Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pic.wan####.com.####.com:80
- TCP(HTTP/1.1) gm.mm####.com:80
- TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
- TCP(HTTP/1.1) l####.tbs.qq.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) p####.tc.qq.com:80
- TCP(HTTP/1.1) c.c####.com:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) pco####.ta####.com:80
- TCP(HTTP/1.1) 47.1####.140.194:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) q####.a####.com:80
- TCP(HTTP/1.1) z.c####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) xz####.zhan####.com:10011
- TCP(HTTP/1.1) gamehe####.g####.com:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) f####.g####.com:80
- TCP(HTTP/1.1) ss####.g####.com:80
- TCP(HTTP/1.1) thi####.q####.cn:80
- TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) 2####.58.212.206:443
- TCP c####.g####.ig####.com:5224
- TCP sdk.o####.t####.####.com:5224
DNS requests:
- 7j####.c####.z0.####.com
- c####.g####.ig####.com
- c####.mm####.com
- c-h####.g####.com
- c.c####.com
- f####.g####.com
- gamehe####.g####.com
- imgc####.qq.com
- l####.tbs.qq.com
- log.u####.com
- mi.g####.qq.com
- pco####.c####.com
- pic####.wan####.com
- pic.wan####.com
- plb####.u####.com
- qzones####.g####.cn
- s####.e.qq.com
- s####.u####.com
- s4.c####.com
- sdk.c####.ig####.com
- sdk.checkup####.g####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- ss####.g####.com
- thi####.q####.cn
- u####.u####.com
- u####.umengc####.com
- x####.bj####.cn
- xz####.zhan####.com
- z11.c####.com
HTTP GET requests:
- c.c####.com/core.php?web_id=####&t=####
- c.c####.com/z_stat.php?id=####
- et2-na6####.wagbr####.ali####.####.com/bar/get/58f723aa310c933fc1000bf4/...
- f####.g####.com/api/discussions?include=####&filter[q]=####&cuid=####&ap...
- f####.g####.com/api/tags?cuid=####&app_id=####&channel_id=####&game_id=#...
- f####.g####.com/static/wzry/css/article_detail.css?v=####
- f####.g####.com/static/wzry/js/jquery-1.9.1.min.js
- f####.g####.com/wzry/article/51597.html?channel_id=####&app_id=####&game...
- gamehe####.g####.com/apk/report/activate?from=####&channel_id=####&app_i...
- gamehe####.g####.com/apk/report/checkupdate?channel_id=####&app_id=####&...
- gamehe####.g####.com/apk/report/openapk?channel_id=####&app_id=####&game...
- gamehe####.g####.com/wzry/hero/list?channel_id=####&app_id=####&game_id=...
- gamehe####.g####.com/wzry/hot/information?channel_id=####&app_id=####&ga...
- gm.mm####.com/9.gif?abc=####&rnd=####
- mi.g####.qq.com/gdt_mview.fcg?actual_width=####&count=####&r=####&templa...
- mi.g####.qq.com/gdt_mview.fcg?posw=####&posh=####&count=####&r=####&data...
- mi.g####.qq.com/gdt_mview.fcg?posw=####&spsa=####&posh=####&count=####&r...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.appcache
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/banner.html
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/banner_close_b...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg02.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg03.jpg
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/bannerbg07.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close02.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/close03.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon....
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/download_icon_...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/gdt_logo_black...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/icon-ad.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/sdk_bg.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tc-gdt-sdk-ope...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_ad_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/images/tsa_logo.png
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js-release/20170821/b...
- p####.tc.qq.com/qzone/biz/gdt/mob/sdk/v2/android01/js/lib/require.js
- p####.tc.qq.com/qzone/biz/gdt/mod/android/AndroidAllInOne/proguard/his/r...
- pco####.ta####.com/app.gif?&cna=####
- pic.wan####.com.####.com/1546894205546lhgtimstulcqsthl.jpeg
- pic.wan####.com.####.com/1546894205644imuejobenpokjkqx.jpeg
- pic.wan####.com.####.com/1546894205686iaptefhvnjbvqcgs.jpeg
- pic.wan####.com.####.com/1546976155902ogohwmmcrrhktcpl.jpeg
- pic.wan####.com.####.com/1546976155983qmtdjrwmbregsdyi.jpeg
- pic.wan####.com.####.com/1547114345350rvbgjubsjiiumurj.png
- pic.wan####.com.####.com/2017-05-05_590c232fb55c8.png
- pic.wan####.com.####.com/2017-05-05_590c233041cf3.png
- pic.wan####.com.####.com/2017-05-05_590c2330c26af.png
- pic.wan####.com.####.com/2017-05-05_590c23316325e.png
- pic.wan####.com.####.com/2017-05-05_590c23326ca1d.png
- pic.wan####.com.####.com/2017-05-05_590c233395c91.png
- pic.wan####.com.####.com/2017-05-05_590c2338d81f3.png
- pic.wan####.com.####.com/2017-05-05_590c233c2bbc6.png
- pic.wan####.com.####.com/2017-05-05_590c234170ffa.png
- pic.wan####.com.####.com/2017-05-05_590c2344ceb61.png
- pic.wan####.com.####.com/2017-05-05_590c23464b02a.png
- pic.wan####.com.####.com/2017-05-05_590c23478167f.png
- pic.wan####.com.####.com/2017-05-05_590c2349c67a0.png
- pic.wan####.com.####.com/2017-05-05_590c234a58630.png
- pic.wan####.com.####.com/2017-05-05_590c23519c199.png
- pic.wan####.com.####.com/2017-05-05_590c23545ba7b.png
- pic.wan####.com.####.com/2017-05-05_590c2355a8a48.png
- pic.wan####.com.####.com/2017-05-09_591146fed1a87.png
- pic.wan####.com.####.com/2017-05-09_59115f1b38692.png
- pic.wan####.com.####.com/2017-05-09_5911728740cc8.png
- pic.wan####.com.####.com/2017-05-09_591178d50a17a.png
- pic.wan####.com.####.com/2017-07-28_597af868f274b.png
- pic.wan####.com.####.com/2017-08-16_5993f16569431.png
- pic.wan####.com.####.com/2017-08-16_5993f44de1fbb.png
- pic.wan####.com.####.com/2017-09-29_59cdf29e3e62d.png
- pic.wan####.com.####.com/2017-12-06_5a27bc4e6b4fb.png
- pic.wan####.com.####.com/2018-01-02_5a4b74f8db0c3.jpeg
- pic.wan####.com.####.com/2018-02-07_5a7a6e89e83fc.png
- pic.wan####.com.####.com/2018-03-20_5ab0dda97a4c4.png
- pic.wan####.com.####.com/2018-06-26_5b320091a1915.png
- pic.wan####.com.####.com/2018-08-28_5b84b1a03fef4.png
- pic.wan####.com.####.com/2018-09-06_5b909433905d2.png
- pic.wan####.com.####.com/2018-09-13_5b99e680bf803.png
- pic.wan####.com.####.com/2018-11-02_5bdbd4708fa91.png
- pic.wan####.com.####.com/2018-11-13_5bea360053aa8.png
- pic.wan####.com.####.com/2018-11-16_5bee2f7671840.jpeg
- pic.wan####.com.####.com/2018-11-27_5bfd0aa89e0f9.png
- pic.wan####.com.####.com/2018-12-11_5c0f88e099f56.png
- pic.wan####.com.####.com/2018-12-18_5c18668cc303d.gif
- pic.wan####.com.####.com/2018-12-25_5c21935fe81c0.jpeg
- pic.wan####.com.####.com/2018-12-26_5c22fa6f28bbe.png
- pic.wan####.com.####.com/2019-01-02_5c2c36715dc3a.jpeg
- pic.wan####.com.####.com/2019-01-02_5c2c7916f22b2.jpeg
- pic.wan####.com.####.com/2019-01-03_5c2d91004f99e.jpeg
- pic.wan####.com.####.com/2019-01-04_5c2f0c6a4e7db.jpeg
- pic.wan####.com.####.com/2019-01-08_5c340cb808e1c.jpeg
- pic.wan####.com.####.com/2019-01-08_5c340dac6bc39.png
- pic.wan####.com.####.com/2019-01-08_5c340dac6bc39.png/thumblist
- pic.wan####.com.####.com/2019-01-08_5c340dace0abc.png
- pic.wan####.com.####.com/2019-01-08_5c340dad5b71e.png
- pic.wan####.com.####.com/2019-01-08_5c340dadd76f5.png
- pic.wan####.com.####.com/2019-01-08_5c340dae56b29.png
- pic.wan####.com.####.com/2019-01-08_5c340daec3d0d.png
- pic.wan####.com.####.com/2019-01-08_5c340daf4c07c.png
- pic.wan####.com.####.com/2019-01-09_5c3563f4716d4.jpg/thumblist
- pic.wan####.com.####.com/2019-01-09_5c357b7354db5.jpeg
- pic.wan####.com.####.com/2019-01-10_5c37073521f8f.png/thumblist
- pic.wan####.com.####.com/2019-01-10_5c37076194493.jpeg/thumblist
- pic.wan####.com.####.com/2019-01-10_5c3707ad7b6d2.gif/thumblist
- pic.wan####.com.####.com/2019-01-10_5c37080090f8d.jpeg/thumblist
- pic.wan####.com.####.com/2019-01-10_5c3708ddd8c33.jpeg/thumblist
- q####.a####.com/znewxinzffe/zxdat74
- ss####.g####.com/sspsdk/checkupdate?svr=####&channel_id=####&app_id=####
- ss####.g####.com/v1.0/mapping?&channel_id=####&device=####&cuid=####&cli...
- t####.c####.q####.####.com/config/hz-hzv3.conf
- t####.c####.q####.####.com/tdata_Bbr255
- t####.c####.q####.####.com/tdata_Soq141
- t####.c####.q####.####.com/tdata_vxj811
- thi####.q####.cn/qqapp/1106087305/3C28181E8FACAEBE136F2C6635C44F14/100
- z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
HTTP POST requests:
- c-h####.g####.com/api.php?format=####&t=####
- l####.tbs.qq.com/ajax?c=####&k=####
- l####.tbs.qq.com/ajax?c=####&v=####&k=####
- s####.e.qq.com/activate
- s####.e.qq.com/msg
- sdk.o####.p####.####.com/api.php?format=####&t=####
- xz####.zhan####.com:10011/zxhypay/action/updatexzf.do
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/070c22e5a812d1a1efb20f1251aeed44b5e21ea8298a5de....0.tmp
- /data/data/####/075c21df0f2902a7ef14f63610c5bd82a60e7edb706a0af....0.tmp
- /data/data/####/07d8fe8d6bcb5f2d2495ee49a2adac02921ac059c1a19e7....0.tmp
- /data/data/####/141aef1e4c01d909baa4a2c68d67c343f59fbd184df91ca....0.tmp
- /data/data/####/1547126018325.log
- /data/data/####/1d4c11921c21901f052369ee932fc92fec390e30df89d4c....0.tmp
- /data/data/####/1ea7d50bc7635324bd9cc8f8fd7b75b46504e17b8eee84a....0.tmp
- /data/data/####/24c69b0b01fb47bf2008a6578e5a3e6a1eb2d27d5f7409d....0.tmp
- /data/data/####/25a5be55aefe09484c2ff6e99df6ee90d08cf5b41a463e4....0.tmp
- /data/data/####/2605.yaqcookie
- /data/data/####/260cb73082d9b44caed71db523694cda890d9ec7329c856....0.tmp
- /data/data/####/297f23ef45df841e5337c306021528348cfd00618b153f9....0.tmp
- /data/data/####/2a1573a457e6de37d1bb241ac89b252917bfaf8ee8b0efc....0.tmp
- /data/data/####/32556be1e9f24ee57674b6e055e585130cf377ef6368e83....0.tmp
- /data/data/####/343d36a67bbd19550d62435a271ffe1afd21727e697405e....0.tmp
- /data/data/####/38657e09cafe4ace286dc8e6ba46e069be961f240c04e69....0.tmp
- /data/data/####/3d394eb40273699dceccb6063ec6b1f6b456e387479aaa5....0.tmp
- /data/data/####/3e269c342e8f12bb77c0b79dac970f1580161227e6baf42....0.tmp
- /data/data/####/43399bd6c9f23287463d5844db6ab7a9a3404b8510ded8f....0.tmp
- /data/data/####/45e470f0e9590be52f2e3cb696588272e42f10a261c5045....0.tmp
- /data/data/####/48655f96f99cc56d220aaad025c6467e3eca540eb18adf1....0.tmp
- /data/data/####/494b3a32979b705b463d314607fbff4ee0594da8db87225....0.tmp
- /data/data/####/4a9ca4366f1396580bbb0f72271d90cf094ecde55df55ae....0.tmp
- /data/data/####/4ff2de0c868c232320a70042698d9c75ba5becb8cde5f51....0.tmp
- /data/data/####/537162d040bb4b2d698bb5d1612abac81e5e258038d8b5e....0.tmp
- /data/data/####/5d8911de9cf84995d57fd12046297100e5439354cd0df6a....0.tmp
- /data/data/####/65545333823168cf0ea76102603142edf0771a8759c90e3....0.tmp
- /data/data/####/68f00eb33712ecdb8559025ec74b911bb8f86da60785d2c....0.tmp
- /data/data/####/6dcec3dfdafa04c108cb12c264a65ab3efa188fc6b8ac24....0.tmp
- /data/data/####/6fea0e4667f3210a8c96b9c011a57167af66e945fd47119....0.tmp
- /data/data/####/7420ae8e7d2670d361e704d98c713ec74ccdf250dd6a2d9....0.tmp
- /data/data/####/748d5f2ce3a0ce52d3d86328cd726e0711ce059330888e0....0.tmp
- /data/data/####/7804bf37243ead1a33e441830303bff847fa2221ea7b1de....0.tmp
- /data/data/####/7f6a7d4e1b9ad00bb6cd558d160782348e6d297a50ac358....0.tmp
- /data/data/####/8298b8e9c8bbe85c0f320565df897dd4d4a85a726e7c932....0.tmp
- /data/data/####/885eeddff150bd1e15c18ab3ef0bf69fb2cf2727233a67c....0.tmp
- /data/data/####/8bf0d76b5fd4d17e841a8a637bd78a1d22d7a4b05241c3d....0.tmp
- /data/data/####/98e859032f6b25510dddff3b4e842bd133ea85e8d26ea5e....0.tmp
- /data/data/####/ApplicationCache.db-journal
- /data/data/####/BuglySdkInfos.xml
- /data/data/####/GDTSDK.db
- /data/data/####/GDTSDK.db-journal
- /data/data/####/XinZF.xml
- /data/data/####/XinZF_conf.xml
- /data/data/####/XinZFsmspay.db
- /data/data/####/XinZFsmspay.db-journal
- /data/data/####/a507e5844c645b8a2d36b1254ed37f9d5a78fb90c964a80....0.tmp
- /data/data/####/a5bda72b730bcab56cec593d4bf769bbf54dd76c90e5806....0.tmp
- /data/data/####/a8b820568aae949491f4247bf33b3e5f945ff930be34098....0.tmp
- /data/data/####/aa5382aa342d7310db1518c3bc69b0e73e5c601260c369f...9f5d.0
- /data/data/####/aaf0258d40af6e76157d6ef8f54f67832d11d0203f1a0a0....0.tmp
- /data/data/####/ac3b96bcd57715eeecba68d89cedebddc184a50dcb878f2....0.tmp
- /data/data/####/b3887bf0bc14a6e2e8c877446d6acff03a2905dbf342f11....0.tmp
- /data/data/####/b49e765fd83135268d3a6ac7e98bcb3c0884fb9596bfe62....0.tmp
- /data/data/####/b9e2a65fd8f99538bb4c4dc8ad4f51c50af4379c0ff7d2c....0.tmp
- /data/data/####/c0a212599de4eb18fde9c376e62ddb08935528804c2adbe....0.tmp
- /data/data/####/c7197cf07dbc678dd096748bad6a3f2b783b17dc4f35021....0.tmp
- /data/data/####/c876420a2c10e53256415d7c199bf056664c7cee9fb5858....0.tmp
- /data/data/####/cff2091cad0dee0f1ede9764227460e18d72933402b8e95....0.tmp
- /data/data/####/config.xml
- /data/data/####/core_info
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTQ3MTI2MDA3MTgy;
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTQ3MTI2MDA4NzU4;
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTQ3MTI2MDA5NzM5;
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTQ3MTI2MDE0NjI3;
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTQ3MTI2MDE1NTE5;
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTQ3MTI2MDE3Njgy;
- /data/data/####/dW1weF9pbnRlcm5hbF8xNTQ3MTI2MDEzMTk0;
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/debug.conf
- /data/data/####/def3b32cd47061396bbdd760bc7ccba517147027b9ec749....0.tmp
- /data/data/####/devCloudSetting.cfg
- /data/data/####/devCloudSetting.sig
- /data/data/####/dexMethod.28020090.dat
- /data/data/####/download_info.db
- /data/data/####/download_info.db-journal
- /data/data/####/e23548b2cf8734658ced2b5404b4f5aa170ba03766a9b63....0.tmp
- /data/data/####/e265d0322bd65b72fbbeb8e73278429d4549299b72f2d5b....0.tmp
- /data/data/####/e460e76c4ae6e36fef0a20a098c365b9a9569c4e20d9665....0.tmp
- /data/data/####/e642130cf9ec8af81ccce349380e53eac9447754f0b370a....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f2d3f486ec384152588be3f21a0fe949fd7e63481222d61....0.tmp
- /data/data/####/f5a4e3e634383a9ba0eaf0da7655e3ac9627cd3593e28cf....0.tmp
- /data/data/####/f7afa14754d360ca9e6375c06dafff5b33c75bc295ec32f....0.tmp
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/fa4439a2450374d36e5b08c71d8bf1fa913288eb9b9317f....0.tmp
- /data/data/####/fd0a642ee9110c16cca7321ebf0743ffbaf71b8075e956d....0.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/gdt_config.cfg
- /data/data/####/gdt_plugin.dex (deleted)
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/gdt_plugin.tmp
- /data/data/####/gdt_plugin.tmp.sig
- /data/data/####/gdt_suid
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/hj_cuid_cache.xml
- /data/data/####/hj_settings.xml
- /data/data/####/hjofficalstrategy.db-journal
- /data/data/####/huanju_ad_info.xml
- /data/data/####/index
- /data/data/####/info.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/libjiagu-910048973.so
- /data/data/####/libyaqbasic.28020090.so
- /data/data/####/libyaqpro.28020090.so
- /data/data/####/multidex.version.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushk.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qihoo_jiagu_crash_report.xml
- /data/data/####/run.pid
- /data/data/####/sdkCloudSetting.cfg
- /data/data/####/sdkCloudSetting.sig
- /data/data/####/splash.jpg
- /data/data/####/ssp_download_info.db
- /data/data/####/ssp_download_info.db-journal
- /data/data/####/tbs_download_config.xml
- /data/data/####/tbs_download_stat.xml
- /data/data/####/tbscoreinstall.txt
- /data/data/####/tbslock.txt
- /data/data/####/tdata_Bbr255
- /data/data/####/tdata_Bbr255.jar
- /data/data/####/tdata_Soq141
- /data/data/####/tdata_Soq141.jar
- /data/data/####/tdata_vxj811
- /data/data/####/tdata_vxj811.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/um_pri.xml
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/update_lc
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/yaqsdkcookie
- /data/data/####/zxxinzf.apkdata
- /data/media/####/.cuid
- /data/media/####/.nomedia
- /data/media/####/308622a9a916d0fb776ccba27f916231
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.xiiiezzz.wangzi.bin
- /data/media/####/com.xiiiezzz.wangzi.db
- /data/media/####/tbslog.txt
- /data/media/####/tdata_Bbr255
- /data/media/####/tdata_Soq141
- /data/media/####/tdata_vxj811
- /data/media/####/test.log
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.huanju.wzry.push.PushService 24969 300 0
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu-910048973.so
- getprop ro.product.cpu.abi
- ls /sys/class/thermal
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.huanju.wzry.push.PushService 24969 300 0
Loads the following dynamic libraries:
- getuiext2
- libjiagu-910048973
- libyaqbasic.28020090
- libyaqpro.28020090
Uses the following algorithms to encrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS7Padding
- DES-CBC-PKCS5Padding
- DESede-ECB-PKCS5Padding
- RSA-ECB-NoPadding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-NoPadding
- AES-ECB-PKCS7Padding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
Parses information from SMS.
Gets information about sent/received SMS.