Adware.Gexin.9889

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
UDP(DNS) 1####.29.29.29:53
TCP(HTTP/1.1) gl####.w.kunl####.####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) oss.cdn.a####.com:80
TCP(HTTP/1.1) down####.1####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.1####.com:80
TCP(HTTP/1.1) h####.1####.com:80
TCP(HTTP/1.1) log.1####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) i####.1####.com:80
TCP(HTTP/1.1) api.a####.com:80
TCP(HTTP/1.1) ddd.1####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(HTTP/1.1) ab.1####.com:3302
TCP(HTTP/1.1) sf6-ttc####.ps####.com.####.com:80
TCP(TLS/1.0) thi####.q####.cn:443
TCP(TLS/1.0) api.a####.com:443
TCP(TLS/1.0) mobads-####.b####.com:443
TCP(TLS/1.0) t####.c####.q####.####.com:443
TCP(TLS/1.0) h####.qktou####.com.####.com:443
TCP(TLS/1.0) cdn.aicli####.com:443
TCP(TLS/1.0) c####.baidust####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) api.1####.com:443
TCP(TLS/1.0) gl####.w.kunl####.####.com:443
TCP(TLS/1.0) h####.1####.com:443
TCP(TLS/1.0) c.innot####.com:443
TCP(TLS/1.0) lo####.qutou####.net:443
TCP(TLS/1.0) log.1####.com:443
TCP(TLS/1.0) recall-####.1####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP(TLS/1.0) qfy.innot####.com:443
TCP(TLS/1.0) a####.a####.m.####.com:443
TCP 2####.119.205.127:80
TCP ope####.m.ta####.com:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5224
UDP 1####.168.117.1:137

DNS requests:

7j####.c####.z0.####.com
a####.m.ta####.com
a####.u####.com
ab.1####.com
ag####.m.ta####.com
amap####.cn-hang####.oss####.####.com
and####.b####.qq.com
api.1####.com
api.a####.com
c####.baidust####.com
c####.g####.ig####.com
c-h####.g####.com
c.innot####.com
cdn.a####.com
cdn.aicli####.com
cfg.a####.com
ddd.1####.com
down####.1####.com
h####.1####.com
h####.1####.com
h####.1####.com
h####.qktou####.com
h####.qktou####.com
h5####.1####.com
i####.1####.com
lo####.qutou####.net
log.1####.com
mo####.b####.com
mobads-####.b####.com
msg.umengc####.com
oss.cdn.a####.com
pos.b####.com
qfy.innot####.com
rcv.a####.com
recall-####.1####.com
res####.a####.com
sdk.c####.ig####.com
sdk.o####.amp.####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sf6-ttc####.ps####.com
st####.1####.com
sta####.1####.com
static####.qutou####.net
thi####.q####.cn
umen####.m.ta####.com
up####.sdk.jig####.cn
upd####.a####.com

HTTP GET requests:

