Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) av1.x####.com:443
DNS requests:
- 7f5e492####.bug####.cn
- av1.x####.com
- i.t####.com
File system changes:
Creates the following files:
- /data/data/####/1555082232850_2296
- /data/data/####/1555082232885_2296
- /data/data/####/1555082232941_2296
- /data/data/####/1555082233601_2351
- /data/data/####/1555082233689_2351
- /data/data/####/1555082234385_2401
- /data/data/####/1555082234451_2401
- /data/data/####/1555082237464_2461
- /data/data/####/1555082237527_2461
- /data/data/####/1555082238239_2511
- /data/data/####/1555082238962_2559
- /data/data/####/1555082240959_2619
- /data/data/####/1555082241614_2667
- /data/data/####/1555082242299_2715
- /data/data/####/1555082243701_2773
- /data/data/####/1555082244428_2821
- /data/data/####/1555082245113_2869
- /data/data/####/1555082247595_2928
- /data/data/####/1555082248462_2976
- /data/data/####/1555082249208_3024
- /data/data/####/1555082252986_3083
- /data/data/####/1555082253777_3131
- /data/data/####/1555082254530_3179
- /data/data/####/1555082256084_3237
- /data/data/####/1555082256903_3285
- /data/data/####/1555082257607_3333
- /data/data/####/1555082261127_3392
- /data/data/####/1555082261909_3440
- /data/data/####/1555082262678_3488
- /data/data/####/1555082266465_3546
- /data/data/####/1555082267239_3595
- /data/data/####/1555082267996_3643
- /data/data/####/1555082269671_3703
- /data/data/####/1555082271119_3751
- /data/data/####/1555082271902_3799
- /data/data/####/1555082273451_3858
- /data/data/####/1555082274323_3906
- /data/data/####/1555082275194_3954
- /data/data/####/1555082277288_4013
- /data/data/####/1555082278055_4061
- /data/data/####/1555082278851_4109
- /data/data/####/1555082282498_4166
- /data/data/####/1555082283262_4214
- /data/data/####/1555082284077_4262
- /data/data/####/1555082287895_4319
- /data/data/####/1555082288727_4365
- /data/data/####/1555082289536_4411
- /data/data/####/MultiDex.lock
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/TDpref_longtime.xml
- /data/data/####/TDpref_longtime0.xml
- /data/data/####/journal.tmp
- /data/data/####/libjiagu-917064677.so
- /data/data/####/multidex.version.xml
- /data/data/####/tdid.xml
- /data/media/####/.nomedia
- /data/media/####/.tcookieid
Miscellaneous:
Executes the following shell scripts:
- getprop
- logcat -v time -t 500 2296
- logcat -v time -t 500 2351
- logcat -v time -t 500 2401
- logcat -v time -t 500 2461
- logcat -v time -t 500 2511
- logcat -v time -t 500 2559
- logcat -v time -t 500 2619
- logcat -v time -t 500 2667
- logcat -v time -t 500 2715
- logcat -v time -t 500 2773
- logcat -v time -t 500 2821
- logcat -v time -t 500 2869
- logcat -v time -t 500 2928
- logcat -v time -t 500 2976
- logcat -v time -t 500 3024
- logcat -v time -t 500 3083
- logcat -v time -t 500 3131
- logcat -v time -t 500 3179
- logcat -v time -t 500 3237
- logcat -v time -t 500 3285
- logcat -v time -t 500 3333
- logcat -v time -t 500 3392
- logcat -v time -t 500 3440
- logcat -v time -t 500 3488
- logcat -v time -t 500 3546
- logcat -v time -t 500 3595
- logcat -v time -t 500 3643
- logcat -v time -t 500 3703
- logcat -v time -t 500 3751
- logcat -v time -t 500 3799
- logcat -v time -t 500 3858
- logcat -v time -t 500 3906
- logcat -v time -t 500 3954
- logcat -v time -t 500 4013
- logcat -v time -t 500 4061
- logcat -v time -t 500 4109
- logcat -v time -t 500 4166
- logcat -v time -t 500 4214
- logcat -v time -t 500 4262
- logcat -v time -t 500 4319
- logcat -v time -t 500 4365
- logcat -v time -t 500 4411
Loads the following dynamic libraries:
- Bugtags
- LanSongffmpeg
- libjiagu-917064677
Uses the following algorithms to encrypt data:
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- DES-CBC-PKCS5Padding
Accesses the ITelephony private interface.
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
