Adware.Gexin.17285

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
UDP(DNS) 1####.29.29.29:53
TCP(HTTP/1.1) qfy.innot####.com:80
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) cfg.a####.com:80
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.1####.com:80
TCP(HTTP/1.1) h####.1####.com:80
TCP(HTTP/1.1) m####.3g.qq.com:80
TCP(HTTP/1.1) log.1####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) i####.1####.com:80
TCP(HTTP/1.1) qfc.innot####.com:80
TCP(HTTP/1.1) apk.1####.com:80
TCP(HTTP/1.1) rcv.a####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) ddd.1####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) st####.1####.com.####.com:80
TCP(TLS/1.0) upd####.a####.com:443
TCP(TLS/1.0) api.shu####.cn:443
TCP(TLS/1.0) l####.cmpass####.com:9443
TCP(TLS/1.0) h####.1####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) co####.cmpass####.com:443
TCP(TLS/1.0) cdn.a####.com.####.com:443
TCP(TLS/1.0) api.1####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) dai.shu####.cn:443
TCP(TLS/1.0) api.w####.com:443
TCP(TLS/1.0) recall-####.1####.com:443
TCP(TLS/1.0) static####.qutou####.net:443
TCP(TLS/1.0) message####.1####.com:443
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.ig####.com:5226
UDP 1####.168.119.1:137

DNS requests:

7j####.c####.z0.####.com
a####.man.aliy####.com
amap####.cn-hang####.oss####.####.com
and####.b####.qq.com
api.1####.com
api.shu####.cn
api.w####.com
apk.1####.com
c-h####.g####.com
cdn.a####.com
cfg.a####.com
cm-1####.ig####.com
co####.cmpass####.com
cpc-st####.1####.com
daa.shu####.cn
dai.shu####.cn
ddd.1####.com
h####.1####.com
i####.1####.com
l####.cmpass####.com
l####.tbs.qq.com
log.1####.com
m####.3g.qq.com
message####.1####.com
qfc.innot####.com
qfy.innot####.com
rcv.a####.com
recall-####.1####.com
res####.a####.com
sdk-glo####.a####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
st####.1####.com
static####.qutou####.net
upd####.a####.com

HTTP GET requests:

api.1####.com/activity/getActivityCardList?platform=####&lon=####&tuid=#...
api.1####.com/app/coldStart?lon=####&tuid=####&device_code=####&OSVersio...
api.1####.com/app/coldStart?lon=####&tuid=####&device_code=####&plugins=...
api.1####.com/app/getAdConfig?lon=####&tuid=####&device_code=####&OSVers...
api.1####.com/app/getCloudPluginV3?os=####&lon=####&tuid=####&device_cod...
api.1####.com/app/getConfig?lon=####&tuid=####&device_code=####&OSVersio...
api.1####.com/app/getGuide?lon=####&tuid=####&device_code=####&OSVersion...
api.1####.com/app/getResource?os=####&lon=####&tuid=####&device_code=###...
api.1####.com/app/start?model=####&tuid=####&OSVersion=####&from=####&tk...
api.1####.com/component/getFeComponentInfo?name=####&currtime=####&sign=...
api.1####.com/content/getDefaultChannelList?lon=####&tuid=####&device_co...
api.1####.com/remain/getIncreaseRead?lon=####&tuid=####&device_code=####...
apk.1####.com/qukan_resource_emoji_244_302.apk
cfg.a####.com/reqMotPkgLst
h####.1####.com/qukan_resource_emoji_244_302.apk
h####.1####.com/qukan_resource_level_897_295.apk
h####.1####.com/search_middle/release/middle/static/release/middle.zip?l...
i####.1####.com/module_detail/release/template/release/static/template.z...
i####.1####.com/module_detail/release/template/release/static/template.zip
i####.1####.com/module_detail/release/video/release/static/template.zip
i####.1####.com/module_detail/release/video/release/static/template.zip....
log.1####.com/a.gif?lon=####&tuid=####&device_code=####&OSVersion=####&d...
log.1####.com/a.gif?tuid=####&OSVersion=####&tk=####&network=####&versio...
q####.c####.l####.####.com/config/hz-hzv6.conf
q####.c####.l####.####.com/tdata_LRe817
q####.c####.l####.####.com/tdata_OxN092
q####.c####.l####.####.com/tdata_bca864
q####.c####.l####.####.com/tdata_yFl369
rcv.a####.com/trace?op1=####&op2=####&op3=####&opt_v=####&t=####
st####.1####.com.####.com/image/sp/2019/06/04/5cf5d99d6d9c7.png
st####.1####.com.####.com/image/sp/2019/08/18/5d583d539b000.jpg?imageVi#...
st####.1####.com.####.com/image/sp/2019/08/18/5d583d539caec.jpg?imageVi#...
st####.1####.com.####.com/image/sp/2019/08/18/5d583d539d18b.jpg?imageVi#...
st####.1####.com.####.com/lw/img/2019/08/12/6d4a421d83103874fa8eff0cf306...
st####.1####.com.####.com/lw/img/2019/08/12/8dcc4b04b7ad5c67c6c7de165925...
st####.1####.com.####.com/lw/img/2019/08/12/e7fa96cb1de91a9bcd8bd12340eb...
st####.1####.com.####.com/lw/img/2019/08/17/189c5b473db1584180580cd07836...
st####.1####.com.####.com/qupost/avatar/2017/07/26/e9de955dc5c6fd6f084b1...
st####.1####.com.####.com/qupost/avatar/2018/03/13/824e4a3b67ca60762da5d...
st####.1####.com.####.com/qupost/images/2019/08/17/1566002920458354815.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566032408381120218.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566032408528556082.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566032408532207764.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566033634118411458.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566033634147711381.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566033634190939762.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566049089695897931.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566049102985388497.j...
st####.1####.com.####.com/qupost/images/2019/08/17/1566049112632284347.j...

HTTP POST requests:

and####.b####.qq.com/rqd/async?aid=####
api.1####.com/app/extendReport
api.1####.com/member/isDeviceReport
api.1####.com/operate/resource/openScreen
c-h####.g####.com/api.php?format=####&t=####
cfg.a####.com/req?aid=####
ddd.1####.com/report
l####.tbs.qq.com/ajax?c=####&k=####
m####.3g.qq.com/
qfc.innot####.com/report/v1
qfy.innot####.com/report/v1
sdk-ope####.g####.com/api.php?format=####&t=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.jg.ic
/data/data/####/0df678a7f3143bbd019b845ec9cebd2d
/data/data/####/1004
/data/data/####/1273315c98dc93daad755a2deb80e7a9bf615f2ff19c07e....0.tmp
/data/data/####/31a73eea107bed3e40b7a714fd388e8dad034a5f1ebcf54....0.tmp
/data/data/####/33dc66fec7e7ba152c7b57c1582d22a3
/data/data/####/3bc2a9c98575c5b0f15dc44155ddaba8
/data/data/####/4077e5503ef4b24525f37558ff2a91f7
/data/data/####/4f6f7cce76c1c7ae2c90613d6118ab55e0b5026f057a543....0.tmp
/data/data/####/53e04345727d00ad66c79d76867af6234c33a177855e6be....0.tmp
/data/data/####/578B62A16DA3AC930921316D40FC750B.so
/data/data/####/5c0251ab95b2fe23d91eaca169a1aa10d5d6cc89668a2a4....0.tmp
/data/data/####/5c5618199b769ea76111c72c1159d02f
/data/data/####/5c5618199b769ea76111c72c1159d02f.tmp
/data/data/####/5da5b3044a11caadb5089407d32a17d396c86de2c93b351....0.tmp
/data/data/####/7df06928118406ec392296de37d370838622f482f5dc61a....0.tmp
/data/data/####/7e78d79200e8112826994e4d8aa4f911
/data/data/####/7e78d79200e8112826994e4d8aa4f911.tmp
/data/data/####/826323f8e625037fca9ee615af2eb214.ttf
/data/data/####/8b80d1f1454364d02480201d347645e9e34492d1cc60850....0.tmp
/data/data/####/94d629bb19e544eb9f015c7121178dfa63d273a01d6beaf....0.tmp
/data/data/####/9f35e08a2dfd48e4863e906f61dcf7c6dd4b2968b1ec656....0.tmp
/data/data/####/ACCS_SDK.xml
/data/data/####/ACemark.i
/data/data/####/ACopenid.i
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/InnoEndTime.i
/data/data/####/Inno_xjl.i
/data/data/####/MessageStore.db
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db
/data/data/####/MsgLogStore.db-journal
/data/data/####/QK_room
/data/data/####/QK_room-journal
/data/data/####/QK_room-shm
/data/data/####/QK_room-wal
/data/data/####/SupportABImpl.xml
/data/data/####/T-75Z-FaSJDyxNVErZEtlU_QTIrBMZ1o
/data/data/####/T-V6Er7SuoZgkRJLQ6vNDkEtNoWkZt-j
/data/data/####/T-ukRKACpnHAB_EorpW9METwDUSAbCVO
/data/data/####/T028wkAM3VyUSw9JCbkA0EnfRRHVLMKy
/data/data/####/T1534EOcemlex7SAjre4Y0VQAOgxwq9L
/data/data/####/T2tdab1OXEoPV2LPHbUXb0q-iC-V36bW
/data/data/####/T3A-U2w7ii_SsnUNZohFpE0WmhSTaNy1
/data/data/####/T3N1smi-PH0Il3ZsrJDRskhcboJyk9cZ
/data/data/####/T4FDeNV0CSkqdQ3VKJdYk0hMVPBpBKm_
/data/data/####/T4HhGA-HFmECKOUao6VnsEFv2gTyvNHB
/data/data/####/T4I1DvO4vGP-JX9I9Lx2U0dLHnBLPw1j
/data/data/####/T4gL1yWy4AJLMO1iJIksuUYpSuTu87xv
/data/data/####/T5Tl4kgtCQYVm5YU8LkapkS5zFjSfYC9
/data/data/####/T7lz3BAV7fE1its3xrXDqkOZDBWhLrWK
/data/data/####/T7reJE0BvtPIxx_yXaUw4ki7qOACzkVA
/data/data/####/T9qD8xzEmmSyWZlYH41RqkjUgus0wB8x
/data/data/####/TMSPropertiesb_d_pre.xml
/data/data/####/TMSPropertiesw_s_c.xml
/data/data/####/T_6Ot1Uc5OgDwcMYj40_-0AhCOkG65dF
/data/data/####/T_9o37GLyaisGYPAobTt20_GXhmWHFMi
/data/data/####/TwWsfD1yZRuUUO4uAocArkvNacpJslFx
/data/data/####/TyXvhf41YX-YKEPSHY0hTUGoHSp3-qKg
/data/data/####/TyYE6jJ73od7EpJS6JfJxk7eMVrfbakG
/data/data/####/_aisdk_local.dex
/data/data/####/_aisdk_local.jar
/data/data/####/_aisdk_remote.jar
/data/data/####/_s_base_switch.xml
/data/data/####/a4924e836173cf7fc28a31a39d60ef9d4e6913d480e05d0....0.tmp
/data/data/####/a9400f1d69ce074a74ad9d773117d3335dd6183d0f559af....0.tmp
/data/data/####/accs.db
/data/data/####/accs.db-journal
/data/data/####/adfa04472e77aac424f5b0eb780b98bfb404e321a60aab6....0.tmp
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/appRunTime.i
/data/data/####/avatar_default-5610d054.png
/data/data/####/ba32c19d7e3856110f62d20bc036264d.0.tmp
/data/data/####/ba32c19d7e3856110f62d20bc036264d.1.tmp
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/c1e7916b2395039ae326f75c821ac5cd9d2518866cfec3c....0.tmp
/data/data/####/c8404d2c0186f69f899217b49e1013a3c92370db328a3b5....0.tmp
/data/data/####/cmd_data_tracker_v2.db
/data/data/####/cmd_data_tracker_v2.db-journal
/data/data/####/cmd_data_tracker_v2.db_pushservice
/data/data/####/cmd_data_tracker_v2.db_pushservice-journal
/data/data/####/com.iclicash.advlib.xml
/data/data/####/com.iclicash.advlib.xml.bak (deleted)
/data/data/####/com.jifen.acReportCount.i
/data/data/####/com.jifen.acacid.i
/data/data/####/com.jifen.accuid.i
/data/data/####/com.jifen.accuid2.i
/data/data/####/com.jifen.acncuid.i
/data/data/####/com.jifen.opopenidcom.jifen.qukan.i
/data/data/####/com.jifen.qkbase.web.template.source.SourceManager.xml
/data/data/####/com.jifen.qukan.xml
/data/data/####/com.jifen.qukan.xml (deleted)
/data/data/####/com.jifen.qukan.xml.bak
/data/data/####/com.jifen.qukan.xml.bak (deleted)
/data/data/####/com.jifen.qukan_dna.xml
/data/data/####/com.jifen.qukan_prefs.xml
/data/data/####/common.536c570e.js
/data/data/####/common.56725196.js
/data/data/####/common.9c88e62c.css
/data/data/####/common.aa0a2cf4.css
/data/data/####/common.acbf1d6f.css
/data/data/####/common.f5e3c832.js
/data/data/####/config.json
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/d04a57521a2f7850152103b022e13aeccbb04ae50764026....0.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNTY2MDcxMjI4NzE1;
/data/data/####/daemon
/data/data/####/dafile.db
/data/data/####/dafile.db-journal
/data/data/####/data_tracker_v2.db
/data/data/####/data_tracker_v2.db-journal
/data/data/####/data_tracker_v2.db_pushservice
/data/data/####/data_tracker_v2.db_pushservice-journal
/data/data/####/de5b8d8b41582d2f75114de868ee3c70eabfd410118a0c3....0.tmp
/data/data/####/debug.conf
/data/data/####/dn_163
/data/data/####/download.zip
/data/data/####/download_upload
/data/data/####/e26a6d3294a07c90b350e5fd8f135bcb078cd479e37d21f....0.tmp
/data/data/####/e8b36168f13c9f58ae37509c2d9bd0b9.0.tmp
/data/data/####/e8b36168f13c9f58ae37509c2d9bd0b9.1.tmp
/data/data/####/emoji.apk
/data/data/####/emoji.cfg
/data/data/####/emoji.dex
/data/data/####/emoji.md5
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f0ae3b08c18d63bd7d38932ef8d0377b288661fa2298f66....0.tmp
