Adware.Gexin.20576

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) a####.exc.mob.com:80
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) rq####.sp####.mig.####.net:80
TCP(HTTP/1.1) oth.up####.mdt.####.com:8080
TCP(TLS/1.0) 2####.58.214.14:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) api.m####.com:443
TCP(TLS/1.0) s####.m####.net.####.com:443
TCP(TLS/1.0) 2####.58.211.106:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.2) 1####.217.19.195:443
TCP(TLS/1.2) 2####.58.211.106:443
TCP oth.str.mdt.####.com:8081
TCP oth.eve.mdt.####.com:8081

DNS requests:

254.23.0.####.arpa
a####.exc.mob.com
a####.u####.com
and####.b####.qq.com
api.m####.com
img.m####.net
instant####.google####.com
l####.tbs.qq.com
md####.google####.com
oth.eve.mdt.####.com
oth.str.mdt.####.com
oth.up####.mdt.####.com
p####.google####.com
s####.m####.net
safebro####.google####.com

HTTP POST requests:

a####.exc.mob.com/errconf
a####.u####.com/app_logs
oth.up####.mdt.####.com:8080/beacon/vercheck
rq####.sp####.mig.####.net/rqd/async

File system changes:

Creates the following files:

/data/data/####/.artc_lock
/data/data/####/.cl
/data/data/####/.dic_lock
/data/data/####/.du_lock
/data/data/####/.duid
/data/data/####/.globalLock
/data/data/####/.gm_lock
/data/data/####/.im_lock
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.jg.store.report_cf
/data/data/####/.jgck
/data/data/####/.lesd_lock
/data/data/####/.lock
/data/data/####/.pkg_lock
/data/data/####/.pkgs_lock
/data/data/####/.slw
/data/data/####/.ss_lock
/data/data/####/.vpl_lock
/data/data/####/.wkl
/data/data/####/1.dex
/data/data/####/1.dex.flock (deleted)
/data/data/####/1.jar
/data/data/####/9.dex
/data/data/####/9.dex.flock (deleted)
/data/data/####/9.jar
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DENGTA_META.xml
/data/data/####/DENGTA_META.xml.bak
/data/data/####/SHARED_NAME_UNIQUE_ID.xml
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/ThrowalbeLog.db-journal
/data/data/####/beacon_cover.xml
/data/data/####/beacon_cover_check.lock
/data/data/####/beacon_cover_load.lock
/data/data/####/beacon_db
/data/data/####/beacon_db-journal
/data/data/####/beacon_sig_1.lock
/data/data/####/bugly_db_-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.dex;classes6.dex
/data/data/####/classes.oat
/data/data/####/core_info
/data/data/####/domain_1
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/im_shared_txt.xml
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/mjd_shared_preferences.xml
/data/data/####/mob_commons_1
/data/data/####/mob_sdk_exception_1
/data/data/####/my_app_share_preference_file.xml
/data/data/####/room.db-journal
/data/data/####/security_info
/data/data/####/ssoconfigs.xml
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbslock.txt
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/media/####/.artc_lock
/data/media/####/.dic_lock
/data/media/####/.du_lock
/data/media/####/.duid
/data/media/####/.globalLock
/data/media/####/.gm_lock
/data/media/####/.im_lock
/data/media/####/.lesd_lock
/data/media/####/.pkg_lock
/data/media/####/.pkgs_lock
/data/media/####/.ss_lock
/data/media/####/.wkl
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/addgoods.2cc2a9a.png
/data/media/####/address.19061901.min.js
/data/media/####/addresslist.19061901.min.js
/data/media/####/addresssel.19061901.min.js
/data/media/####/addresstag.19061901.min.js
/data/media/####/agentrules.7fd17bb67ddc5e78a107.js
/data/media/####/agentrules.ab115e5928d1440fbbf4af933784beb4.css
/data/media/####/agreement.125fa6129b021061d49c.js
/data/media/####/agreement.7e25544496891312f50e.js
/data/media/####/agreement.a442a5f75acbca5101596beb52584c16.css
/data/media/####/agreement.c462bc15176d07a1a35c.js
/data/media/####/agreement.e13c3cb5b6291ad2c90f.js
/data/media/####/agreement.ed3ba54abb352b0fb03be8b84262bda8.css
/data/media/####/app19061901.zip.data
/data/media/####/applyinvoice.19061901.min.js
/data/media/####/background.115ba12.png
/data/media/####/background2.c7febdb.png
/data/media/####/bankcardadd.19061901.min.js
/data/media/####/bankcarddetail.19061901.min.js
/data/media/####/bankcardlist.19061901.min.js
/data/media/####/bankcardunadd.19061901.min.js
/data/media/####/banner.c2059e7.png
/data/media/####/beginner1.2ae8e3a.png
/data/media/####/beginner1.2f7e82b.png
/data/media/####/beginner2.c18de32.png
/data/media/####/beginner3.a41cbc9.png
/data/media/####/beginner4.679e47f.png
/data/media/####/beginner4.cae9f5e.png
/data/media/####/beginner5.189c0a1.png
/data/media/####/beginner5.efb13b5.png
/data/media/####/beginner6.6f4d630.png
/data/media/####/beginner7.20f8f79.png
/data/media/####/beginner7.96085f7.png
/data/media/####/beginner8.bba78cb.png
/data/media/####/beginner9.0e4c047.png
/data/media/####/bg-1.a29695a.jpg
/data/media/####/bg-2.4f57816.jpg
/data/media/####/bg-3.5c3172f.jpg
/data/media/####/bg-4.d7c3ab3.jpg
/data/media/####/bg-5.ec31cf3.jpg
/data/media/####/bg-6.87f5408.jpg
/data/media/####/bg-7.9eabdcf.jpg
/data/media/####/bg-develop.0bc0e54.png
/data/media/####/bg-more.c5601e2.png
/data/media/####/bg-white.35c0121.png
/data/media/####/bottom.19061901.min.js
/data/media/####/bundle.19061901.min.js
/data/media/####/buyerorderdetail.19061901.min.js
/data/media/####/buyerorderlist.19061901.min.js
/data/media/####/buyerordersearch.19061901.min.js
/data/media/####/cartlist.19061901.min.js
/data/media/####/cashtobank.19061901.min.js
/data/media/####/cashtobankresult.19061901.min.js
/data/media/####/cashtobankstate.19061901.min.js
/data/media/####/cashtozfb.19061901.min.js
/data/media/####/cashtozfbresult.19061901.min.js
/data/media/####/cashtozfbstate.19061901.min.js
/data/media/####/cashwithdrawlist.19061901.min.js
/data/media/####/category.07ff512cc36365f3e40b2e38c68d448f.css
/data/media/####/category.0ae1cc72fba3bf28f789cc7c77ac2caa.css
/data/media/####/category.1258a19e0e3acaa1adaa.js
/data/media/####/category.333a4cb0bdb0e8b6335b.js
/data/media/####/category.39c4ac67bed17830d986.js
/data/media/####/category.3b21123b494082bb544987a6f2deb8b4.css
/data/media/####/category.5309fbea56e6bb33f5bd.js
/data/media/####/category.6b62269fb6a3c701650c.js
/data/media/####/category.7751d012a8633a6c71fb.js
/data/media/####/category.79b2d426a3f6e27bcd2f.js
/data/media/####/category.faf543112deab27adddd0a7b35c42c15.css
/data/media/####/city.19061901.min.js
/data/media/####/city.js
/data/media/####/common.19061901.min.css
/data/media/####/cookie.19061901.min.js
/data/media/####/datepicker.19061901.min.css
/data/media/####/datepicker.19061901.min.js
/data/media/####/detail.12e3bfc5f08b4c3057c3.js
/data/media/####/detail.16f264e925b1d3d2646a.js
/data/media/####/detail.1c8c370d07a36b6036be.js
/data/media/####/detail.2dfb8c18ac85402df3b2.js
/data/media/####/detail.46e6b856a14a55ad1404.js
/data/media/####/detail.49fc734fcca994a57e82.js
/data/media/####/detail.4da89fac5eb92d4d9869.js
/data/media/####/detail.65fadee643900cfaac6dd241783f4233.css
/data/media/####/detail.682283dee7da256e9cf3.js
/data/media/####/detail.73efdebd0ff5ee4505ea506e650819aa.css
/data/media/####/detail.92eb94205824761c9bd0.js
/data/media/####/detail.946f1449d8bec128ec372bc1e8a4248f.css
/data/media/####/detail.9a788e94ce3702537141.js
/data/media/####/detail.9a8380e97f5442b9484e.js
/data/media/####/detail.a162893c6095680afff8507e35c245af.css
/data/media/####/detail.a3348e4b7e77dcb920573ba315e1f8c5.css
/data/media/####/detail.a9d0053cb1f3f9ae0337.js
/data/media/####/detail.adb638612c1b9afbeea56dc2ba9eaf2c.css
/data/media/####/detail.afbb486824c506af19bfd2f07bc0ab92.css
/data/media/####/detail.d35dcbee5bbcaff56c7c3c196d6cef91.css
/data/media/####/detail.e01b04612952877027c9.js
/data/media/####/detail.f7ffbc13b51fa651ea2a.js
/data/media/####/develop-two.58fe492f302b6c00d70e4af2ff12fcf3.css
/data/media/####/develop-two.8e9869ca04313d0d2a1b.js
/data/media/####/develop-two.8f8d6ca3ef88f048b9b8.js
/data/media/####/develop-two.a3b672a7af052d3f7db3f50567923034.css
/data/media/####/develop-two.b34dd5aa0e498c688bc0.js
/data/media/####/develop.22e2dfaf6f91dba48b8b0c1f32451f0a.css
/data/media/####/develop.400022951122845e968301247df3368c.css
/data/media/####/develop.434f6a6767c5b7f14256.js
/data/media/####/develop.4c4f96dec23d1e22f3af838a8f51df76.css
/data/media/####/develop.764436071ac4937d40e9.js
/data/media/####/develop.a32d8db9bd57038af53e.js
/data/media/####/develop.e655a9dd08153efc4816.js
/data/media/####/diygood.12e30e0e38f40cb16f18.js
/data/media/####/diygood.6974215ccbe18e64b5d881c7d2d8e96f.css
/data/media/####/diygood.acc08d30063516f33026.js
/data/media/####/diygood.cb003ce252b170d966bc129ecbf4c265.css
/data/media/####/diygood.e43cd3ab6b5b2d5036d1.js
/data/media/####/earningdetail.19061901.min.js
/data/media/####/earningdetailpre.19061901.min.js
/data/media/####/empty.ea9f01c.png
/data/media/####/emputy.ea9f01c.png
/data/media/####/evaluate-success.10f495345761cf753f68.js
/data/media/####/evaluate-success.22db6295beb18443099a5bbaffaf9261.css
/data/media/####/evaluate-success.3b76054f0441270a8286.js
/data/media/####/evaluate-success.61a3f8fb2532c4afa302.js
/data/media/####/evaluate-success.622e8d9f08584c3b5de982182268cfb3.css
/data/media/####/evaluate-success.999b8b6c9c9e4bc1b9dc.js
/data/media/####/evaluate-success.9b33352427408c55c180.js
/data/media/####/evaluate-success.b65e6d130518e46bd7e5.js
/data/media/####/evaluate-success.d46a7ddbd3e3523a0b19.js
/data/media/####/evaluate-success.d9f854f36126e220fa696a83cba2c8a2.css
/data/media/####/evaluate-success.dd540ddf89ee6ddef1d9f5f44b75de38.css
/data/media/####/evaluate.15619321599886f54677.js
/data/media/####/evaluate.205551a48845eadbf303.js
/data/media/####/evaluate.2dddc499390b07aa9428cb76ed22b441.css
/data/media/####/evaluate.542f05f5aa0f0fffc867c45b3c889bb7.css
/data/media/####/evaluate.5ffc1c74157286796905.js
/data/media/####/evaluate.9916b443b50dea8da643.js
/data/media/####/evaluate.b595622091701a75480ecec1da12938a.css
/data/media/####/evaluate.c4ad288bdf0c80d22963.js
/data/media/####/evaluate.c5d969b0056b009440721d6cb2d34f3d.css
/data/media/####/evaluate.e77023d1ae7863c77675.js
/data/media/####/evaluate.ec2042b52d7e53118ab1.js
/data/media/####/fastclick.19061901.min.js
/data/media/####/feedback.19061901.min.css
/data/media/####/feedback.19061901.min.js
/data/media/####/feedbacklist.19061901.min.js
/data/media/####/feedbackreply.19061901.min.js
/data/media/####/greenhand_five.0a86360.png
/data/media/####/guidance.177e2dc655fd5d45782a0560e97d7b10.css
/data/media/####/guidance.1888d628965a89f5ace4bbab2ae98a86.css
/data/media/####/guidance.32089faa7e9af39d8511.js
/data/media/####/guidance.364bef6cb146a70018ee.js
/data/media/####/guidance.6346a429fe8e424d7a3499b84a753841.css
/data/media/####/guidance.724b382647fa6b529101.js
/data/media/####/guidance.89fb980e8e94c894fd971de23ffd8145.css
/data/media/####/guidance.8a437d3371bae6a88330.js
/data/media/####/guidance.b274d4e600d154d3ad4286c963b352df.css
/data/media/####/guidance.c83a98cea886157474a8.js
/data/media/####/guidance.cb1cc41c3293ce41eb8c.js
/data/media/####/guidance.d022bbcb6df6755bf7a08a08698e0722.css
/data/media/####/guidance.d36a7c2e03f8aea487ad.js
/data/media/####/guidance.d75902db702d78d4fd5d1004584616f6.css
/data/media/####/guidance.e5fb5d80a46d88a00b39.js
/data/media/####/guidance.e74ad718e16523d5df16.js
/data/media/####/guidance.f0c40dd4f819f8f24b10.js
/data/media/####/help.19061901.min.js
/data/media/####/home.19061901.min.css
/data/media/####/idcardvalidate.19061901.min.js
/data/media/####/incomemanage.19061901.min.js
/data/media/####/index.0ec631b535fbc9a6fcce0cdb153933ee.css
/data/media/####/index.113a86878cba087eaa17.js
/data/media/####/index.1c417223f3bd6e0315a7.js
/data/media/####/index.208df515456748247758.js
/data/media/####/index.210f22109cef04c349e26786edbaac76.css
/data/media/####/index.27a82a52eec11455ac6e.js
/data/media/####/index.285426773b45449f7241e88053f5cc38.css
/data/media/####/index.292efb028c6016494523.js
/data/media/####/index.2fe8ec20dfa8b6995cc1ef33eb089c46.css
/data/media/####/index.4073caca4a13b31f17f8.js
/data/media/####/index.428b48f05480f29c114d.js
/data/media/####/index.47285465782f60af1fe8.js
/data/media/####/index.4ff87d7d4f4c66cada9e404ecab38f4c.css
/data/media/####/index.5aa8041e1e5de3b36887.js
/data/media/####/index.6226896a786a24e8a93f.js
/data/media/####/index.67e1bab21833774d18bd50be440609a0.css
/data/media/####/index.6ae9a7391e575e79342e.js
/data/media/####/index.6f4cc9451c219507d008.js
/data/media/####/index.736c751dd2bd4bbe9134.js
/data/media/####/index.7443d624968b03b1abeac0a6de6596f0.css
/data/media/####/index.7453c7aa32b65456b80a.js
/data/media/####/index.7bf6297835ca97d6e5b13084e71e6beb.css
/data/media/####/index.87a6b807cade9290a94b.js
/data/media/####/index.8c817c2616ef509b97e85748823d1090.css
/data/media/####/index.8d7852652ff02dcb3ddd.js
/data/media/####/index.9241394f69cf9e514e75a41746590bcb.css
/data/media/####/index.99f801d24b5db0a6163f.js
/data/media/####/index.9bb717eca732435361d1.js
/data/media/####/index.9c9a46668439b907e635.js
/data/media/####/index.9e6f94df8177a819c72992431ea6d520.css
/data/media/####/index.a10d309fae3962b23f60c105077d25a9.css
/data/media/####/index.a192f04b14dea729cd8a.js
/data/media/####/index.a9434b563e1a59611bd2.js
/data/media/####/index.a9df5696e979020833e8.js
/data/media/####/index.b818cfb1dc9e22873a4e.js
/data/media/####/index.b8e56345759ffd382304829f8379d490.css
/data/media/####/index.c313c1b9cf0ada791863.js
/data/media/####/index.c8911adc062210cb7ea6.js
/data/media/####/index.c8fd5ffffdf0fe70d3b81128ce960dc0.css
/data/media/####/index.d0fea178f0734eaac18745f8171a6da9.css
/data/media/####/index.d9509dd0d1cf8de230b7.js
/data/media/####/index.da7284b0f15d71a25080.js
/data/media/####/index.db8de3f226226dbf9ec1.js
/data/media/####/index.e2ffbe82d1a174f35461.js
/data/media/####/index.e67baca60ad484724b2392ac5ea775a9.css
/data/media/####/index.eb24847c4956fb4495113a9f088e435c.css
/data/media/####/index.ec3f892db665cb5f77ad.js
/data/media/####/index.ed456ec56a24a7e5e3fe.js
/data/media/####/index.f6f6686aa3e59fc67612.js
/data/media/####/index.f78da6c0bdf39adc074e.js
/data/media/####/index.fab13e57d82e4dcf4d3f62ad34e942fa.css
/data/media/####/index.fe499476ab3d787e74b2.js
/data/media/####/indexview.19061901.min.js
/data/media/####/invest.0d9799a8ec94aa97ab72.js
/data/media/####/invest.1d8345518f5bf9956c7012b410818d32.css
/data/media/####/invest.26ab9ff5f57731c3773b.js
/data/media/####/invest.2d9fe0730a6e30aa12b8.js
/data/media/####/invest.2f5a369e904162416a5257b299e7e7fe.css
/data/media/####/invest.3f722e5526ecda984221.js
/data/media/####/invest.420147c374f34d8e426a305a56334a13.css
/data/media/####/invest.42a63b62edc4367a93c2.js
/data/media/####/invest.4a8944657e87f1e280ae.js
/data/media/####/invest.4ae560a083b819c9e23f.js
/data/media/####/invest.4d3ac99b6c7184032961d999dcefa380.css
/data/media/####/invest.54e58abff65397081a78.js
/data/media/####/invest.60a14644e3017beb1e4f245923aba362.css
/data/media/####/invest.b5ebf0acc549de82fa6a656fa8d1cdfa.css
/data/media/####/invest.fb9ead1ad42740198910.js
/data/media/####/invest2.342c858.png
/data/media/####/invest2.afabd6a.png
/data/media/####/invite.8a7cac58693c30a15a82cb6a18e11063.css
/data/media/####/invite.b4e870f315bf17fceeda.js
/data/media/####/invoicepre.19061901.min.js
/data/media/####/jquery-3.2.1.19061901.min.js
/data/media/####/jquery190.19061901.min.js
/data/media/####/list.03f518d5dcde03a1e8bfd2c1d75b2478.css
/data/media/####/list.0501d78bd66f1f5a2829.js
/data/media/####/list.1f676487e860a0d5d65a.js
/data/media/####/list.34713330d581c3d50d44.js
/data/media/####/list.44179194b3d10fd3199c.js
/data/media/####/list.4c51537f28914da76f24.js
/data/media/####/list.54882f67f1a0ef723c51.js
/data/media/####/list.5e5009de503412a56c7c9b1258b1eb2e.css
/data/media/####/list.62b269728c4b46b782b86a5f4fe82243.css
/data/media/####/list.71eb6943cf220bb7fffcb4dd703a6524.css
/data/media/####/list.772d54bda0a1ed4e93c0c72e1708ee6f.css
/data/media/####/list.790c6c6615cf87ac95d6.js
/data/media/####/list.795545a760b5b4ca3400e6e9585e0200.css
/data/media/####/list.7ab83d02879000c6031c.js
/data/media/####/list.95f764b9567368fc253e064c3ccc70b1.css
/data/media/####/list.a0ee0485b57f0e1647fe.js
/data/media/####/list.b4da730f12877f80b3de.js
/data/media/####/list.baaf851d75e830b2d9c4.js
/data/media/####/list.c3383d4670687ff78c78.js
/data/media/####/list.c5bf32e381a92af21f1c.js
/data/media/####/list.c85023a4db0b1732543809debff62f29.css
/data/media/####/list.fb92ee4562a144894da1.js
/data/media/####/loading.b8d5a3f.gif
/data/media/####/logo.8422ebf.png
/data/media/####/makemoney.774d89e.png
/data/media/####/manifest.2413f79b16615a63c0de.js
/data/media/####/manifest.4f650a2ec096ad9296f1.js
/data/media/####/manifest.546fb8d03dbbd3b266bd.js
/data/media/####/manifest.8b1fe0272780a2048377.js
/data/media/####/manifest.8cc22aa4e28ea78e065c.js
/data/media/####/manifest.c19968e9da3240193771.js
/data/media/####/manjingdian_money.e4b1c47.png
/data/media/####/merchants_advantage.e02d7a1.png
/data/media/####/merchants_background.88e2b0a.png
/data/media/####/merchants_background.b441379.png
/data/media/####/merchants_contactus.23bfeb0.png
/data/media/####/merchants_contactus.4ab407e.png
/data/media/####/merchants_manjindian.3b21c50.png
/data/media/####/merchants_text.27e28e4.png
/data/media/####/merchants_trend.3069ba5.png
/data/media/####/meta.dat
/data/media/####/mine.19061901.min.css
/data/media/####/mobilebind.19061901.min.js
/data/media/####/mobilebindcheck.19061901.min.js
/data/media/####/my-evaluation.0ab69c7b32f825ab278e6d512925faac.css
/data/media/####/my-evaluation.0ddfb4cc03746708e092821619db9cba.css
/data/media/####/my-evaluation.4c57c767c08569b69cd8.js
/data/media/####/my-evaluation.6b9ed194b5616a0be505.js
/data/media/####/my-evaluation.6c90da8b3161ca0f871d.js
/data/media/####/my-evaluation.7aefa227cf08062cd176.js
/data/media/####/my-evaluation.a0033f623f563d9bd4f5.js
/data/media/####/my-evaluation.b70d820187900e53a7dd.js
/data/media/####/my-evaluation.c46cfd88d8db4fcfb342.js
/data/media/####/my-evaluation.e4a89af670c16eb622bd0f76aac4badb.css
/data/media/####/my-evaluation.e6619b4054940ae6f34add8ef121cb1c.css
/data/media/####/notagent.a135295481a231253fbc.js
/data/media/####/notagent.ed8861b5f37ee58b76f34cb9e40e16c8.css
/data/media/####/onelogin_log.txt
/data/media/####/order.19061901.min.css
/data/media/####/orderaddress.19061901.min.js
/data/media/####/orderaddresssel.19061901.min.js
/data/media/####/ordercustomapply.19061901.min.js
/data/media/####/ordercustomdetail.19061901.min.js
/data/media/####/ordercustomexpress.19061901.min.js
/data/media/####/ordercustomlist.19061901.min.js
/data/media/####/ordercustomretform.19061901.min.js
/data/media/####/ordercustomsearch.19061901.min.js
/data/media/####/orderdetail.19061901.min.js
/data/media/####/orderexpress.19061901.min.js
/data/media/####/orderlist.19061901.min.js
/data/media/####/ordersearch.19061901.min.js
/data/media/####/pagedialog.19061901.min.js
/data/media/####/paymentsel.19061901.min.js
/data/media/####/pdf.19061901.min.js
/data/media/####/pdf.worker.19061901.min.js
/data/media/####/person-1.ea1dadb.png
/data/media/####/person-2.e7dc9d9.png
/data/media/####/person-3.376449a.png
/data/media/####/picker.19061901.min.js
/data/media/####/preferential.1553eccc910f936c8b34.js
/data/media/####/preferential.4fbf34a82272475d044f.js
/data/media/####/preferential.5c1c2a118821b862bdfc.js
/data/media/####/preferential.5f3636ef14d03192ab76.js
/data/media/####/preferential.6beb8019f6d6268fb463.js
/data/media/####/preferential.8ecec09fc6e1672dbd6c.js
/data/media/####/preferential.a1a6f5bfda4187eaae8e.js
/data/media/####/preferential.c0bef7135f353493e469e419ec43d004.css
