Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) d####.c####.l####.####.com:80
- TCP(HTTP/1.1) d####.gex####.com:80
- TCP(HTTP/1.1) nav.cn.ron####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(TLS/1.0) and####.google####.com:443
- TCP(TLS/1.0) s####.map.b####.com:443
- TCP(TLS/1.0) d####.gex####.com:443
- TCP(TLS/1.2) 1####.250.179.195:443
- TCP(TLS/1.2) 1####.217.168.202:443
- UDP 1####.251.36.42:443
- TCP sdk.o####.t####.####.com:5224
- UDP 1####.217.168.202:443
- TCP cm-1####.g####.com:5226
DNS requests:
- a####.u####.com
- and####.google####.com
- api.t####.com
- c.sz.gt.####.8
- c.sz.gt.####.com
- cm-1####.g####.com
- d####.gex####.com
- d####.gex####.com
- m####.go####.com
- nav.cn.ron####.com
- s####.cn.ron####.com
- s####.map.b####.com
- sdk.c####.g####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
HTTP GET requests:
- d####.c####.l####.####.com/config/hzv9.conf
- d####.gex####.com/Admin/Logo/Ad/5d6b5b9a53e141718b0980a3505913e9.jpg
- d####.gex####.com/Admin/Physical/Show/07d80ba4328945cd95bdffbc76e48289.jpg
- d####.gex####.com/Admin/Physical/Show/1ad0e2b7575c4f4db598fb57e0dfbf42.jpg
- d####.gex####.com/Admin/Physical/Show/26a18a9607af4ea1b83125a4b2ce2838.jpg
- d####.gex####.com/Admin/Physical/Show/3555169740814f06ae3fa553536e02d9.jpg
- d####.gex####.com/Admin/Physical/Show/4a01821ad1a74b8dafae04270ab38cec.jpg
- d####.gex####.com/Admin/Physical/Show/4b<SMS Address>ffdb40d48509afc85c6...
- d####.gex####.com/Admin/Physical/Show/4eb9e1a0a7f84a8d90051527b8e2538c.jpg
- d####.gex####.com/Admin/Physical/Show/4fb229a64cac46b0be86fb741a360897.jpg
- d####.gex####.com/Admin/Physical/Show/5660a56f6b454b289b9a0c7164365aab.jpg
- d####.gex####.com/Admin/Physical/Show/6645c62e0bdb4d048b5910205ad0f534.jpg
- d####.gex####.com/Admin/Physical/Show/6bc79aaf308c449ab64ddb1cfce131e8.jpg
- d####.gex####.com/Admin/Physical/Show/6ddef435df864c1491d7eab94f2a6ebc.jpg
- d####.gex####.com/Admin/Physical/Show/81be61784caa4fd3a7989e632e00d16c.jpg
- d####.gex####.com/Admin/Physical/Show/9d6ae748da764e3fba2a903eca22fe10.jpg
- d####.gex####.com/Admin/Physical/Show/b8bd19ec7973474e98551d6b5151fd64.jpg
- d####.gex####.com/Admin/Physical/Show/bf4277dfd55b441ebb6e98c69c676b0e.jpg
- d####.gex####.com/Admin/Physical/Show/f14b7dd11f624135af501d1479f9d543.jpg
- d####.gex####.com/Admin/Physical/Show/f41c20c6342e41e595d31f0144ae7e3e.jpg
- d####.gex####.com/Admin/Physical/Show/f535692ebf6443a0a58cbe3dd0675384.jpg
- d####.gex####.com/Admin/Physical/Show/f8fd0dffe4c24997b5b91c9450477c90.jpg
- d####.gex####.com/ClientService.asmx/AndroidVersion?version=####&key=###...
- d####.gex####.com/ClientService.asmx/PhysiognomyAd?version=####&key=####...
