Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) av1.x####.com:443
DNS requests:
- 7f5e492####.bug####.com
- av1.x####.com
- i.t####.com
File system changes:
Creates the following files:
- /data/data/####/1550376758163_2288
- /data/data/####/1550376758210_2288
- /data/data/####/1550376758268_2288
- /data/data/####/1550376759080_2338
- /data/data/####/1550376759153_2338
- /data/data/####/1550376759825_2387
- /data/data/####/1550376759949_2387
- /data/data/####/1550376763936_2447
- /data/data/####/1550376764760_2495
- /data/data/####/1550376766543_2543
- /data/data/####/1550376769211_2602
- /data/data/####/1550376770095_2650
- /data/data/####/1550376770909_2698
- /data/data/####/1550376773281_2759
- /data/data/####/1550376776192_2807
- /data/data/####/1550376777033_2855
- /data/data/####/1550376779921_2914
- /data/data/####/1550376781090_2962
- /data/data/####/1550376782005_3010
- /data/data/####/1550376784353_3070
- /data/data/####/1550376785161_3118
- /data/data/####/1550376786053_3166
- /data/data/####/1550376788092_3224
- /data/data/####/1550376788903_3272
- /data/data/####/1550376789794_3320
- /data/data/####/1550376794144_3380
- /data/data/####/1550376795068_3428
- /data/data/####/1550376795860_3476
- /data/data/####/1550376798376_3524
- /data/data/####/1550376799173_3572
- /data/data/####/1550376800068_3620
- /data/data/####/1550376802011_3679
- /data/data/####/1550376802851_3727
- /data/data/####/1550376806099_3775
- /data/data/####/1550376817155_3840
- /data/data/####/1550376818422_3888
- /data/data/####/1550376819492_3936
- /data/data/####/MultiDex.lock
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/TDpref_longtime.xml
- /data/data/####/TDpref_longtime0.xml
- /data/data/####/journal.tmp
- /data/data/####/libjiagu-917064677.so
- /data/data/####/multidex.version.xml
- /data/data/####/tdid.xml
- /data/media/####/.nomedia
- /data/media/####/.tcookieid
Miscellaneous:
Executes the following shell scripts:
- getprop
- logcat -v time -t 500 2288
- logcat -v time -t 500 2338
- logcat -v time -t 500 2387
- logcat -v time -t 500 2447
- logcat -v time -t 500 2495
- logcat -v time -t 500 2543
- logcat -v time -t 500 2602
- logcat -v time -t 500 2650
- logcat -v time -t 500 2698
- logcat -v time -t 500 2759
- logcat -v time -t 500 2807
- logcat -v time -t 500 2855
- logcat -v time -t 500 2914
- logcat -v time -t 500 2962
- logcat -v time -t 500 3010
- logcat -v time -t 500 3070
- logcat -v time -t 500 3118
- logcat -v time -t 500 3166
- logcat -v time -t 500 3224
- logcat -v time -t 500 3272
- logcat -v time -t 500 3320
- logcat -v time -t 500 3380
- logcat -v time -t 500 3428
- logcat -v time -t 500 3476
- logcat -v time -t 500 3524
- logcat -v time -t 500 3572
- logcat -v time -t 500 3620
- logcat -v time -t 500 3679
- logcat -v time -t 500 3727
- logcat -v time -t 500 3775
- logcat -v time -t 500 3840
- logcat -v time -t 500 3888
- logcat -v time -t 500 3936
Loads the following dynamic libraries:
- Bugtags
- LanSongffmpeg
- libjiagu-917064677
Uses the following algorithms to encrypt data:
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- DES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).