/data/media/####/preferential.c2ff823bf6e3bff31fae.js
/data/media/####/purchase.19061901.min.css
/data/media/####/realnameauth.19061901.min.js
/data/media/####/realnameauthok.19061901.min.js
/data/media/####/redirectlogin.19061901.min.js
/data/media/####/rem.19061901.min.js
/data/media/####/require.19061901.min.js
/data/media/####/salelist.19061901.min.js
/data/media/####/securitycenter.19061901.min.js
/data/media/####/selfbg.352aa82.png
/data/media/####/selfbg.5c58151.png
/data/media/####/selficon1.11f3770.png
/data/media/####/selficon1.8a39bc7.png
/data/media/####/selficon2.6b28668.png
/data/media/####/selficon2.7aedfab.png
/data/media/####/selficon3.c0b4751.png
/data/media/####/selficon3.fc31775.png
/data/media/####/shopinfo.19061901.min.js
/data/media/####/shopok.19061901.min.js
/data/media/####/supincomemanage.19061901.min.js
/data/media/####/tbslog.txt
/data/media/####/test.19061901.min.js
/data/media/####/two1.ec70e62.png
/data/media/####/two2.69f937c.png
/data/media/####/two2.ebf683d.png
/data/media/####/two3.21c8078.png
/data/media/####/two3.59debf2.png
/data/media/####/twobg.2e7ee8a.png
/data/media/####/twobg.6ba8cbf.png
/data/media/####/understand_background.eaccaac.png
/data/media/####/understand_blue.0e9db17.png
/data/media/####/understand_icon_bottom.2269471.png
/data/media/####/understand_icon_manjindian.5bf6cc1.png
/data/media/####/understand_iphonex.589e333.png
/data/media/####/understand_iphonex.e7ac867.png
/data/media/####/understand_orange.bab4cae.png
/data/media/####/understand_purple.317766d.png
/data/media/####/understand_white.cf00c77.png
/data/media/####/understand_yellow.172e6ff.png
/data/media/####/vendor.1f931c264ac89efb405d.js
/data/media/####/vendor.7c52c0a60d9b750ad856.js
/data/media/####/version.19061901.min.js
/data/media/####/visitorlist.19061901.min.js
/data/media/####/vue.19061901.min.js
/data/media/####/zepto.19061901.min.js
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes3.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes4.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes5.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes6.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/beacon/comp/1.jar --oat-fd=62 --oat-location=/data/user/0/<Package>/files/beacon/odex/1.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/beacon/comp/1.jar --oat-fd=76 --oat-location=/data/user/0/<Package>/files/beacon/odex/1.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/beacon/comp/9.jar --oat-fd=62 --oat-location=/data/user/0/<Package>/files/beacon/odex/9.dex --compiler-filter=speed
/system/bin/sh -c type su
cat /sys/class/net/wlan0/address
getprop androVM.vbox_dpi
getprop gsm.sim.state
getprop gsm.sim.state2
getprop qemu.sf.fake_camera
getprop ro.board.platform
getprop ro.debuggable
getprop ro.genymotion.version
getprop ro.product.cpu.abi
getprop ro.secure

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
AES-GCM-NoPadding
DES-ECB-PKCS5Padding
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
DES-ECB-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about running apps.

Displays its own windows over windows of other apps.

Технологии

Термины

Обучение и просвещение

Мифы

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней