Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) laidian####.oss-cn-####.aliy####.com:80
- TCP(HTTP/1.1) app.wa####.com:80
- TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
- TCP(TLS/1.0) 1####.217.17.142:443
DNS requests:
- app.wa####.com
- laidian####.oss-cn-####.aliy####.com
- log.u####.com
- mt####.go####.com
- s####.u####.com
HTTP GET requests:
- app.wa####.com/novel/recommendList?key=####&app_id=####&device_id=####&d...
- et2-na6####.wagbr####.ali####.####.com/bar/get/59fa807ff43e483e670000e6/...
- laidian####.oss-cn-####.aliy####.com/8-novel-202003-25-1585120574148.jpg
- laidian####.oss-cn-####.aliy####.com/8-novel-202003-25-1585120605234.jpg
- laidian####.oss-cn-####.aliy####.com/8-novel-202003-25-1585120623847.jpg
- laidian####.oss-cn-####.aliy####.com/8-novel-202003-25-1585120651422.jpg
- laidian####.oss-cn-####.aliy####.com/8-novel-202003-25-1585120676752.jpg
- laidian####.oss-cn-####.aliy####.com/8-novel-202003-25-1585121023244.jpg
- laidian####.oss-cn-####.aliy####.com/novel-cover-0bbd98acebb31ffcba7b449...
- laidian####.oss-cn-####.aliy####.com/novel-cover-27c64193ebdbe80ac2e854b...
- laidian####.oss-cn-####.aliy####.com/novel-cover-425c96d1a5d6aa75f271859...
- laidian####.oss-cn-####.aliy####.com/novel-cover-4519224a368f2ad1c6f8b16...
- laidian####.oss-cn-####.aliy####.com/novel-cover-6a80480e74bfcc240aa63ec...
- laidian####.oss-cn-####.aliy####.com/novel-cover-712e2a6933e22edd32b4320...
- laidian####.oss-cn-####.aliy####.com/novel-cover-8264af87078797c5165e93a...
- laidian####.oss-cn-####.aliy####.com/novel-cover-86a0a629965bd45e8bb92b0...
- laidian####.oss-cn-####.aliy####.com/novel-cover-8d9661b7f31850a11087086...
- laidian####.oss-cn-####.aliy####.com/novel-cover-90b8c782fe44d5f3e1aa129...
- laidian####.oss-cn-####.aliy####.com/novel-cover-a3c6781f768b2ec66a434e3...
- laidian####.oss-cn-####.aliy####.com/novel-cover-a7d1a044dfd725bc125354a...
- laidian####.oss-cn-####.aliy####.com/novel-cover-a81de70a26d113a96e502e5...
- laidian####.oss-cn-####.aliy####.com/novel-cover-adc53a4572187243ae67977...
- laidian####.oss-cn-####.aliy####.com/novel-cover-b4cea4929373b65854f9e81...
- laidian####.oss-cn-####.aliy####.com/novel-cover-bc351352cd04f23fb5e7b2c...
- laidian####.oss-cn-####.aliy####.com/novel-cover-bc46b3979b071fceddcdaaf...
- laidian####.oss-cn-####.aliy####.com/novel-cover-bdad039ec1e8f4239445bb5...
- laidian####.oss-cn-####.aliy####.com/novel-cover-bdce8fb6a8cead70bc3f780...
- laidian####.oss-cn-####.aliy####.com/novel-cover-cbf6fd9b92541a15dc58782...
- laidian####.oss-cn-####.aliy####.com/novel-cover-d55e98006ee6a7094b3ce12...
- laidian####.oss-cn-####.aliy####.com/novel-cover-e3533224ec32a2438140b2d...
- laidian####.oss-cn-####.aliy####.com/novel-cover-e3d75bfaa1928818d3de40e...
- laidian####.oss-cn-####.aliy####.com/novel-cover-ec24736ae1bd1f5b3d33a1a...
- laidian####.oss-cn-####.aliy####.com/novel-cover-f1bdc14092de353dbf18685...
- laidian####.oss-cn-####.aliy####.com/novel-cover-f7bc31f86c62482d3627203...
HTTP POST requests:
- app.wa####.com/client/launch?device_id=####&type=####&version=####&os=####
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/1586352172912.log
- /data/data/####/com.wxb.wanshu_preference.xml
- /data/data/####/libjiagu1677656108.so
- /data/data/####/umeng_socialize.xml
- /data/media/####/-1178511217.tmp
- /data/media/####/-1203296768.tmp
- /data/media/####/-1264487402.tmp
- /data/media/####/-1285542846.tmp
- /data/media/####/-1374092771.tmp
- /data/media/####/-1559881409.tmp
- /data/media/####/-1571900333.tmp
- /data/media/####/-1574488094.tmp
- /data/media/####/-1676992242.tmp
- /data/media/####/-173280584.tmp
- /data/media/####/-1899693493.tmp
- /data/media/####/-190900919.tmp
- /data/media/####/-2015436020.tmp
- /data/media/####/-417985672.tmp
- /data/media/####/-464608212.tmp
- /data/media/####/-666777963.tmp
- /data/media/####/-705170742.tmp
- /data/media/####/-776828424.tmp
- /data/media/####/.nomedia
- /data/media/####/1238894456.tmp
- /data/media/####/1323835390.tmp
- /data/media/####/1484191927.tmp
- /data/media/####/1496621656.tmp
- /data/media/####/233636636.tmp
- /data/media/####/449218425.tmp
- /data/media/####/496501109.tmp
- /data/media/####/505581106.tmp
- /data/media/####/769316801.tmp
- /data/media/####/850460475.tmp
- /data/media/####/873867258.tmp
- /data/media/####/911517538.tmp
- /data/media/####/933411618.tmp
- /data/media/####/946569378.tmp
Miscellaneous:
Loads the following dynamic libraries:
- libjiagu1677656108
Uses the following algorithms to encrypt data:
- AES-CBC-NoPadding
Uses the following algorithms to decrypt data:
- AES-CBC-NoPadding
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