/data/data/####/f4747c234b0f608a33b61a13613e44a9418a6b419aa6118....0.tmp
/data/data/####/f4747c234b0f608a33b61a13613e44a9418a6b419aa6118...6abf.0
/data/data/####/fb64117c959a735b2f7f36095560fa8ed9754568f012d15....0.tmp
/data/data/####/finch.db
/data/data/####/finch.db-journal
/data/data/####/first_page_fy.xml
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/httpdns_config_cache.xml.bak (deleted)
/data/data/####/i==1.2.0&&3.9.37.000.0806.1948_1566071227855_envelope.log
/data/data/####/ic_return-c01af319.png
/data/data/####/ic_search-a9054d83.png
/data/data/####/icon-delete-7e1541c7.png
/data/data/####/icon-history-28be26f0.png
/data/data/####/icon-hotnews-3b31a624.png
/data/data/####/icon_article-77ec0e08.png
/data/data/####/icon_close_search-bf54bcc6.png
/data/data/####/icon_hot-fccf250e.png
/data/data/####/icon_more-9568d56c.png
/data/data/####/icon_picture-03fc07e6.png
/data/data/####/icon_play-bcdf2dfb.png
/data/data/####/icon_qutoutiaohao-98fbbebd.png
/data/data/####/icon_success-fac4a5d6.png
/data/data/####/icon_video-567efe5a.png
/data/data/####/icon_vip-d40ce791.png
/data/data/####/icon_wemedia_more-897cdcb9.png
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/innoBattery.i
/data/data/####/innoBm.i
/data/data/####/innoMacs.i
/data/data/####/innoMacs.i (deleted)
/data/data/####/inno_YKsuccessTime.i
/data/data/####/inno_acidSour.i
/data/data/####/inno_acidSour.i (deleted)
/data/data/####/inno_cuidSour.i
/data/data/####/inno_dbcreat.i
/data/data/####/inno_ipv6.i
/data/data/####/inno_ipv6.i (deleted)
/data/data/####/inno_isDir.i
/data/data/####/inno_last_soFErr.i
/data/data/####/inno_ncuid.i
/data/data/####/inno_ot.i
/data/data/####/inno_soMd5.i
/data/data/####/inno_soName.i
/data/data/####/inno_successdate_nt.i
/data/data/####/innotechBlackApps.i
/data/data/####/innotechBlackFile.i
/data/data/####/innotechBlackFileVersion.i
/data/data/####/innotechBlackUp.i
/data/data/####/innotechBlackUpVersion.i
/data/data/####/innotechBlackVersion.i
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/level.apk
/data/data/####/level.dex
/data/data/####/level.md5
/data/data/####/libijkffmpeg.so
/data/data/####/libijkffmpeg.so.md5
/data/data/####/libijkplayer.so
/data/data/####/libijkplayer.so.md5
/data/data/####/libijksdl.so
/data/data/####/libijksdl.so.md5
/data/data/####/libjiagu-1385524905.so
/data/data/####/libquid.so
/data/data/####/libxyvodsdk.so
/data/data/####/libxyvodsdk.so.md5
/data/data/####/lite_qkbase.xml
/data/data/####/loading-6525f20e.gif
/data/data/####/local_crash_lock
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/main_metadata
/data/data/####/main_metadata.bak
/data/data/####/middle.0b932444.css
/data/data/####/middle.a4ab3173.js
/data/data/####/middle.html
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/noactivity-eaac7382.png
/data/data/####/noresult-e375458a.png
/data/data/####/open_screen_image.png
/data/data/####/pdm.db
/data/data/####/pdm.db-journal
/data/data/####/pref.xml
/data/data/####/proc_monitor_local_rec_main.xml
/data/data/####/proc_monitor_local_rec_push.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/qk_app.xml
/data/data/####/qk_app.xml.bak
/data/data/####/qk_app.xml.bak (deleted)
/data/data/####/qk_app_optsp.xml
/data/data/####/qk_push_sp.xml
/data/data/####/qk_push_sp.xml.bak (deleted)
/data/data/####/run.pid
/data/data/####/search_middle.zip
/data/data/####/security_info
/data/data/####/so.zip
/data/data/####/ssoconfigs.xml
/data/data/####/statistic_all_new_log.db
/data/data/####/statistic_all_new_log.db-journal
/data/data/####/statistic_all_new_log.db_pushservice
/data/data/####/statistic_all_new_log.db_pushservice-journal
/data/data/####/sys_log_1566071197255299.txt
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_LRe817
/data/data/####/tdata_LRe817.jar
/data/data/####/tdata_OxN092
/data/data/####/tdata_OxN092.jar
/data/data/####/tdata_bca864
/data/data/####/tdata_bca864.jar
/data/data/####/tdata_yFl369
/data/data/####/tdata_yFl369.jar
/data/data/####/temp_jclip.i
/data/data/####/temp_ogrder.i
/data/data/####/temp_ogvd.i
/data/data/####/temp_ogver.i
/data/data/####/tempfile
/data/data/####/template.47713dc8.css
/data/data/####/template.65ab0161.css
/data/data/####/template.8405f2b4.js
/data/data/####/template.c3a45211.js
/data/data/####/template.html
/data/data/####/timer_ab.xml
/data/data/####/timer_rewards.xml
/data/data/####/tmsdk_dualsim_shark.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/vendor.0678e785.js
/data/data/####/webview.db
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/weibo_sdk_aid1
/data/data/####/wifi_signal_table
/data/data/####/wifi_signal_table-journal
/data/data/####/zipPre.bfde96c6.js
/data/media/####/.2e1b3.openidcom.jifen.qukan
/data/media/####/.48504.acid
/data/media/####/.5454a.openidcom.jifen.qukan
/data/media/####/.79594.cuid2
/data/media/####/.80662.acid
/data/media/####/.8e8b2.ncuid
/data/media/####/.98ff3.cuid2
/data/media/####/.98ff3.openidcom.jifen.qukan
/data/media/####/._android.dat
/data/media/####/._driver.dat
/data/media/####/._system.dat
/data/media/####/.aio.dat
/data/media/####/.b11dd.cuid
/data/media/####/.b11dd.cuid2
/data/media/####/.c3418.acid
/data/media/####/.com.jifen.ac.ReportCount
/data/media/####/.com.jifen.ac.acid
/data/media/####/.com.jifen.ac.cuid
/data/media/####/.com.jifen.ac.cuid2
/data/media/####/.com.jifen.ac.ncuid
/data/media/####/.com.jifen.op.openidcom.jifen.qukan
/data/media/####/.e84e3.cuid
/data/media/####/.e84e3.ncuid
/data/media/####/.e8b74.cuid
/data/media/####/.nomedia
/data/media/####/.quid
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/a38579f9747b93a04b757e18de46a51c
/data/media/####/aio.dat
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/app.db
/data/media/####/cf_lk_2.dat
/data/media/####/cf_st_2.dat
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.jifen.qukan.bin
/data/media/####/com.jifen.qukan.db
/data/media/####/crash-2019-08-17.log
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/tbslog.txt
/data/media/####/tdata_LRe817
/data/media/####/tdata_OxN092
/data/media/####/tdata_bca864
/data/media/####/tdata_yFl369
/data/media/####/test.log

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.jifen.framework.push.getui.GTCoreService 24479 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/app_bin/daemon
chmod 700 <Package Folder>/files/gdaemon_20161017
date
df
getprop
getprop net.hostname
getprop persist.service.bdroid.bdaddr
getprop ro.boot.bootloader
getprop ro.boot.boottime
getprop ro.build.date.utc
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.product.cpu.abi2
getprop ro.recovery_id
getprop ro.runtime.firstboot
getprop ro.serialno
getprop ro.smartisan.version
getprop ro.vivo.os.version
id
logcat -d -v threadtime
ls -i
ls -l
ls -l /system/xbin/su
ls /dev/socket
ls /sys/class/thermal
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
mount
ps
service call iphonesubinfo 1
sh
sh -c cat
sh -c cat /etc/sensor_def_hh.conf
sh -c cat /proc/devices
sh -c cat /proc/meminfo
sh -c cat /proc/mounts
sh -c cat /proc/partitions
sh -c cat /proc/self/maps
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /system/ && stat etc
sh -c cd /acct && ls -i
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/ && stat net
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /sys/devices/system/cpu/cpu0/cpufreq/ && stat cpuinfo_max_freq
sh -c cd /sys/kernel/debug && ls -i
sh -c cd /system && stat app
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd /system/bin/ && stat cat
sh -c cd <SD-Card>/ && ls -i
sh -c echo NEEzRTgzRkU0QjRFNzM5MjBGODg4NkE1MjUwRTk3MDI5ODMzM0Q6RDg0NEY1OjBBQURDOA== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo NEEzRTgzRkU0QjRFNzM5MjBGODg4NkE1MjUwRTk3MDI5ODMzM0Q6RDg0NEY1OjBBQURDOA== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo OEY5QTY2MDEzMjI2MERBQzBGRTcyREJBNTQ0OUQ3QzUxNDg2MkY6OUI0NjcwOkU3QkQ5Mw== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo OEY5QTY2MDEzMjI2MERBQzBGRTcyREJBNTQ0OUQ3QzUxNDg2MkY6OUI0NjcwOkU3QkQ5Mw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo RTBEMTczOEFCQUI5NDdEMTVDQUJCRUY5RDE1RDM2RDkxNTY2MDcxMjI0 > <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c echo RTBEMTczOEFCQUI5NDdEMTVDQUJCRUY5RDE1RDM2RDkxNTY2MDcxMjI0 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh <Package Folder>/files/T-75Z-FaSJDyxNVErZEtlU_QTIrBMZ1o
sh <Package Folder>/files/T-V6Er7SuoZgkRJLQ6vNDkEtNoWkZt-j
sh <Package Folder>/files/T-ukRKACpnHAB_EorpW9METwDUSAbCVO
sh <Package Folder>/files/T028wkAM3VyUSw9JCbkA0EnfRRHVLMKy
sh <Package Folder>/files/T1534EOcemlex7SAjre4Y0VQAOgxwq9L
sh <Package Folder>/files/T2tdab1OXEoPV2LPHbUXb0q-iC-V36bW
sh <Package Folder>/files/T3A-U2w7ii_SsnUNZohFpE0WmhSTaNy1
sh <Package Folder>/files/T3N1smi-PH0Il3ZsrJDRskhcboJyk9cZ
sh <Package Folder>/files/T4FDeNV0CSkqdQ3VKJdYk0hMVPBpBKm_
sh <Package Folder>/files/T4HhGA-HFmECKOUao6VnsEFv2gTyvNHB
sh <Package Folder>/files/T4I1DvO4vGP-JX9I9Lx2U0dLHnBLPw1j
sh <Package Folder>/files/T4gL1yWy4AJLMO1iJIksuUYpSuTu87xv
sh <Package Folder>/files/T5Tl4kgtCQYVm5YU8LkapkS5zFjSfYC9
sh <Package Folder>/files/T7lz3BAV7fE1its3xrXDqkOZDBWhLrWK
sh <Package Folder>/files/T9qD8xzEmmSyWZlYH41RqkjUgus0wB8x
sh <Package Folder>/files/T_6Ot1Uc5OgDwcMYj40_-0AhCOkG65dF
sh <Package Folder>/files/T_9o37GLyaisGYPAobTt20_GXhmWHFMi
sh <Package Folder>/files/TwWsfD1yZRuUUO4uAocArkvNacpJslFx
sh <Package Folder>/files/TyXvhf41YX-YKEPSHY0hTUGoHSp3-qKg
sh <Package Folder>/files/TyYE6jJ73od7EpJS6JfJxk7eMVrfbakG
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.jifen.framework.push.getui.GTCoreService 24479 300 0
stat /cache
stat /data
stat /data/app
stat /proc/sys/kernel/random
stat /root
stat app
stat cat
stat etc
stat net
stat random
uname -a

Loads the following dynamic libraries:

Bugly
InnoSecure
InnoSo
NativeExample
du
getuiext3
libTmsdk-2.0.8-dual-mfr
libijkffmpeg
libijkplayer
libijksdl
libjiagu-1385524905

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
DES-ECB-NoPadding
RSA-ECB-PKCS1Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about APN settings.

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Manages Wi-Fi connectivity.

Технології

Терміни

Навчання

Міфи

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней