Technical information
Malicious functions:
Downloads the following detected threats from the Internet:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) p1.070####.com:80
- TCP(HTTP/1.1) ns-ji####.jiuya####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) cdn.gu####.cn.####.net:80
- TCP(HTTP/1.1) p1.a####.com:80
- TCP(HTTP/1.1) 42.2####.73.50:80
- TCP(HTTP/1.1) d1jy####.jiuya####.com:81
- TCP(TLS/1.0) hm.b####.com:443
DNS requests:
- cdn.gu####.cn
- d1jy####.jiuya####.com
- down####.ji####.yuzhua####.com
- down####.jiuya####.com
- hm.b####.com
- p1.070####.com
- p1.a####.com
- p1.le####.cn
HTTP GET requests:
- 42.2####.73.50/Wmobile/Tpl/Public/css/gqapp.css?t=####
- 42.2####.73.50/Wmobile/Tpl/Public/css/swiper.min.css
- 42.2####.73.50/Wmobile/Tpl/Public/images/banner-bj.png
- 42.2####.73.50/Wmobile/Tpl/Public/images/foot-icon04.png
- 42.2####.73.50/Wmobile/Tpl/Public/images/icon-kf-02.png
- 42.2####.73.50/Wmobile/Tpl/Public/images/icon-star.png
- 42.2####.73.50/Wmobile/Tpl/Public/images/index-02.png
- 42.2####.73.50/Wmobile/Tpl/Public/images/index-icon05.png
- 42.2####.73.50/Wmobile/Tpl/Public/images/lhhtc.png?t=####
- 42.2####.73.50/Wmobile/Tpl/Public/images/little-icon01-up.png
- 42.2####.73.50/Wmobile/Tpl/Public/images/tus-01.png
- 42.2####.73.50/Wmobile/Tpl/Public/js/jquery-1.9.1.min.js
- 42.2####.73.50/game_download_page-331-1.html
- 42.2####.73.50/index.php/Index/gqapp/?gameid=331?from=####&isapp=####&tg...
- cdn.gu####.cn.####.net/web_server/upload/picture/2015-11-12/sklr-icon-an...
- d1jy####.jiuya####.com:81/_c/products/jy/v81500/1main_ckf0009000.apk
- d1jy####.jiuya####.com:81/_c/products/jy/v81500/3rongyao_cha0101000.apk
- d1jy####.jiuya####.com:81/down.php?p=L3Byb####&tgid=####&isdownmb=####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.gif?cc=1&ck=1&cl=16-bit&ds=600x800&vl=898&ep=10413,10413...
- hm.b####.com/hm.gif?cc=1&ck=1&cl=16-bit&ds=600x800&vl=898&ep=3562,3562&e...
- hm.b####.com/hm.gif?cc=1&ck=1&cl=16-bit&ds=600x800&vl=898&ep=9456,7229&e...
- hm.b####.com/hm.gif?cc=1&ck=1&cl=16-bit&ds=600x800&vl=898&et=0&ja=0&ln=e...
- hm.b####.com/hm.js?14da34f####
- ns-ji####.jiuya####.com/index.php/Index/down/?appid=####&tgid=####&type=...
- ns-ji####.jiuya####.com/index.php/Index/down/appid/3/tgid/ba0000001/type...