api.1####.com/activity/getActivityCardList?platform=####&lon=####&OSVers...
api.1####.com/app/coldStart?lon=####&OSVersion=####&deviceCode=####&dtu=...
api.1####.com/app/eventConfig?lon=####&OSVersion=####&deviceCode=####&dt...
api.1####.com/app/getAdConfig?lon=####&OSVersion=####&deviceCode=####&dt...
api.1####.com/app/getConfig?lon=####&OSVersion=####&deviceCode=####&dtu=...
api.1####.com/app/getGuide?lon=####&OSVersion=####&deviceCode=####&dtu=#...
api.1####.com/app/getPatch?versionName=####&dtu=####
api.1####.com/app/start?model=####&lon=####&OSVersion=####&deviceCode=##...
api.1####.com/app/updateV2?platform=####&lon=####&OSVersion=####&deviceC...
api.1####.com/content/getDefaultChannelList?lon=####&OSVersion=####&devi...
api.1####.com/qupwd/config?lon=####&OSVersion=####&deviceCode=####&dtu=#...
api.1####.com/welfare/redbagconfig?lon=####&OSVersion=####&deviceCode=##...
api.a####.com/ga?slotid=1027423&jdata={"device":{"physical_density":0.81...
api.a####.com/ga?slotid=1028298&jdata={"device":{"physical_density":0.81...
api.a####.com/ga?slotid=1029077&jdata={"device":{"physical_density":0.81...
api.a####.com/reqMotPkgLst
api.a####.com/show?CAAQcQ.####
down####.1####.com/download/qukan.3.2.0.1.001_apkfile
gl####.w.kunl####.####.com/image/sp/2018/04/12/148a91e973f72c57e313f0fe5...
gl####.w.kunl####.####.com/image/sp/2018/04/24/d924bb0a82c95083120505227...
gl####.w.kunl####.####.com/image/sp/2019/03/08/5c827330af38a.jpg?imageVi...
gl####.w.kunl####.####.com/image/sp/2019/03/08/5c827330bc122.jpg?imageVi...
gl####.w.kunl####.####.com/png/dislike.png
gl####.w.kunl####.####.com/png/lick1.png
gl####.w.kunl####.####.com/png/like_click_animation.png
gl####.w.kunl####.####.com/png/recommend_bg.png
gl####.w.kunl####.####.com/qupost/avatar/2017/11/18/899e3bb96f74916e167a...
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551772379594251884....
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551772379601593046....
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551772379607062422....
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551788318754272464....
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551788318894205605....
gl####.w.kunl####.####.com/qupost/images/2019/03/05/1551788318977667821....
gl####.w.kunl####.####.com/qupost/images/2019/03/07/1551970723628140342....
gl####.w.kunl####.####.com/qupost/images/2019/03/07/1551970723643363134....
gl####.w.kunl####.####.com/qupost/images/2019/03/07/1551970723677375513....
gl####.w.kunl####.####.com/qupost/images/2019/03/08/1552049451104996907....
h####.1####.com/live/videoPoster/1559909/ccd2e76df7dface84c9ea89c1524966...
h####.1####.com/live/videoPoster/1570713/caff5df93a82aa6dff00fc68b2834a3...
i####.1####.com/module_detail/release/template/release/static/template.h...
log.1####.com/a.gif?OSVersion=####&tk=####&network=####&version=####&tim...
log.1####.com/a.gif?lon=####&OSVersion=####&deviceCode=####&error_code=#...
log.1####.com/a.gif?lon=####&OSVersion=####&deviceCode=####&userid=####&...
log.1####.com/a.gif?lon=####&index=####&op=####&OSVersion=####&deviceCod...
oss.cdn.a####.com/live/customer/1558602/25b47125404dc475cc399e4fd4c9af87...
oss.cdn.a####.com/live/customer/1558602/3822ccf2682740b222ce14f351fea4c1...
oss.cdn.a####.com/live/customer/1558602/cafe6b57825ee9a52fb7a730ba5989de...
sf6-ttc####.ps####.com.####.com/obj/ad.union.api/105d604054acd5ef1fa77e8...
sf6-ttc####.ps####.com.####.com/obj/ad.union.api/a57c85a570c6470e4f26a39...
sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
ti####.c####.l####.####.com/config/hz-hzv3.conf

HTTP POST requests:

