/data/data/####/home_tab_my_icon_selected@2x.png
/data/data/####/home_tab_my_icon_selected@3x.png
/data/data/####/home_tab_new_icon@2x.png
/data/data/####/home_tab_new_icon@3x.png
/data/data/####/home_tab_vip_icon_normal@2x.png
/data/data/####/home_tab_vip_icon_normal@3x.png
/data/data/####/home_tab_vip_icon_press@2x.png
/data/data/####/home_tab_vip_icon_press@3x.png
/data/data/####/home_toolbar_message_icon@2x.png
/data/data/####/home_toolbar_message_icon@3x.png
/data/data/####/home_toolbar_search_icon@2x.png
/data/data/####/home_toolbar_search_icon@3x.png
/data/data/####/home_toolbar_sign_icon@2x.png
/data/data/####/home_toolbar_sign_icon@3x.png
/data/data/####/home_topic_list_icon@2x.png
/data/data/####/home_topic_list_icon@3x.png
/data/data/####/home_video_bg@2x.png
/data/data/####/home_video_bg@3x.png
/data/data/####/home_zs_vip_bg@2x.png
/data/data/####/home_zs_vip_bg@3x.png
/data/data/####/hottopic_click_tip@2x.png
/data/data/####/hottopic_click_tip@3x.png
/data/data/####/hottopic_icon@2x.png
/data/data/####/hottopic_icon@3x.png
/data/data/####/ic_change_phone_number@2x.png
/data/data/####/ic_favorite_bbs@2x.png
/data/data/####/ic_favorite_bbs@3x.png
/data/data/####/ic_login_qq@2x.png
/data/data/####/ic_login_qq@3x.png
/data/data/####/ic_login_wechat@2x.png
/data/data/####/ic_login_wechat@3x.png
/data/data/####/ic_third_party_bind_qq@2x.png
/data/data/####/ic_third_party_bind_qq@3x.png
/data/data/####/ic_third_party_bind_wechat@2x.png
/data/data/####/ic_third_party_bind_wechat@3x.png
/data/data/####/index.android.bundle
/data/data/####/index.android.bundle.meta
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libjiagu-1267286255.so
/data/data/####/light_start@2x.png
/data/data/####/light_start@3x.png
/data/data/####/list_content_price@2x.png
/data/data/####/list_content_price@3x.png
/data/data/####/main.jsbundle
/data/data/####/main.jsbundle.meta
/data/data/####/meng_i_know_btn@2x.png
/data/data/####/meng_i_know_btn@3x.png
/data/data/####/menu_search_icon_dark@2x.png
/data/data/####/menu_search_icon_dark@3x.png
/data/data/####/multidex.version.xml
/data/data/####/my_cache_icon@2x.png
/data/data/####/my_cache_icon@3x.png
/data/data/####/my_coin@2x.png
/data/data/####/my_coin@3x.png
/data/data/####/my_community_icon@2x.png
/data/data/####/my_daysign_icon@2x.png
/data/data/####/my_daysign_icon@3x.png
/data/data/####/my_exchangecode_icon@2x.png
/data/data/####/my_exchangecode_icon@3x.png
/data/data/####/my_first_register_dialog_bg@2x.png
/data/data/####/my_first_register_dialog_bg@3x.png
/data/data/####/my_first_register_dialog_btn@2x.png
/data/data/####/my_first_register_dialog_btn@3x.png
/data/data/####/my_first_register_dialog_close@2x.png
/data/data/####/my_first_register_dialog_close@3x.png
/data/data/####/my_group_icon@2x.png
/data/data/####/my_group_icon@3x.png
/data/data/####/my_help_icon@2x.png
/data/data/####/my_help_icon@3x.png
/data/data/####/my_important_bg@2x.png
/data/data/####/my_important_bg@3x.png
/data/data/####/my_message_icon@2x.png
/data/data/####/my_message_icon@3x.png
/data/data/####/my_metting_icon@2x.png
/data/data/####/my_metting_icon@3x.png
/data/data/####/my_money_icon@2x.png
/data/data/####/my_money_icon@3x.png
/data/data/####/my_question_icon@2x.png
/data/data/####/my_question_icon@3x.png
/data/data/####/my_setting_icon@2x.png
/data/data/####/my_setting_icon@3x.png
/data/data/####/my_task_icon@2x.png
/data/data/####/my_task_icon@3x.png
/data/data/####/my_vip_icon@2x.png
/data/data/####/my_vip_icon@3x.png
/data/data/####/native_record_lock
/data/data/####/nav_back@2x.png
/data/data/####/nav_back@3x.png
/data/data/####/nav_back_dark@2x.png
/data/data/####/nav_back_dark@3x.png
/data/data/####/nav_close_dark@2x.png
/data/data/####/nav_close_dark@3x.png
/data/data/####/nd_vip_icon@2x.png
/data/data/####/nd_vip_icon@3x.png
/data/data/####/new_user_task_list_header_bg@2x.png
/data/data/####/new_user_task_list_header_bg@3x.png
/data/data/####/new_user_task_list_progress_dot_selected@2x.png
/data/data/####/new_user_task_list_progress_dot_selected@3x.png
/data/data/####/new_user_task_list_progress_gift_icon@2x.png
/data/data/####/new_user_task_list_progress_gift_icon@3x.png
/data/data/####/new_user_task_list_progress_gift_icon_selected@2x.png
/data/data/####/new_user_task_list_progress_gift_icon_selected@3x.png
/data/data/####/new_user_task_rules_close_icon@2x.png
/data/data/####/new_user_task_rules_close_icon@3x.png
/data/data/####/new_user_task_rules_title_left_icon@2x.png
/data/data/####/new_user_task_rules_title_left_icon@3x.png
/data/data/####/new_user_task_rules_title_right_icon@2x.png
/data/data/####/new_user_task_rules_title_right_icon@3x.png
/data/data/####/node_modules_reactnavigation_src_views_assets_b...sk.png
/data/data/####/node_modules_reactnavigation_src_views_assets_backicon.png
/data/data/####/pay_address_location_icon@2x.png
/data/data/####/pay_address_location_icon@3x.png
/data/data/####/pay_address_top_line@2x.png
/data/data/####/pay_address_top_line@3x.png
/data/data/####/pay_recommend_icon@2x.png
/data/data/####/pay_recommend_icon@3x.png
/data/data/####/pay_time_icon@2x.png
/data/data/####/pay_time_icon@3x.png
/data/data/####/pay_way_alipay_icon@2x.png
/data/data/####/pay_way_alipay_icon@3x.png
/data/data/####/pay_way_switch_icon_normal@2x.png
/data/data/####/pay_way_switch_icon_normal@3x.png
/data/data/####/pay_way_switch_icon_selected@2x.png
/data/data/####/pay_way_switch_icon_selected@3x.png
/data/data/####/pay_way_wechat_icon@2x.png
/data/data/####/pay_way_wechat_icon@3x.png
/data/data/####/post_detail_choose_normal@2x.png
/data/data/####/post_detail_choose_normal@3x.png
/data/data/####/post_detail_choose_normal_disable@2x.png
/data/data/####/post_detail_choose_normal_disable@3x.png
/data/data/####/post_detail_choose_selected@2x.png
/data/data/####/post_detail_choose_selected@3x.png
/data/data/####/post_detail_choose_selected_disable@2x.png
/data/data/####/post_detail_choose_selected_disable@3x.png
/data/data/####/post_detail_empty_view@2x.png
/data/data/####/post_detail_empty_view@3x.png
/data/data/####/post_detail_like_icon@2x.png
/data/data/####/post_detail_like_icon@3x.png
/data/data/####/post_detail_like_normal_icon@2x.png
/data/data/####/post_detail_like_normal_icon@3x.png
/data/data/####/post_detail_reply_icon@2x.png
/data/data/####/post_detail_reply_icon@3x.png
/data/data/####/post_detail_reply_like_icon@2x.png
/data/data/####/post_detail_reply_like_icon@3x.png
/data/data/####/post_detail_reply_like_normal_icon@2x.png
/data/data/####/post_detail_reply_like_normal_icon@3x.png
/data/data/####/post_detail_reply_reply_icon@2x.png
/data/data/####/post_detail_reply_reply_icon@3x.png
/data/data/####/post_detail_share_circle_icon@2x.png
/data/data/####/post_detail_share_circle_icon@3x.png
/data/data/####/post_detail_share_collect_normal_icon@2x.png
/data/data/####/post_detail_share_collect_normal_icon@3x.png
/data/data/####/post_detail_share_collect_press_icon@3x.png
/data/data/####/post_detail_share_delete_press_icon@2x.png
/data/data/####/post_detail_share_delete_press_icon@3x.png
/data/data/####/post_detail_share_qq_icon@2x.png
/data/data/####/post_detail_share_qq_icon@3x.png
/data/data/####/post_detail_share_qzone_icon@2x.png
/data/data/####/post_detail_share_qzone_icon@3x.png
/data/data/####/post_detail_share_report_icon@2x.png
/data/data/####/post_detail_share_report_icon@3x.png
/data/data/####/post_detail_share_wx_icon@2x.png
/data/data/####/post_detail_share_wx_icon@3x.png
/data/data/####/post_detail_view_all_reply_arrow@2x.png
/data/data/####/post_detail_view_all_reply_arrow@3x.png
/data/data/####/post_item_overhead_icon@2x.png
/data/data/####/post_item_overhead_icon@3x.png
/data/data/####/post_item_share_icon@2x.png
/data/data/####/post_item_share_icon@3x.png
/data/data/####/post_item_vip_icon@2x.png
/data/data/####/post_item_vip_icon@3x.png
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/react_components_form_images_edit_clear_icon.png
/data/data/####/react_components_header_images_nav_back.png
/data/data/####/react_components_header_images_nav_back_dark.png
/data/data/####/react_components_header_images_nav_close_dark.png
/data/data/####/react_components_listview_images_turn_top_btn.png
/data/data/####/react_pages_articleitem_images_article_state_new_icon.png
/data/data/####/react_pages_articleitem_images_article_state_top_icon.png
/data/data/####/react_pages_articleitem_images_article_title_ar...on.png
/data/data/####/react_pages_articleitem_images_daydayup_recomme...on.png
/data/data/####/react_pages_articleitem_images_exchange_icon_1.png
/data/data/####/react_pages_articleitem_images_exchange_icon_2.png
/data/data/####/react_pages_articleitem_images_exchange_icon_3.png
/data/data/####/react_pages_articleitem_images_exchange_icon_4.png
/data/data/####/react_pages_articleitem_images_home_video_bg.png
/data/data/####/react_pages_articleitem_images_list_content_price.png
/data/data/####/react_pages_articlelist_image_menu_search_icon_dark.png
/data/data/####/react_pages_bbs_guide_images_allcircle_click_tip.png
/data/data/####/react_pages_bbs_guide_images_allcircle_icon.png
/data/data/####/react_pages_bbs_guide_images_circle_click_tip.png
/data/data/####/react_pages_bbs_guide_images_circle_icon.png
/data/data/####/react_pages_bbs_guide_images_hottopic_click_tip.png
/data/data/####/react_pages_bbs_guide_images_hottopic_icon.png
/data/data/####/react_pages_bbs_images_bbs_attention_add.png
/data/data/####/react_pages_bbs_images_bbs_attention_cancle.png
/data/data/####/react_pages_bbs_images_bbs_attention_cancle_allcircle.png
/data/data/####/react_pages_bbs_images_bbs_btn_blue.png
/data/data/####/react_pages_bbs_images_bbs_circle_look_all.png
/data/data/####/react_pages_bbs_images_bbs_create_float_btn.png
/data/data/####/react_pages_bbs_images_bbs_focus_index_all_circle_icon.png
/data/data/####/react_pages_bbs_images_bbs_focus_index_circle_add_icon.png
/data/data/####/react_pages_bbs_images_bbs_focus_index_circle_r...on.png
/data/data/####/react_pages_bbs_images_bbs_look_all.png
/data/data/####/react_pages_bbs_images_bbs_post_detail_more_icon.png
/data/data/####/react_pages_bbs_images_bbs_post_index_add_icon.png
/data/data/####/react_pages_bbs_images_bbs_post_index_anonymous...on.png
/data/data/####/react_pages_bbs_images_bbs_post_index_delete_ci...on.png
/data/data/####/react_pages_bbs_images_bbs_post_index_delete_img_icon.png
/data/data/####/react_pages_bbs_images_bbs_post_index_down_arrow.png
/data/data/####/react_pages_bbs_images_bbs_post_index_img_icon.png
/data/data/####/react_pages_bbs_images_bbs_post_index_topic_icon.png
/data/data/####/react_pages_bbs_images_bbs_post_index_topic_press_icon.png
/data/data/####/react_pages_bbs_images_bbs_post_my.png
/data/data/####/react_pages_bbs_images_bbs_reply_icon.png
/data/data/####/react_pages_bbs_images_bbs_title_hot_icon.png
/data/data/####/react_pages_bbs_images_bbs_title_top_icon.png
/data/data/####/react_pages_bbs_images_focus_index_circle_item_bg1.png
/data/data/####/react_pages_bbs_images_focus_index_circle_item_bg2.png
/data/data/####/react_pages_bbs_images_focus_index_circle_item_bg3.png
/data/data/####/react_pages_bbs_images_focus_index_circle_item_bg4.png
/data/data/####/react_pages_bbs_images_post_detail_choose_norma...le.png
/data/data/####/react_pages_bbs_images_post_detail_choose_normal.png
/data/data/####/react_pages_bbs_images_post_detail_choose_selec...le.png
/data/data/####/react_pages_bbs_images_post_detail_choose_selected.png
/data/data/####/react_pages_bbs_images_post_detail_empty_view.png
/data/data/####/react_pages_bbs_images_post_detail_like_icon.png
/data/data/####/react_pages_bbs_images_post_detail_like_normal_icon.png
/data/data/####/react_pages_bbs_images_post_detail_reply_icon.png
/data/data/####/react_pages_bbs_images_post_detail_reply_like_icon.png
/data/data/####/react_pages_bbs_images_post_detail_reply_like_n...on.png
/data/data/####/react_pages_bbs_images_post_detail_reply_reply_icon.png
/data/data/####/react_pages_bbs_images_post_detail_share_circle_icon.png
/data/data/####/react_pages_bbs_images_post_detail_share_collec...on.png
/data/data/####/react_pages_bbs_images_post_detail_share_delete...on.png
/data/data/####/react_pages_bbs_images_post_detail_share_qq_icon.png
/data/data/####/react_pages_bbs_images_post_detail_share_qzone_icon.png
/data/data/####/react_pages_bbs_images_post_detail_share_report_icon.png
/data/data/####/react_pages_bbs_images_post_detail_share_wx_icon.png
/data/data/####/react_pages_bbs_images_post_detail_view_all_rep...ow.png
/data/data/####/react_pages_bbs_images_post_item_overhead_icon.png
/data/data/####/react_pages_bbs_images_post_item_share_icon.png
/data/data/####/react_pages_bbs_images_post_item_vip_icon.png
/data/data/####/react_pages_course_cache_images_cache_download_...le.png
/data/data/####/react_pages_course_cache_images_cache_download_...op.png
/data/data/####/react_pages_course_cache_images_cache_download_...rt.png
/data/data/####/react_pages_course_cache_images_cache_downloaded.png
/data/data/####/react_pages_course_cache_images_cache_downloading.png
/data/data/####/react_pages_course_cache_images_cache_more_sche...al.png
/data/data/####/react_pages_course_cache_images_cache_more_sche...le.png
/data/data/####/react_pages_course_cache_images_course_cache_list_icon.png
/data/data/####/react_pages_course_images_empty_no_cache_icon.png
/data/data/####/react_pages_course_images_empty_no_ware_icon.png
/data/data/####/react_pages_evaluate_images_empty_start.png
/data/data/####/react_pages_evaluate_images_selected_start.png
/data/data/####/react_pages_evaluatelist_images_empty_evaluate_icon.png
/data/data/####/react_pages_evaluatelist_images_empty_start.png
/data/data/####/react_pages_evaluatelist_images_light_start.png
/data/data/####/react_pages_favorite_images_favorite_media_icon.png
/data/data/####/react_pages_favorite_images_ic_favorite_bbs.png
/data/data/####/react_pages_home_images_bj_vip_icon.png
/data/data/####/react_pages_home_images_home_article_cell_icon.png
/data/data/####/react_pages_home_images_home_audio_cell_icon.png
/data/data/####/react_pages_home_images_home_bj_vip_bg.png
/data/data/####/react_pages_home_images_home_community_msg_cancle.png
/data/data/####/react_pages_home_images_home_community_msg_icon.png
/data/data/####/react_pages_home_images_home_course_hot.png
/data/data/####/react_pages_home_images_home_course_rationing_icon.png
/data/data/####/react_pages_home_images_home_course_rationing_icon_1.png
/data/data/####/react_pages_home_images_home_course_subcribing.png
/data/data/####/react_pages_home_images_home_course_tuan.png
/data/data/####/react_pages_home_images_home_everyday_article_icon.png
/data/data/####/react_pages_home_images_home_everyday_audio_icon.png
/data/data/####/react_pages_home_images_home_everyday_study_item_icon.png
/data/data/####/react_pages_home_images_home_group_title_more_icon.png
/data/data/####/react_pages_home_images_home_item_meeting_icon.png
/data/data/####/react_pages_home_images_home_living_bgview.png
/data/data/####/react_pages_home_images_home_living_living_icon.png
/data/data/####/react_pages_home_images_home_living_waiting_icon.png
/data/data/####/react_pages_home_images_home_media_progress_ion.png
/data/data/####/react_pages_home_images_home_nd_vip_bg.png
/data/data/####/react_pages_home_images_home_new_user_task_icon.png
/data/data/####/react_pages_home_images_home_series_course_bg.png
/data/data/####/react_pages_home_images_home_tab_course_icon_normal.png
/data/data/####/react_pages_home_images_home_tab_course_icon_selected.png
/data/data/####/react_pages_home_images_home_tab_home_icon_normal.png
/data/data/####/react_pages_home_images_home_tab_home_icon_selected.png
/data/data/####/react_pages_home_images_home_tab_my_icon_normal.png
/data/data/####/react_pages_home_images_home_tab_my_icon_selected.png
/data/data/####/react_pages_home_images_home_tab_new_icon.png
/data/data/####/react_pages_home_images_home_tab_vip_icon_normal.png
/data/data/####/react_pages_home_images_home_tab_vip_icon_press.png
/data/data/####/react_pages_home_images_home_toolbar_message_icon.png
/data/data/####/react_pages_home_images_home_toolbar_search_icon.png
/data/data/####/react_pages_home_images_home_toolbar_sign_icon.png
/data/data/####/react_pages_home_images_home_topic_list_icon.png
/data/data/####/react_pages_home_images_home_zs_vip_bg.png
/data/data/####/react_pages_home_images_my_daysign_icon.png
/data/data/####/react_pages_home_images_my_message_icon.png
/data/data/####/react_pages_home_images_my_setting_icon.png
/data/data/####/react_pages_home_images_nd_vip_icon.png
/data/data/####/react_pages_home_images_time_interval.png
/data/data/####/react_pages_home_images_vip_free_icon.png
/data/data/####/react_pages_home_images_zs_vip_icon.png
/data/data/####/react_pages_home_meng_images_home_meng_icon_bbs.png
/data/data/####/react_pages_home_meng_images_home_meng_icon_bbs_word.png
/data/data/####/react_pages_home_meng_images_meng_i_know_btn.png
/data/data/####/react_pages_home_mycomponent_images_my_cache_icon.png
/data/data/####/react_pages_home_mycomponent_images_my_coin.png
/data/data/####/react_pages_home_mycomponent_images_my_community_icon.png
/data/data/####/react_pages_home_mycomponent_images_my_exchange...on.png
/data/data/####/react_pages_home_mycomponent_images_my_first_re...bg.png
/data/data/####/react_pages_home_mycomponent_images_my_first_re...se.png
/data/data/####/react_pages_home_mycomponent_images_my_first_re...tn.png
/data/data/####/react_pages_home_mycomponent_images_my_group_icon.png
/data/data/####/react_pages_home_mycomponent_images_my_help_icon.png
/data/data/####/react_pages_home_mycomponent_images_my_important_bg.png
/data/data/####/react_pages_home_mycomponent_images_my_metting_icon.png
/data/data/####/react_pages_home_mycomponent_images_my_money_icon.png
/data/data/####/react_pages_home_mycomponent_images_my_question_icon.png
/data/data/####/react_pages_home_mycomponent_images_my_task_icon.png
/data/data/####/react_pages_home_mycomponent_images_my_vip_icon.png
/data/data/####/react_pages_my_images_community_ishidden.png
/data/data/####/react_pages_my_images_community_nohidden.png
/data/data/####/react_pages_my_images_community_reply.png
/data/data/####/react_pages_my_images_series_course_jiantou.png
/data/data/####/react_pages_my_images_series_detail_bj_bg.png
/data/data/####/react_pages_my_images_series_detail_nd_bg.png
/data/data/####/react_pages_my_images_series_detail_suo.png
/data/data/####/react_pages_my_images_series_detail_zs_bg.png
/data/data/####/react_pages_pay_images_pay_address_location_icon.png
/data/data/####/react_pages_pay_images_pay_address_top_line.png
/data/data/####/react_pages_pay_images_pay_recommend_icon.png
/data/data/####/react_pages_pay_images_pay_time_icon.png
/data/data/####/react_pages_pay_images_pay_way_alipay_icon.png
/data/data/####/react_pages_pay_images_pay_way_switch_icon_normal.png
/data/data/####/react_pages_pay_images_pay_way_switch_icon_selected.png
/data/data/####/react_pages_pay_images_pay_way_wechat_icon.png
/data/data/####/react_pages_tasklist_images_coin.png
/data/data/####/react_pages_tasklist_images_get_coin_icon.png
/data/data/####/react_pages_tasklist_images_get_coin_icon_completed.png
/data/data/####/react_pages_tasklist_images_new_user_task_list_...bg.png
/data/data/####/react_pages_tasklist_images_new_user_task_list_...ed.png
/data/data/####/react_pages_tasklist_images_new_user_task_list_...on.png
/data/data/####/react_pages_tasklist_images_new_user_task_rules...on.png
/data/data/####/react_pages_tasklist_images_task_list_top_bg.png
/data/data/####/react_pages_tasklist_images_task_pull_down.png
/data/data/####/react_pages_tasklist_images_task_pull_up.png
/data/data/####/react_pages_tasklist_images_task_receive_score.png
/data/data/####/react_pages_user_images_checkbox_checked.png
/data/data/####/react_pages_user_images_checkbox_unchecked.png
/data/data/####/react_pages_user_images_ic_change_phone_number.png
/data/data/####/react_pages_user_images_ic_login_qq.png
/data/data/####/react_pages_user_images_ic_login_wechat.png
/data/data/####/react_pages_user_images_ic_third_party_bind_qq.png
/data/data/####/react_pages_user_images_ic_third_party_bind_wechat.png
/data/data/####/react_pages_user_images_register_gift.png
/data/data/####/react_res_image_arrow.png
/data/data/####/react_res_image_big_placehoder.png
/data/data/####/react_res_image_checkbox_normal.png
/data/data/####/react_res_image_checkbox_pressed.png
/data/data/####/react_res_image_circle_placeholder.png
/data/data/####/react_res_image_default_avatar.png
/data/data/####/react_res_image_fetch_empty_icon_new.png
/data/data/####/react_res_image_fetch_fail_icon.png
/data/data/####/react_res_image_fetch_fail_icon_new.png
/data/data/####/react_res_image_reload_data_again_bg.png
/data/data/####/react_res_image_slogan.png
/data/data/####/react_res_image_small_placeholder.png
/data/data/####/register_gift@2x.png
/data/data/####/register_gift@3x.png
/data/data/####/reload_data_again_bg@2x.png
/data/data/####/reload_data_again_bg@3x.png
/data/data/####/run.pid
/data/data/####/selected_start@2x.png
/data/data/####/selected_start@3x.png
/data/data/####/sensorsdata.xml
/data/data/####/series_course_jiantou@2x.png
/data/data/####/series_course_jiantou@3x.png
/data/data/####/series_detail_bj_bg@2x.png
/data/data/####/series_detail_bj_bg@3x.png
/data/data/####/series_detail_nd_bg@2x.png
/data/data/####/series_detail_suo@2x.png
/data/data/####/series_detail_suo@3x.png
/data/data/####/series_detail_zs_bg@2x.png
/data/data/####/series_detail_zs_bg@3x.png
/data/data/####/shared.db-journal
/data/data/####/slogan@2x.png
/data/data/####/slogan@3x.png
/data/data/####/small_placeholder@2x.png
/data/data/####/small_placeholder@3x.png
/data/data/####/task_list_top_bg@2x.png
/data/data/####/task_list_top_bg@3x.png
/data/data/####/task_pull_down@2x.png
/data/data/####/task_pull_down@3x.png
/data/data/####/task_pull_up@2x.png
/data/data/####/task_pull_up@3x.png
/data/data/####/task_receive_score@2x.png
/data/data/####/task_receive_score@3x.png
/data/data/####/tdata_BAI450
/data/data/####/tdata_BAI450.jar
/data/data/####/tdata_YJA893
/data/data/####/tdata_YJA893.jar
/data/data/####/time_interval@2x.png
/data/data/####/time_interval@3x.png
/data/data/####/turn_top_btn@2x.png
/data/data/####/turn_top_btn@3x.png
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/data/####/vip_free_icon@2x.png
/data/data/####/vip_free_icon@3x.png
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/zs_vip_icon@2x.png
/data/data/####/zs_vip_icon@3x.png
/data/media/####/.nomedia
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.prance.app.bin
/data/media/####/com.prance.app.db
/data/media/####/tdata_BAI450
/data/media/####/tdata_YJA893
/data/media/####/test.log

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/com.prance.third.impl.GeTuiPushService 24365 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.prance.third.impl.GeTuiPushService 24365 300 0

Loads the following dynamic libraries:

Bugly
getuiext2
libfb
libjiagu-1267286255
libreactnativejni
libyoga
ut_c_api

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical information

Curing recommendations

Free trial