- p1.070####.com/2015/11/11/5642f9d1d5bc6.png
- p1.070####.com/2016/04/20/5716ef58a0030.jpg
- p1.070####.com/2016/08/01/579f08ea57771.png
- p1.070####.com/2017/11/16/5a0d03709920a.jpg
- p1.070####.com/2017/12/28/5a44bd3a84f15.png
- p1.070####.com/2018/01/03/5a4c96885c2fc.png
- p1.070####.com/2018/01/04/5a4dd43e152a2.png
- p1.070####.com/2018/02/08/5a7bb918862c0.png
- p1.a####.com/
- p1.a####.com/2016/08/10/57aaf12562d3e.jpg
- p1.a####.com/2016/08/10/57aaf12563677.jpg
- p1.a####.com/2016/08/10/57aaf12563f1d.jpg
- p1.a####.com/2016/10/17/580471ad1ccd5.png
- p1.a####.com/2016/10/17/580471b5ee05b.png
- p1.a####.com/2016/10/17/580471d2194bf.png
- p1.a####.com/2016/10/17/580471d9a17b3.png
- p1.a####.com/2016/10/17/580471e032a4a.png
- p1.a####.com/2016/10/17/580471e9017a4.png
- p1.a####.com/2016/10/17/580471eedca51.png
- p1.a####.com/2016/10/17/580471f6b45c7.png
- p1.a####.com/2017/06/06/5936075b097b3.png
- p1.a####.com/2019/12/11/5df0645fe701d.gif
- p1.a####.com/2019/12/25/5e02f7a60f77c.png
- p1.a####.com/Wmobile/Tpl/Public/css/style.css?t=####
- p1.a####.com/Wmobile/Tpl/Public/images/banner-kf.jpg
- p1.a####.com/Wmobile/Tpl/Public/images/center-icon-back.png
- p1.a####.com/Wmobile/Tpl/Public/images/foot-icon01.png
- p1.a####.com/Wmobile/Tpl/Public/images/foot-icon02.png
- p1.a####.com/Wmobile/Tpl/Public/images/foot-icon05.png
- p1.a####.com/Wmobile/Tpl/Public/images/go-top.png
- p1.a####.com/Wmobile/Tpl/Public/images/head-back.png
- p1.a####.com/Wmobile/Tpl/Public/images/hot02.png
- p1.a####.com/Wmobile/Tpl/Public/images/icon-gg.png
- p1.a####.com/Wmobile/Tpl/Public/images/icon-kefu.png
- p1.a####.com/Wmobile/Tpl/Public/images/icon-kf-01.png
- p1.a####.com/Wmobile/Tpl/Public/images/icon-kf-03.png
- p1.a####.com/Wmobile/Tpl/Public/images/index-01.png
- p1.a####.com/Wmobile/Tpl/Public/images/index-03.png
- p1.a####.com/Wmobile/Tpl/Public/images/index-04.png
- p1.a####.com/Wmobile/Tpl/Public/images/index-icon01.png
- p1.a####.com/Wmobile/Tpl/Public/images/index-icon02.png
- p1.a####.com/Wmobile/Tpl/Public/images/index-icon03.png
- p1.a####.com/Wmobile/Tpl/Public/images/index-icon04.png
- p1.a####.com/Wmobile/Tpl/Public/images/index-icon06.png
- p1.a####.com/Wmobile/Tpl/Public/images/index-icon07.png
- p1.a####.com/Wmobile/Tpl/Public/images/index-icon08.png
- p1.a####.com/Wmobile/Tpl/Public/images/little-icon03.png
- p1.a####.com/Wmobile/Tpl/Public/images/logo.png?t=####
- p1.a####.com/Wmobile/Tpl/Public/images/new.png
- p1.a####.com/Wmobile/Tpl/Public/images/search-icon01.png
- p1.a####.com/Wmobile/Tpl/Public/images/search-icon02.png
- p1.a####.com/Wmobile/Tpl/Public/images/search.png
- p1.a####.com/Wmobile/Tpl/Public/images/set-icon01.png
- p1.a####.com/Wmobile/Tpl/Public/images/tus-img.png
- p1.a####.com/Wmobile/Tpl/Public/images/xtb-search-01.png
- p1.a####.com/Wmobile/Tpl/Public/images/xtb-search-02.png
- p1.a####.com/Wmobile/Tpl/Public/imagesarch-02.png
- p1.a####.com/Wmobile/Tpl/Public/js/jquery-cookie.js
- p1.a####.com/Wmobile/Tpl/Public/js/jquery.back.js?t=####
- p1.a####.com/Wmobile/Tpl/Public/js/load_list.js
- p1.a####.com/Wmobile/Tpl/Public/js/swiper.min.js
- p1.a####.com/hotsearch.html
- p1.a####.com/index.php/index/game_searchall?kw=####¢er=####
- p1.a####.com/kefu.html
File system changes:
Creates the following files:
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/f_00000e
- /data/data/####/f_00000f
- /data/data/####/f_000010
- /data/data/####/f_000011
- /data/data/####/f_000012
- /data/data/####/f_000013
- /data/data/####/f_000014
- /data/data/####/index
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/1main_ckf0009000.apk
- /data/media/####/3rongyao_cha0101000.apk
Miscellaneous:
Displays its own windows over windows of other apps.