HTTP POST requests:
- a####.u####.com/app_logs
- d####.gex####.com/ClientService.asmx/Login
- d####.gex####.com/WebService.asmx/AcquireKeychain
- d####.gex####.com/WebService.asmx/AcquireSecretKey
- nav.cn.ron####.com/navipush.json
- sdk.o####.p####.####.com/api.php?format=####&t=####
File system changes:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/00907522e8e74d5d670d2d9b7b026b7a4ef70de37083e27...5e5c.0
- /data/data/####/055f8f84a67157ae6c66cb8c95dfce9481df877925fc34f....0.tmp
- /data/data/####/14c0727d304b1a62ced9d9102ee65f68893d73ac377ae8d....0.tmp
- /data/data/####/1d966753a7268ee1af5956c89d5a09fb4509fd74603b867....0.tmp
- /data/data/####/239a65556fefc7bf3ea7bdb2e51569f46b2fecb4a6edf6a....0.tmp
- /data/data/####/2f20a5cc4cc80879500d27358c27db849bff921d4bd7ffb....0.tmp
- /data/data/####/3372967ca83d55f9e3a36f952b3438c4b6cb553af25b618....0.tmp
- /data/data/####/3859cda54729bf5112933604c0ca719720e403bf79b15c5....0.tmp
- /data/data/####/5440958110897f9b9c90482027757cf04dc1ebed0c2b039....0.tmp
- /data/data/####/68ccd2d893786e0657cf84585c43ca1ce323b115f3259c2....0.tmp
- /data/data/####/6d8e041a26c684c8142b5329be95589be08cdd65dd5c41a....0.tmp
- /data/data/####/88dee6cf0bcc613c8b3b00b7c30a64e044bc79f7bcc0ae8....0.tmp
- /data/data/####/912342a696411635b68ba00a1f76ab216d24ce386a7e860....0.tmp
- /data/data/####/9643d6f5464d92275efac1cd4877537bfc8c9a988d6c5cf....0.tmp
- /data/data/####/9fac780c3c106398a80e2d9bbd725c6032d71510bde6292....0.tmp
- /data/data/####/COUNTLY_STORE.xml
- /data/data/####/DVDirectory.cfg
- /data/data/####/DVHotMap.cfg
- /data/data/####/DVHotcity.cfg
- /data/data/####/DVVersion.cfg
- /data/data/####/ResPack.rs
- /data/data/####/RongPush.xml
- /data/data/####/Statistics.xml
- /data/data/####/TUSDK_Shared_Cache.xml
- /data/data/####/a074559480fe7495ee0d304d6981b68968a76703eefca1e....0.tmp
- /data/data/####/authStatus_com.zaili.douping.xml
- /data/data/####/authStatus_com.zaili.douping;ipc.xml
- /data/data/####/authStatus_com.zaili.douping;pushservice.xml
- /data/data/####/authStatus_io.rong.push.xml
- /data/data/####/b6d504929c36dc028645446a3edc3b103534153542ce041....0.tmp
- /data/data/####/baf005747add5d8cbcfa657a0a63a751773f9a26be6f867....0.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/check.xml
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/classes.dex;classes3.dex
- /data/data/####/classes.dex;classes4.dex
- /data/data/####/config.xml
- /data/data/####/config.xml.bak
- /data/data/####/e8353b0362c49cacf5dbd848c04c0b600fc23dfd3a767da....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f87512a869de75841f97ba0e85ff98374bb1af85af5690b....0.tmp
- /data/data/####/ffbb04a4a63e99eb211be77904fdba76db3392209e926ae....0.tmp
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/keychain.dat
- /data/data/####/libjiagu.so
- /data/data/####/mac.xml
- /data/data/####/mapstyle.sty
- /data/data/####/proc_auxv
- /data/data/####/push.pid
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/satellitestyle.sty
- /data/data/####/trafficstyle.sty
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/ver.dat
- /data/media/####/.cuid
- /data/media/####/.nomedia
- /data/media/####/RongLog.log
- /data/media/####/app.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.zaili.douping.db
- /data/media/####/global.keystore
- /data/misc/####/primary.prof
Miscellaneous:
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Displays its own windows over windows of other apps.
Requests the system alert window permission.
