Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) vc.m####.com:80
- TCP(HTTP/1.1) ap####.v0.m####.com:80
- TCP(HTTP/1.1) imgal####.res.m####.com:80
- TCP(HTTP/1.1) x.da.m####.com:80
- TCP(HTTP/1.1) v2.log.hun####.com:80
- TCP(HTTP/1.1) 0####.h####.com:80
- TCP(HTTP/1.1) g####.hun####.com:80
- TCP(HTTP/1.1) use####.api.max.####.com:80
- TCP(HTTP/1.1) pl####.log.hun####.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) www.qchann####.cn:80
- TCP(HTTP/1.1) d####.t####.m####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) com####.m####.com:80
- TCP(HTTP/1.1) rc.m####.com:80
- TCP(HTTP/1.1) st.bz.m####.com:80
- TCP(HTTP/1.1) log.v2.hun####.com:80
- TCP(HTTP/1.1) hun####.m.cn.####.com:80
- TCP(HTTP/1.1) o####.ar####.api.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) log.rc.hun####.com:80
- TCP(HTTP/1.1) vhun####.adma####.com.cn:80
- TCP(HTTP/1.1) o####.ac####.api.####.com:80
- TCP(HTTP/1.1) 1####.h####.com:80
- TCP(HTTP/1.1) mo####.api.hun####.com:80
- TCP(HTTP/1.1) res####.a####.com:80
- TCP(HTTP/1.1) mo####.log.hun####.com:80
- TCP(HTTP/1.1) m####.api.m####.com:80
- TCP(HTTP/1.1) x.da.hun####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) mob.bz.m####.com:80
- TCP(HTTP/1.1) log.da.hun####.com:80
- TCP(HTTP/1.1) mob####.api.hun####.com:80
- TCP(HTTP/1.1) cou####.pe####.m####.com:80
- TCP(HTTP/1.1) y.da.hun####.com:80
- TCP(HTTP/1.1) s5.hun####.com:80
- TCP(TLS/1.0) qq.i####.com:443
- TCP sdk.o####.t####.####.com:5224
- TCP t####.nz4.ig####.com:5224
- TCP 43.2####.145.10:5226
DNS requests:
- 0####.h####.com
- 1####.h####.com
- 2####.h####.com
- 3####.h####.com
- 4####.h####.com
- 7j####.c####.z0.####.com
- a####.u####.com
- ap####.v0.m####.com
- api####.a####.com
- c-h####.g####.com
- com####.m####.com
- cou####.pe####.m####.com
- d####.t####.m####.com
- g####.hun####.com
- hun####.m.cn.####.com
- imgal####.res.m####.com
- log.da.hun####.com
- log.rc.hun####.com
- log.v2.hun####.com
- m####.api.m####.com
- m.i####.com
- mo####.api.hun####.com
- mo####.log.hun####.com
- mob####.api.hun####.com
- mob.bz.m####.com
- o####.ac####.api.####.com
- o####.ar####.api.####.com
- pl####.log.hun####.com
- pub-####.qin####.com
- rc.m####.com
- s5.hun####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- st.bz.m####.com
- t####.nz4.g####.net
- t####.nz4.ge####.com
- t####.nz4.ig####.com
- use####.api.max.####.com
- v2.log.hun####.com
- v2.res.log.####.com
- vc.m####.com
- vhun####.adma####.com.cn
- www.qchann####.cn
- x.da.hun####.com
- x.da.m####.com
- y.da.hun####.com
HTTP GET requests:
- 0####.h####.com/preview/cms_icon/2019/1/6/01/20190106123248013.jpg_130x1...
- 0####.h####.com/preview/cms_icon/2019/2/22/02/20190222224247666.jpg_750x...
- 0####.h####.com/preview/cms_icon/2019/2/25/02/20190225095257853.gif
- 0####.h####.com/preview/cms_icon/2019/2/25/02/20190225101925702.jpg_750x...
- 0####.h####.com/preview/internettv/sp_images/ott/2016/dianying/110269/20...
- 0####.h####.com/preview/internettv/sp_images/ott/2018/11/23/dianying/324...
- 0####.h####.com/preview/internettv/sp_images/ott/2018/11/26/zongyi/32722...
- 0####.h####.com/preview/sp_images/2018/zongyi/323564/4457296/20180709091...
- 0####.h####.com/preview/sp_images/2019/2/1/zongyi/328291/5094592/2019020...
- 0####.h####.com/preview/sp_images/2019/2/23/zongyi/327491/5210606/201902...
- 0####.h####.com/preview/sp_images/2019/2/23/zongyi/327491/5210611/201902...
- 0####.h####.com/preview/sp_images/2019/2/25/zongyi/328291/5219178/201902...
- 0####.h####.com/preview/sp_images/2019/2/26/zongyi/328308/5221479/201902...
- 1####.h####.com/preview/cms_icon/2019/1/6/01/20190106123235829.jpg_130x1...
- 1####.h####.com/preview/cms_icon/2019/1/6/01/20190106123329836.jpg_130x1...
- 1####.h####.com/preview/cms_icon/2019/2/13/02/20190213095329269.jpg_130x...
- 1####.h####.com/preview/cms_icon/2019/2/21/02/20190221200441426.jpg_750x...
- 1####.h####.com/preview/cms_icon/2019/2/22/02/20190222165854695.png_130x...
- 1####.h####.com/preview/cms_icon/2019/2/24/02/20190224231127808.jpg_750x...
- 1####.h####.com/preview/cms_icon/2019/2/26/02/20190226103105553.gif
- 1####.h####.com/preview/cms_icon/2019/2/26/02/20190226111832964.jpg_750x...
- 1####.h####.com/preview/internettv/sp_images/ott/2018/dianying/324078/20...
- ap####.v0.m####.com/buffer.php?td=####&net=####&istry=####&aver=####&tim...
- ap####.v0.m####.com/hb.php?ht=####&net=####&istry=####&aver=####&time=##...
- ap####.v0.m####.com/pv.php?nt=####&cpid=####&md=####&tst=####&gps=####&s...
- ap####.v0.m####.com/pv.php?nt=####&ftl=####&cpid=####&md=####&tst=####&g...
- com####.m####.com/video_comment/getcount?type=####&subject_id=####
- cou####.pe####.m####.com/message/poll?uid=####&osVersion=####&did=####&m...
- d####.t####.m####.com/vod.do?arange=####&fid=####&gsid=####&pm=####&ver=...
- d####.t####.m####.com/vod.do?fid=####&gsid=####&pm=####&svrip=####&ver=#...
- d####.t####.m####.com/vod.do?fid=####&gsid=####&pm=####&ver=####&chk=####
- g####.hun####.com/mobile/distribute.do?deviceid=####
- hun####.m.cn.####.com/x/k=2113704&p=7MOF7&dx=0&rt=2&ns=95.211.190.198&ni...
- imgal####.res.m####.com/mediafiles/wiad_creative/1008/15506498742532.png
- imgal####.res.m####.com/mediafiles/wiad_creative/1024/15508222575001.jpg
- imgal####.res.m####.com/mediafiles/wiad_creative/1037/15508308057769.jpg
- imgal####.res.m####.com/mediafiles/wiad_creative/1221/15501171756498.jpg
- imgal####.res.m####.com/mediafiles/wiad_creative/7/15468456922527.jpg
- log.da.hun####.com/info.php?f=####&ex=####&e=####&b=####&c=####&mod=####...
- log.da.hun####.com/info.php?f=-1&ex=&e=3.400601.300600&b=1&c=1&mod=<Syst...
- log.rc.hun####.com/rpt?region=####&hitid=####&mod=####&did=####&ver=####...
- log.rc.hun####.com/rpt?region=####&mod=####&did=####&ver=####&net=####&c...
- mo####.api.hun####.com/user/getActivity?uid=####&osVersion=####&ticket=#...
- mob####.api.hun####.com/v7/video/getSource?uid=####&osVersion=####&mac=#...
- mob.bz.m####.com/channel/live?uid=####&osVersion=####&ticket=####&appVer...
- mob.bz.m####.com/odin/c1/channel/list?uid=####&osVersion=####&mac=####&o...
- mob.bz.m####.com/user/payConfig?uid=####&osVersion=####&ticket=####&appV...
- mob.bz.m####.com/v1/config/play?uid=####&osVersion=####&ticket=####&appV...
- mob.bz.m####.com/v6/search/recommend?uid=####&osVersion=####&ticket=####...
- mob.bz.m####.com/v8/video/info?uid=####&osVersion=####&mac=####&osType=#...
- o####.ac####.api.####.com/artist/getRecommendCollectArtist?uid=####&osVe...
- o####.ar####.api.####.com/artist/getArtistListByIds?artistIds=####&type=...
- o####.ar####.api.####.com/artist/getArtistListByIds?uid=####&type=####&t...
- pl####.log.hun####.com/ad.gif?os=####&app=####&d=####&error=####&cache=#...
- pl####.log.hun####.com/playerQuality.gif?first_frame_time=####&seeking_t...
- qin####.com.www.####.com/tdata_EDT369
- rc.m####.com/mobile/like?did=####&uid=####&vid=####&c=####
- rc.m####.com/mobile/rank?c=####
- rc.m####.com/mobile/rank?uid=####&osVersion=####&c=####&mac=####&osType=...
- rc.m####.com/mobile/user?uid=####&c=####&mac=####
- s5.hun####.com/channel/live?uid=####&osVersion=####&ticket=####&appVersi...
- s5.hun####.com/mobile/uip?uid=####&osVersion=####&ticket=####&appVersion...
- s5.hun####.com/recommend?uid=####&platform=####&osVersion=####&mac=####&...
- s5.hun####.com/user/payConfig?uid=####&osVersion=####&ticket=####&appVer...
- s5.hun####.com/v5/listconfig?uid=####&platform=####&osVersion=####&mac=#...
- s5.hun####.com/v7/playlist/list?clipId=####&abroad=####
- s5.hun####.com/v7/video/getSource?uid=####&osVersion=####&mac=####&osTyp...
- s5.hun####.com/v8/video/info?uid=####&osVersion=####&mac=####&osType=###...
- s5.hun####.com/v8/video/list?uid=####&appVersion=####&ticket=####&fstlvl...
- s5.hun####.com/v8/video/relative?uid=####&appVersion=####&ticket=####&fs...
- st.bz.m####.com/odin/c1/channel/index?uid=####&osVersion=####&mac=####&o...
- t####.c####.q####.####.com/tdata_AXX896
- t####.c####.q####.####.com/tdata_BAI450
- t####.c####.q####.####.com/tdata_Fus136
- ti####.c####.l####.####.com/config/bj-bjv6.conf
- ti####.c####.l####.####.com/config/hz-bjv6.conf
- use####.api.max.####.com/person5ad6eea479eeb.png@1wh_1e_1c_0o_0l_130h_13...
- use####.api.max.####.com/person5b1a4e6712024.jpg
- use####.api.max.####.com/person5b1b72e5b9d13.jpg@1wh_1e_1c_0o_0l_130h_13...
- use####.api.max.####.com/person5c357a519f6e6.jpg
- use####.api.max.####.com/person5c6cbb2e584ba.jpg
- use####.api.max.####.com/preview/cms_icon/2018/12/31/12/2018123104233493...
- use####.api.max.####.com/preview/cms_icon/2019/1/12/01/20190112142330405...
- use####.api.max.####.com/preview/cms_icon/2019/1/16/01/20190116202855613...
- use####.api.max.####.com/preview/cms_icon/2019/2/16/02/20190216233346974...
- use####.api.max.####.com/preview/cms_icon/2019/2/21/02/20190221101831820...
- use####.api.max.####.com/preview/cms_icon/2019/2/22/02/20190222102528796...
- use####.api.max.####.com/preview/cms_icon/2019/2/23/02/20190223222552856...
- use####.api.max.####.com/preview/cms_icon/2019/2/23/02/20190223223527545...
- use####.api.max.####.com/preview/cms_icon/2019/2/23/02/20190223223632379...
- use####.api.max.####.com/preview/cms_icon/2019/2/23/02/20190223223746167...
- use####.api.max.####.com/preview/cms_icon/2019/2/23/02/20190223230700265...
- use####.api.max.####.com/preview/cms_icon/2019/2/25/02/20190225103435963...
- use####.api.max.####.com/preview/cms_icon/2019/2/25/02/20190225120705158...
- use####.api.max.####.com/preview/cms_icon/2019/2/25/02/20190225213412266...
- use####.api.max.####.com/preview/cms_icon/2019/2/26/02/20190226102525067...
- use####.api.max.####.com/preview/cms_icon/2019/2/26/02/20190226114134705...
- use####.api.max.####.com/preview/internettv/sp_images/ott/2019/2/14/dian...
- use####.api.max.####.com/preview/internettv/sp_images/ott/2019/2/21/dian...
- use####.api.max.####.com/preview/internettv/sp_images/ott/2019/2/25/dian...
- use####.api.max.####.com/preview/sp_images/2018/12/25/dianshiju/323323/4...
- use####.api.max.####.com/preview/sp_images/2019/1/12/zongyi/327491/49806...
- use####.api.max.####.com/preview/sp_images/2019/1/19/zongyi/327491/50196...
- use####.api.max.####.com/preview/sp_images/2019/1/26/zongyi/327491/50604...
- use####.api.max.####.com/preview/sp_images/2019/1/5/zongyi/327491/493779...
- use####.api.max.####.com/preview/sp_images/2019/2/10/zongyi/328291/51000...
- use####.api.max.####.com/preview/sp_images/2019/2/18/dianying/328366/518...
- use####.api.max.####.com/preview/sp_images/2019/2/18/zongyi/328291/51828...
- use####.api.max.####.com/preview/sp_images/2019/2/2/zongyi/327491/510014...
- use####.api.max.####.com/preview/sp_images/2019/2/20/dianying/324267/519...
- use####.api.max.####.com/preview/sp_images/2019/2/24/zongyi/328169/52145...
- use####.api.max.####.com/preview/sp_images/2019/2/24/zongyi/328291/52107...
- use####.api.max.####.com/preview/sp_images/2019/2/25/dianying/328174/521...
- v2.log.hun####.com/info.php?f=-1&ex=&e=103000&b=1&c=1&mod=<System Proper...
- v2.log.hun####.com/info.php?f=-1&ex=&e=3.400601.300600&b=1&c=1&mod=<Syst...
- v2.log.hun####.com/info.php?f=0&ex=&e=&b=1&c=1&mod=<System Property>&a=0...
- v2.log.hun####.com/info.php?f=0&ex=&e=105000&b=1&c=1&mod=<System Propert...
- vc.m####.com/v2/dynamicinfo?uid=####&osVersion=####&mac=####&pid=####&os...
- vhun####.adma####.com.cn/i/a122297,b3199629,c1370,i0,m202,8a2,8b1,f95.21...
- vhun####.adma####.com.cn/i/a122297,b3204581,c1370,i0,m202,8a2,8b1,f95.21...
- vhun####.adma####.com.cn/i/a122558,b3179177,c1370,i0,m202,8a2,8b1,h,0a0,...
- vhun####.adma####.com.cn/i/a123033,b3191084,c1370,i0,m202,8a2,8b1,h,0a0,...
- y.da.hun####.com/app/impression?_serverip=####&adid=####&adtotal=####&ap...
- y.da.hun####.com/err?_serverip=10.43.6.232&adid=09B1D9A2057E22F6B302DEA9...
- y.da.hun####.com/err?_serverip=10.43.6.251&adid=09B1D9A2057E22F6B302DEA9...
HTTP POST requests:
- a####.u####.com/app_logs
- c-h####.g####.com/api.php?format=####&t=####
- log.da.hun####.com/v1/t
- log.v2.hun####.com/dispatcher.do
- m####.api.m####.com/mpns/parseLog
- mo####.log.hun####.com/data.cgi
- mo####.log.hun####.com/dispatcher.do
- o####.ac####.api.####.com/global/config
- o####.ar####.api.####.com/artist/getArtistListByIds
- res####.a####.com/v3/log/init
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
- vc.m####.com/v2/watch
- www.qchann####.cn/center/adj
- www.qchann####.cn/center/adj?appkey=####
- x.da.hun####.com/json/app/boot
- x.da.hun####.com/m/page
- x.da.hun####.com/video/player
- x.da.m####.com/m/page
File system changes:
Creates the following files:
- /data/data/####/-613446676
- /data/data/####/.imprint
- /data/data/####/0543bf41099dc3b78dd113e88bae033049c3bfecfe0a5ca....0.tmp
- /data/data/####/068794a08086f0e7f1c0831e8215d719b3257f04a54dc24....0.tmp
- /data/data/####/0851208cd4e251fd64eb938589a76bb50aaac2978825539....0.tmp
- /data/data/####/0b6a693552bc678947dd8beae0a93de4
- /data/data/####/0cd40279c60b
- /data/data/####/1172516e70003030926c10fbb463cf0955ee12f11cc5681....0.tmp
- /data/data/####/11f6997292052eed3f5867b697c2b3d641f97745ad072d6....0.tmp
- /data/data/####/16cc43660839b8b9d46fcda954851c0bad4fad5f0fa11a0....0.tmp
- /data/data/####/1703720991
- /data/data/####/18d3d83b3bef2deb4fd1d7c18305cbd280d5132318cbc1c....0.tmp
- /data/data/####/1a71a633bd9c413f200ac7e3818ffffb36ab0546d0b0ba5....0.tmp
- /data/data/####/1b3962ed09bbc3f09aa3997d15c63f5aded0154df5bfe87....0.tmp
- /data/data/####/1d66ceeb08d0d65d88d0605514c1794257b3352435c402e....0.tmp
- /data/data/####/1f1e43cb277b380c0e91f7281c6c6e408edf97cbc3897b2....0.tmp
- /data/data/####/2068cb5908d333a42a9a19e2bb1c188233eaf087863f651....0.tmp
- /data/data/####/2150e31d5b64c359a27b2433c6837172a800589a01a389b....0.tmp
- /data/data/####/257306020
- /data/data/####/257306024
- /data/data/####/257306028
- /data/data/####/25f85cc3a84db04eec79ee332da6e94582ae015cf8fbbd3....0.tmp
- /data/data/####/27d3d6a657c7a341f8260cb453723b0b726375bf7b42ef2....0.tmp
- /data/data/####/2c389a773f9d35f6553c180ca6e005862963a8eff25de0b....0.tmp
- /data/data/####/31e56e948fa7cf368678c3e7c8874f8d
- /data/data/####/3900036301a28c398b5d2a7321d1f18cf70fa64dee81b11....0.tmp
- /data/data/####/3bb8e6906aec37151c50961ccb4258af582dddf251dcf92....0.tmp
- /data/data/####/3bb8e6906aec37151c50961ccb4258af582dddf251dcf92...849f.0
- /data/data/####/3c6686afaa90e59f2aeaacb637fdde6b830e469e99a9d03....0.tmp
- /data/data/####/3e304289cd3b71103d37ee2fb132cfb0037512e71267254....0.tmp
- /data/data/####/3e6a6bc59b6749b2896b95ffedb297f703321ea92569620....0.tmp
- /data/data/####/3f5b096b526aa368f9c00071c31afe652d6e246d4e371e5....0.tmp
- /data/data/####/50cc4c92e6fb0054182188b2a80dfa221a24b815d522c3b....0.tmp
- /data/data/####/5796c09760a619f3e9c83dd9b62cd8477b677bae9d0eecd....0.tmp
- /data/data/####/5839cabc62b6c9a64730dda79993f45c111d4b63133b82b....0.tmp
- /data/data/####/5ab5b13ac77af8bf8b26867dd58a07e2
- /data/data/####/5dc99528c0de72033cd2d2b9b8940221d752b319ddaa421....0.tmp
- /data/data/####/5f12c3dcfc877b513ca985142a540244b69d0c7eec75adc....0.tmp
- /data/data/####/60058bfaddd3e9804380e0168fec312c436548fac1516e5....0.tmp
- /data/data/####/614108960
- /data/data/####/6164488808ecdfe1bb669cf1488d6e4f
- /data/data/####/6b338b463eb76067ee5395160ece52fbb457acdb68bd0d7....0.tmp
- /data/data/####/6c5221835323632aa62c3ac1bac874c6fc249bd74786fc3....0.tmp
- /data/data/####/6d124718f7112b8289bd39ac6da4354d
- /data/data/####/6dcfc14fc0a1f1cfab39612875e903be4ed5257fecc2254....0.tmp
- /data/data/####/7115a56b634554a215dea44ee35ec98cbb6dbff42b37696....0.tmp
- /data/data/####/723a1f6b785a35a4cb80c0f9f6846454e75316b718a6a48....0.tmp
- /data/data/####/72e8daac210fe3f20158e4f0ff67553baa67394275b263f....0.tmp
- /data/data/####/787d6b1efdea523aa306c381792e470dd963dc83ccdbb9b....0.tmp
- /data/data/####/78f00f061ce427e44ef1e19030846a2515b20c83d9c2bc7....0.tmp
- /data/data/####/836778da596e23cd2f1c8c3634175706
- /data/data/####/863e565cf7fa1ecac269410540e7cc09a90d6326bf8472e....0.tmp
- /data/data/####/8709dd38e8955b4b4083b955af8642b25de2545812b11cf....0.tmp
- /data/data/####/877ed68cd646db34c925decf89afa74164ea5632606c7c5....0.tmp
- /data/data/####/8d9ab2c174ba64317399f3efee923d7e96f6ad24311114e....0.tmp
- /data/data/####/933978904
- /data/data/####/94788b87dee8f985b4ab1c94c36f74bf3167e6a2a8e60e7....0.tmp
- /data/data/####/9663ca2d36f0e2852fa2aaaa0d7828378b87a93a198d9e8....0.tmp
- /data/data/####/98a85cad5fd3823d4aac804e0468d526c61e11445d5999a....0.tmp
- /data/data/####/9a99007a18f5f90f48f9db6e42c62b2d260cc5d72d02f61....0.tmp
- /data/data/####/ImgoPad-journal
- /data/data/####/LOG_CACHE.xml
- /data/data/####/MGTVCommon.xml
- /data/data/####/MGTVCommon.xml.bak
- /data/data/####/MV3Plugin.ini
- /data/data/####/MV3Plugin_Default.ini
- /data/data/####/QT.xml
- /data/data/####/a185de0090727a9b7609565261ad74dde82f4a012570230....0.tmp
- /data/data/####/a6df66dd3923b4697d3960624d64331978f3da7ea878fa3....0.tmp
- /data/data/####/a7097c5b97b4b6a39a1c88bcf3f444818f2f7e3d37e94a5....0.tmp
- /data/data/####/a8f13e3daa5c3f9e517a52bbdfe73c208ab2b7af045aba2....0.tmp
- /data/data/####/afad00efc5f863b8959ed438a7ddac3e
- /data/data/####/afd76ea283bc613971fa190614df47b3545d992752d580b....0.tmp
- /data/data/####/arch.xml
- /data/data/####/b2b268a1a51adb9fac0873401cac3aa7797fa0ae7dedbd8....0.tmp
- /data/data/####/b41a82c7efbd5583100792b56d80fd502f5d1ce7c412646....0.tmp
- /data/data/####/ba1b99a2a4fe00913a9d3de5a20992d8e4d4ca9dfa78c32....0.tmp
- /data/data/####/bb5e5b60bc90408c0467e0143d2eb3f1075641d648d067d....0.tmp
- /data/data/####/bd35083a5a398d01839ed4812b25e91fc2246e7e3448b48....0.tmp
- /data/data/####/bdb3f16d502d9d0eb3b4ffd0a63f6b48cafcecf8993a2ec....0.tmp
- /data/data/####/c0c63c6a5142fe58c136256e58a92ecc885344594b2843d....0.tmp
- /data/data/####/c29c2101aaa798c31ece42584d091e939377c9cb945fb85....0.tmp
- /data/data/####/c4862a5a712a6b8213584caef773fcbf0715b1dad386345....0.tmp
- /data/data/####/cec6c459fcc16cb69326484307129fdcdfc4d6e4f70ca98....0.tmp
- /data/data/####/cn.com.mma.mobile.tracking.normal.xml
- /data/data/####/cn.com.mma.mobile.tracking.other.xml
- /data/data/####/d2b52fef00d26f22c77c9e1d26802697dad66d678ad842b....0.tmp
- /data/data/####/d4706934eee2058fb6244cc2dcae64e06a0893100b4fd8e....0.tmp
- /data/data/####/d48e7fb501b1cc400c71c0c4ffda78e2e05e7774c7eb5a0....0.tmp
- /data/data/####/dfb7c350221df72d031d068c4dfbd4f4c519147120e4547....0.tmp
- /data/data/####/e46292c1b0f18c24fff9cb68eb5b9f4974618f4b408e848....0.tmp
- /data/data/####/e6929cc269d974b59b7933cabff2161cf8034c380426064....0.tmp
- /data/data/####/e835ecba96a69d8907966817681b19daa030a8f8aa56991....0.tmp
- /data/data/####/e96395461ef55ff622b17cf5e549254a
- /data/data/####/e9a1b05bd169d1286fe9de76da3be646
- /data/data/####/ecf27cc50247e091ddfc92e4e426e1e8f1ab858ae423384....0.tmp
- /data/data/####/ee169f8d9e19d04c55d9aff740922ae6209b3d738686a44....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/f4a1f088283c5245f93f30a484361e6d0e6933867a4d258....0.tmp
- /data/data/####/f6650b9be9142ba3b6ed9cf48d622f68ac8bae407ff66e6....0.tmp
- /data/data/####/f7158c968bd35e84e32a2b76dbb7a9284f99042f6dad66b....0.tmp
- /data/data/####/fa1629df98e17587b212d009a4ecf547ba8e7910d0bb8f0....0.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/gx_sp.xml
- /data/data/####/hmt_agent_commonutill_com.biyan.tv.chaoqing.xml
- /data/data/####/hmt_agent_commonutill_device_id.xml
- /data/data/####/hmt_agent_online_setting_com.biyan.tv.chaoqing.xml
- /data/data/####/hmt_analytics
- /data/data/####/hmt_analytics-journal
- /data/data/####/hmt_init_savetime.xml
- /data/data/####/hmt_irsuid.xml
- /data/data/####/hmt_session_id.xml
- /data/data/####/hmt_session_id_savetime.xml
- /data/data/####/hmt_session_id_savetime.xml.bak
- /data/data/####/hmt_session_id_savetime.xml.bak (deleted)
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/last_know_location.xml
- /data/data/####/libjiagu156545740.so
- /data/data/####/multidex.version.xml
- /data/data/####/openudid_prefs.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qtsession.xml
- /data/data/####/root.db-journal
- /data/data/####/run.pid
- /data/data/####/tdata_AXX896
- /data/data/####/tdata_AXX896.jar
- /data/data/####/tdata_BAI450
- /data/data/####/tdata_BAI450.jar
- /data/data/####/tdata_Fus136
- /data/data/####/tdata_Fus136.jar
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_general_config.xml.bak (deleted)
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/media/####/.nomedia
- /data/media/####/1_log.txt
- /data/media/####/32375ea60a6f2fe367a1dcc3305788ce
- /data/media/####/4908afc5705af2314b4ef8095ffbac66
- /data/media/####/54a3f6f36a889d3aa1fc9644de20d9c3
- /data/media/####/7262ae080973b0b4972f2f428fd5f643
- /data/media/####/82217c5417edaf9b081a92e72a264178
- /data/media/####/8e7f6b68a2c0118683df0c8e122d00eb
- /data/media/####/AN.csv-20190226100806
- /data/media/####/APITimeMark.txt
- /data/media/####/TruthInfo.csv-1551175687228
- /data/media/####/UA.csv-20190226100808
- /data/media/####/UnicomTrafficFree.log
- /data/media/####/apge.csv-20190226100821
- /data/media/####/apge.csv-20190226100854
- /data/media/####/app.db
- /data/media/####/bf492e7f86b8f6c9b05f1cb2f067b1f7
- /data/media/####/com.biyan.tv.chaoqing.bin
- /data/media/####/com.biyan.tv.chaoqing.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/e10b98902f1eb494a60bf93f5cb2b905
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/journal.tmp
- /data/media/####/qt.csv.1551175683432.txt
- /data/media/####/tdata_AXX896
- /data/media/####/tdata_BAI450
- /data/media/####/tdata_Fus136
- /data/media/####/test.log
- /data/media/####/uuid
Miscellaneous:
Executes the following shell scripts:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.hunantv.imgo.service.GetuiPushService 25064 300 0
- cat /proc/cpuinfo
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- mount
Loads the following dynamic libraries:
- CdnAuth
- ImgoFfmpeg
- ImgoHelp
- ImgoMediaPlayer_V3.0.3
- MMANDKSignature
- getuiext2
- libjiagu156545740
Uses the following algorithms to encrypt data:
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Uses the following algorithms to decrypt data:
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Gets information about running apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