a####.u####.com/app_logs
ab.1####.com:3302/ab_by_sign
and####.b####.qq.com/rqd/async?aid=####
api.1####.com/app/extendReport
api.a####.com/v3/json
c-h####.g####.com/api.php?format=####&t=####
ddd.1####.com/report
sdk.o####.p####.####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/07366dfc7174e2accfc0f8cd28260240cd17a87e2f7c92b....0.tmp
/data/data/####/0e4034662694406e996615200cbbb063676e05a62f3608c....0.tmp
/data/data/####/1004
/data/data/####/1d2fd1103974b2388fbc4477a1232f2372eb500291406f6....0.tmp
/data/data/####/320df611aed98f3582997bc22dbf14da1de376764a15694....0.tmp
/data/data/####/37c59d12a6056d0a634d54b372cb71784514f8df9c69181....0.tmp
/data/data/####/442e5cebd7c2786d7041eaa3ec631458cb70a2641cad93d....0.tmp
/data/data/####/44bdfda5e546d5be3c498e5742c728c9de8a5196444cdd4....0.tmp
/data/data/####/50b7444ac57d30fecbeff52d1ed47fdf25a86ea61cd3049....0.tmp
/data/data/####/50fae74979868957abfd14f61912db6e0fd036d62f7e846....0.tmp
/data/data/####/51428e0fad66214171542cc3e93951f61c77f748be7b941....0.tmp
/data/data/####/5633d3606a26faf1900fa744faa493d7709c26d793b2ba7....0.tmp
/data/data/####/57cbac2cf864c999859f29e45734f743c0b46b9a64f43e7....0.tmp
/data/data/####/67f76d73096b96976a7feefd2d8a67bd32a40b2d25789ec....0.tmp
/data/data/####/6f762fe74043c42dc045a6aa37c4dd077f34fb4d889ba7b....0.tmp
/data/data/####/7c96c2aad83f079a3072a99904dcc1976802de82804992a....0.tmp
/data/data/####/7d61439f5ae1869b272119d8ba097d6664818077a4255e0....0.tmp
/data/data/####/83b4381451f7c069ec6602be5ed88828a94ca8e5d75bb54....0.tmp
/data/data/####/964846eee4cb023f1318dadfd880c4aa87478d0f6b005f8....0.tmp
/data/data/####/ACCS_BINDumeng;57578e4d67e58e4c810000d2.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/JPushSA_Config.xml
/data/data/####/MANIFEST.MF
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/QK_room-journal
/data/data/####/RAB5dL408Es5uTPVVct7r1JE
/data/data/####/RB82_mbqbkAZqkAJR0UrUuz1
/data/data/####/RBOLEQva1kjrtHbKCTQoxs0O
/data/data/####/RCCN47WpBEl8iTuk6wKKyFZg
/data/data/####/RGlLLjFc_ECMvG48dBhU968T
/data/data/####/RIjiFKHGM0NmvzHkLpWHbvWF
/data/data/####/RJC8krboiEcFjpZmToD7Cewn
/data/data/####/RJN62o-5vEtktVE4qkAS119g
/data/data/####/RKV-BNfcBkvfnh3HeJKAwDda
/data/data/####/RLP6L3DLXESwgFadKNyzLTAj
/data/data/####/RMpYsQn4eEtsv3d1Anw9wmQ9
/data/data/####/RNRRuSkkoEzlhl8cTly_yZzM
/data/data/####/RORzEVggUkJkpuAThH6Y2PWE
/data/data/####/ROjbycZYFUDqpFbpsi4A61lH
/data/data/####/ROz5YI57R0YboKjwBdhetbmE
/data/data/####/RPUbQkWvCERfpF-Xyci1cwWn
/data/data/####/ReadTimerPresenterEx
/data/data/####/SKY_SP.xml
/data/data/####/_aisdk_local.jar
/data/data/####/_aisdk_remote.jar
/data/data/####/_download_1552099976
/data/data/####/a13217f28ebef198d5fa5beaac0ab4b9db1ee7a0068447f....0.tmp
/data/data/####/aa3cb4047aa6d81ddfaaee93a4f3254e1e8492d0ad6e03c....0.tmp
/data/data/####/accs.db-journal
/data/data/####/ad682ad31c2fdb9893d669cc67d48af208f72f9a6dbab33....0.tmp
/data/data/####/afa2d32e9f9cbee1491e883d0b7951c80ff7388b69d8d5f....0.tmp
/data/data/####/agoo.pid
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/bugly_db_-journal
/data/data/####/c80f33965a1cd46856a126d445539bcccb46c040a3c49b7....0.tmp
/data/data/####/cba552f05de61e2e2bd89a1f2b6d26a8ff936ff03dd5eee....0.tmp
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/classes.dex
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.iclicash.advlib.xml
/data/data/####/com.jifen.qukan-journal
/data/data/####/com.jifen.qukan.xml
/data/data/####/com.jifen.qukan_dna.xml
/data/data/####/com.jifen.qukan_prefs.xml
/data/data/####/com.jifen.qukan_prefs.xml.bak
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/crashrecord.xml
/data/data/####/d8465f051a7df0abe652ef251d0115f08f35e36f2bd8da5....0.tmp
/data/data/####/d8e2c49184e5511b4d0fd49a3b0f4297a1d134545ad0990....0.tmp
/data/data/####/d8e95c0fdaa73909a0c99cc770f55bd62ea7b67c759f016....0.tmp
/data/data/####/daemon
/data/data/####/dafile.db
/data/data/####/dafile.db-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/data_3 (deleted)
/data/data/####/ddf6bb8f38c64bc746de0f7b4600874e8e41c2cde034cac....0.tmp
/data/data/####/e1bad61562b5eca1e3807727f3ebfc869b3dcb79eea93f3....0.tmp
/data/data/####/e20b9e577580a801e27092f86fe14e22cf93ae41cd2d547....0.tmp
/data/data/####/ea886fa962e5f75da94405d380213ac31ebc5472e89ed98....0.tmp
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/fd232d5b09ba5e9a06d4ff40f8caaa53d2286acd992f656....0.tmp
/data/data/####/getui_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/https_html2.qktoutiao.com_0.localstorage-journal
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/libjiagu-1385524905.so
/data/data/####/local_crash_lock
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/prdownloader.db-journal
/data/data/####/pref.xml
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/qk_app.xml
/data/data/####/qk_app.xml.bak
/data/data/####/qk_app.xml.bak (deleted)
/data/data/####/qk_push_sp.xml
/data/data/####/run.pid
/data/data/####/secid
/data/data/####/security_info
/data/data/####/sensorsdata.xml
/data/data/####/statistic_all_new_log.db
/data/data/####/statistic_all_new_log.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.acid
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.acid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid
/data/media/####/.301d574ef42563b03638c8eae19225cb.acid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.acid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.cuid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.acid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.acid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.acid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.acid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid
/data/media/####/.5454aa1a50f52737de04f35ca206c3e6.acid
/data/media/####/.5454aa1a50f52737de04f35ca206c3e6.cuid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.acid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.cuid
/data/media/####/.595b157df788ac0a270a61af4e82461b.acid
/data/media/####/.595b157df788ac0a270a61af4e82461b.cuid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.acid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid
/data/media/####/.74f9af2a1233161067ccef0ab406443a.cuid
/data/media/####/.79594990e265ac60591761aa24fbd681.acid
/data/media/####/.79594990e265ac60591761aa24fbd681.cuid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.acid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.acid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.acid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.acid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.cuid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.acid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.acid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid
/data/media/####/.919166631283dc3099cc3b24dc440014.acid
/data/media/####/.919166631283dc3099cc3b24dc440014.cuid
/data/media/####/.953c80ff9827cbb183369e675c974bc1.cuid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.acid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid
/data/media/####/._android.dat
/data/media/####/._driver.dat
/data/media/####/._system.dat
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.acid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid
/data/media/####/.aio.dat
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.acid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.acid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.cuid
/data/media/####/.c3418983f96107fb595049c67426dc08.acid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.acid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.cuid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.acid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.cuid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.acid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.acid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.cuid
/data/media/####/.f4e8fb1b9b24e8d4a8e49c675baf05db.cuid
/data/media/####/.nomedia
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/_android.dat
/data/media/####/_driver.dat
/data/media/####/_system.dat
/data/media/####/a9b30a9a76604aee9d018200f3908365
/data/media/####/aacout
/data/media/####/aio.dat
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/app.db
/data/media/####/axacount
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.jifen.qukan.bin
/data/media/####/com.jifen.qukan.db
/data/media/####/cpc_ad_search
/data/media/####/cusc
/data/media/####/cusys
/data/media/####/deviceToken
/data/media/####/f67963ce217349efa2d693641a9f74cc
/data/media/####/qtac
/data/media/####/red_dot_navigationSelected.png
/data/media/####/red_dot_navigationUnSelected.png
/data/media/####/systemccu
/data/media/####/systtk
/data/media/####/tabtkae
/data/media/####/template.html
/data/media/####/wcout
/data/media/####/weitac
/data/media/####/wxtac
/data/media/####/wxtoatk

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:57578e4d67e58e4c810000d2","utdid":"XIMqgahyGPkDAGdzx1F1oIOS","sdkVersion":"220"} -I agoodm.m.taobao.com -O 80 -T -Z
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/app_bin/daemon
chmod 755 <Package Folder>/.jiagu/libjiagu-1385524905.so
date
df
getprop
getprop net.hostname
getprop persist.service.bdroid.bdaddr
getprop ro.boot.bootloader
getprop ro.boot.boottime
getprop ro.build.date.utc
getprop ro.product.cpu.abi
getprop ro.product.cpu.abi2
getprop ro.recovery_id
getprop ro.runtime.firstboot
getprop ro.serialno
id
ls -i
ls -l
ls /dev/socket
ls /system/fonts
mkdir -p <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/
mount
ps
service call iphonesubinfo 1
sh
sh -c cat /etc/sensor_def_hh.conf
sh -c cat /proc/meminfo
sh -c cat /proc/mounts
sh -c cat /proc/self/maps
sh -c cat /proc/sys/kernel/osrelease
sh -c cat /proc/sys/kernel/random/boot_id
sh -c cat /proc/sys/kernel/random/uuid
sh -c cat /proc/uptime
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cat /sys/class/net/eth0/address
sh -c cat /sys/class/net/eth1/address
sh -c cat /sys/class/net/eth2/address
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/..ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccdid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/.ccvid
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c cat <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /system/ && stat etc
sh -c cd /proc/;cat cpuinfo
sh -c cd /proc/net/ && cat arp
sh -c cd /proc/self/;cat status
sh -c cd /sys/class/ && stat net
sh -c cd /sys/class/net/eth0/ && cat address
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /sys/devices/system/cpu/cpu0/cpufreq/ && stat cpuinfo_max_freq
sh -c cd /sys/kernel/debug && ls -i
sh -c cd /system && stat app
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd /system/bin/ && stat cat
sh -c cd <SD-Card>/ && ls -i
sh -c echo OEQ3OTkzQTJDRkZEMDQyMzIwOEFDNDE3RDUyNjlCOTQyOUM5NUQ6MkNENzA0OjJGMDk2OQ== > <SD-Card>/../../../../../..<SD-Card>/._android.dat
sh -c echo OEQ3OTkzQTJDRkZEMDQyMzIwOEFDNDE3RDUyNjlCOTQyOUM5NUQ6MkNENzA0OjJGMDk2OQ== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_android.dat
sh -c echo OTM5NzJBMUMwNTU1MjIyMUI4NzU1MkE3QUE1MDJDOUVDQkVGQjA6QTVDMUFFOjFEODM5QQ== > <SD-Card>/../../../../../..<SD-Card>/._driver.dat
sh -c echo OTM5NzJBMUMwNTU1MjIyMUI4NzU1MkE3QUE1MDJDOUVDQkVGQjA6QTVDMUFFOjFEODM5QQ== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_driver.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/._system.dat
sh -c echo QjU4NUVFQTBCMEQ3MkI1Mzg5QjM5ODQ1MzQ1NUNFMDMzQzdBQjU6ODg2Qzc4OjI3RERDMw== > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/_system.dat
sh -c echo RTZGOEU4QTI0MTgzRjhBODAyNkE2MEJDREYxMEQyNTgxNTUyMDk5OTc0 > <SD-Card>/../../../../../..<SD-Card>/.aio.dat
sh -c echo RTZGOEU4QTI0MTgzRjhBODAyNkE2MEJDREYxMEQyNTgxNTUyMDk5OTc0 > <SD-Card>/../../../../../..<SD-Card>/Android/Data/System/local/aio.dat
sh <Package Folder>/files/RAB5dL408Es5uTPVVct7r1JE
sh <Package Folder>/files/RB82_mbqbkAZqkAJR0UrUuz1
sh <Package Folder>/files/RBOLEQva1kjrtHbKCTQoxs0O
sh <Package Folder>/files/RCCN47WpBEl8iTuk6wKKyFZg
sh <Package Folder>/files/RIjiFKHGM0NmvzHkLpWHbvWF
sh <Package Folder>/files/RJC8krboiEcFjpZmToD7Cewn
sh <Package Folder>/files/RJN62o-5vEtktVE4qkAS119g
sh <Package Folder>/files/RKV-BNfcBkvfnh3HeJKAwDda
sh <Package Folder>/files/RLP6L3DLXESwgFadKNyzLTAj
sh <Package Folder>/files/RMpYsQn4eEtsv3d1Anw9wmQ9
sh <Package Folder>/files/RNRRuSkkoEzlhl8cTly_yZzM
sh <Package Folder>/files/RORzEVggUkJkpuAThH6Y2PWE
sh <Package Folder>/files/ROjbycZYFUDqpFbpsi4A61lH
sh <Package Folder>/files/ROz5YI57R0YboKjwBdhetbmE
sh <Package Folder>/files/RPUbQkWvCERfpF-Xyci1cwWn
stat app
stat cat
stat etc
stat net
stat random
uname -a
uname -r

Loads the following dynamic libraries:

Bugly
InnoSecure
InnoSo
NativeExample
du
getuiext2
jcore118
libjiagu-1385524905
tnet-3.1

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
RSA
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Manages Wi-Fi connectivity.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial