Adware.Gexin.11546

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) 2####.146.244.104:85
TCP(HTTP/1.1) s####.m.img####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8011
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) cdn.4399yo####.439####.net:80
TCP(HTTP/1.1) m####.4399yo####.439####.net:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) f1.img####.com:80
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) f1.img####.com:443
TCP(TLS/1.0) e.crashly####.com:443
TCP(TLS/1.0) m####.439####.net:443
TCP(TLS/1.0) ptl####.4####.com:443
TCP(TLS/1.0) ptl####.330####.net:443
TCP(TLS/1.0) g####.4####.com:443
TCP(TLS/1.0) fs.img####.com:443
TCP(TLS/1.0) sett####.crashly####.com:443
TCP(TLS/1.0) cdn.4399yo####.439####.net:443
TCP c####.g####.ig####.com:5226
TCP sdk.o####.t####.####.com:5224

DNS requests:

7j####.c####.z0.####.com
a####.b####.qq.com
a.4####.cn
a.img####.com
aexcep####.b####.qq.com
and####.b####.qq.com
c####.g####.ig####.com
c-h####.g####.com
cdn.4399yo####.com
e.crashly####.com
f1.img####.com
fs.img####.com
g####.4####.com
log.u####.com
m####.439####.net
m####.4399yo####.com
plb####.u####.com
ptl####.330####.net
ptl####.4####.com
pub-####.qin####.com
s####.m.img####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
sett####.crashly####.com
sj2.img####.com
u####.u####.com

HTTP GET requests:

cdn.4399yo####.439####.net/app/android/v3.1/game-detail.html?gameId=####
f1.img####.com/app/android/v3.1/follow-relation.html?otherUids=####&apkN...
f1.img####.com/app/android/v3.1/payGift-room.html
f1.img####.com/app/android/v3.1/payGift.html
f1.img####.com/app/android/v3.1/tvManager-typeSetting.html
f1.img####.com/app/android/v3.1/tvPlay-ad.html?roomId=####&apkName=####&...
f1.img####.com/app/android/v3.1/tvPlay-carryPoint.html?anchor_uid=####
f1.img####.com/app/android/v3.1/tvPlay-wapShare.html?push_id=####
f1.img####.com/app/android/v3.1/tvPlay.html?apk_version=####&room_id=###...
f1.img####.com/app/android/v3.1/tvRemind-isSet.html?anchorUid=####&apkNa...
f1.img####.com/app/android/v3.1/tvReport-rules.html
f1.img####.com/app/android/v3.1/tvReward-list.html?apkName=####&game_id=...
f1.img####.com/app/android/v3.1/tvReward-list.html?total=####
f1.img####.com/app/android/v3.1/tvReward-sunshineSetting.html
f1.img####.com/app/android/v3.1/tvReward-uk.html?type=####&anchorUid=####
f1.img####.com/app/android/v3.1/user-channel.html?anchor_uid=####
f1.img####.com/ma~508_20180806163836_5b68090c9014c.png?t=####
f1.img####.com/sj~u/ga/1774754210/2019/03/14/15_oxZQqP.960x640.jpg
m####.4399yo####.439####.net/app/android/v3.1/custom-FootMenu.html
m####.4399yo####.439####.net/app/android/v3.1/face-list.html
m####.4399yo####.439####.net/app/android/v3.1/feed-list.html?lastTime=##...
m####.4399yo####.439####.net/app/android/v3.1/game-homeRec.html
m####.4399yo####.439####.net/app/android/v3.1/game-tabTvList.html?gameId...
m####.4399yo####.439####.net/app/android/v3.1/game-topRec.html
m####.4399yo####.439####.net/app/android/v3.1/home-background.html
m####.4399yo####.439####.net/app/android/v3.1/home-getConfig.html?apkNam...
m####.4399yo####.439####.net/app/android/v3.1/home-getConfig.html?appVer...
m####.4399yo####.439####.net/app/android/v3.1/home-hot.html
m####.4399yo####.439####.net/app/android/v3.1/home-popAd.html?start_firs...
m####.4399yo####.439####.net/app/android/v3.1/home-searchHot.html
m####.4399yo####.439####.net/app/android/v3.1/level-step.html
m####.4399yo####.439####.net/app/android/v3.1/push-updatePushId.html?pla...
m####.4399yo####.439####.net/app/android/v3.1/rss-isUpdate.html?lastTime...
m####.4399yo####.439####.net/app/android/v3.1/tvReward-list.html?total=#...
m####.4399yo####.439####.net/downloader/youpai/tools/resource_20171205.5...
qin####.com.www.####.com/tdata_EDT369
t####.c####.q####.####.com/tdata_JNg986
t####.c####.q####.####.com/tdata_MkX219
t####.c####.q####.####.com/tdata_iRz660
t####.c####.q####.####.com/tdata_zzW503
ti####.c####.l####.####.com/config/hz-hzv3.conf

HTTP POST requests:

aexcep####.b####.qq.com:8011/rqd/async
aexcep####.b####.qq.com:8012/rqd/async
and####.b####.qq.com/rqd/async
c-h####.g####.com/api.php?format=####&t=####
f1.img####.com/app/android/v3.1/chat-msg.html
f1.img####.com/app/android/v3.1/tvManager-relate.html
f1.img####.com/app/android/v3.1/tvPlay-join.html
m####.4399yo####.439####.net/app/android/v2.2/feedback-getMessage.html
m####.4399yo####.439####.net/app/android/v3.1/app-getUdid.html
m####.4399yo####.439####.net/app/android/v3.1/user-isDyed.html
s####.m.img####.com/trace/<Package>/1.0/4399Game/
s####.m.img####.com/trace/<Package>/1.0/4399Game/.config?version=####
s####.m.img####.com/trace/<Package>/1.0/meizu/
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

File system changes:

Creates the following files:

/data/data/####/-1769862752193252826
/data/data/####/-663220944-1819838947
/data/data/####/.imprint
/data/data/####/.policy
/data/data/####/00f63ebecab6a9001d3c4d867e7d64187f8fb7b3d2da970....0.tmp
/data/data/####/05ec2acfd4d6f0ee87b67417203a49b3.png
/data/data/####/07785c9cf1711ea6315e26d3f4dbc6c23a89bf9cae03d54....0.tmp
/data/data/####/1.png
/data/data/####/10.png
/data/data/####/101558accde15b3588779f060679767536f5e6622755b10....0.tmp
/data/data/####/11.png
/data/data/####/12.png
/data/data/####/1298155f3790ccad425c21670a1a9689c125b56f9fae713....0.tmp
/data/data/####/13.png
/data/data/####/14.png
/data/data/####/15.png
/data/data/####/1516606873
/data/data/####/16.png
/data/data/####/1678467419-1345754950
/data/data/####/17.png
/data/data/####/1708877312708752245
/data/data/####/18.png
/data/data/####/19.png
/data/data/####/2.png
/data/data/####/20.png
/data/data/####/21.png
/data/data/####/22.png
/data/data/####/23.png
/data/data/####/235127de1b83e88ded2ef1017c2286c3266cba4cce6a418....0.tmp
/data/data/####/24.png
/data/data/####/25.png
/data/data/####/26.png
/data/data/####/27.png
/data/data/####/28.png
/data/data/####/28a9d1e00baa0a6bff453d6faff9bf9884eb60082353267....0.tmp
/data/data/####/29.png
/data/data/####/3.mp3
/data/data/####/3.png
/data/data/####/30.png
/data/data/####/31.png
/data/data/####/311eb83e5ce768eff0528417752690704ccbbe9f435a768....0.tmp
/data/data/####/32.png
/data/data/####/33.png
/data/data/####/34.png
/data/data/####/35.png
/data/data/####/36.png
/data/data/####/37.png
/data/data/####/38.png
/data/data/####/39.png
/data/data/####/4.mp3
/data/data/####/4.png
/data/data/####/40.png
/data/data/####/41.png
/data/data/####/42.png
/data/data/####/43.png
/data/data/####/44.png
/data/data/####/45.png
/data/data/####/456c7d8a50465a25a25724e73f9cbabc142d8f9000430c3....0.tmp
/data/data/####/46.png
/data/data/####/468fedbf6af3d9aab9716b36e547128294943d9b3c20d40....0.tmp
/data/data/####/47.png
/data/data/####/48.png
/data/data/####/49.png
/data/data/####/5.mp3
/data/data/####/5.png
/data/data/####/50.png
/data/data/####/51.png
/data/data/####/52.png
/data/data/####/53.png
/data/data/####/54.png
/data/data/####/55.png
/data/data/####/56.png
/data/data/####/57.png
/data/data/####/58.png
/data/data/####/59.png
/data/data/####/5CA4224B035A-0001-08FD-44BB842D6BA2BeginSession.cls_temp
/data/data/####/5CA4224B035A-0001-08FD-44BB842D6BA2BeginSession.json
/data/data/####/5CA4224B035A-0001-08FD-44BB842D6BA2SessionApp.cls_temp
/data/data/####/5CA4224B035A-0001-08FD-44BB842D6BA2SessionApp.json
/data/data/####/5CA4224B035A-0001-08FD-44BB842D6BA2SessionDevice.cls_temp
/data/data/####/5CA4224B035A-0001-08FD-44BB842D6BA2SessionDevice.json
/data/data/####/5CA4224B035A-0001-08FD-44BB842D6BA2SessionOS.cls_temp
/data/data/####/5CA4224B035A-0001-08FD-44BB842D6BA2SessionOS.json
/data/data/####/6.png
/data/data/####/60.png
/data/data/####/60fe24653b198fd4cce320f99ad1c07bb8d8de73f5251db....0.tmp
/data/data/####/61.png
/data/data/####/62.png
/data/data/####/63.png
/data/data/####/65.png
/data/data/####/66.png
/data/data/####/67.png
/data/data/####/7.png
/data/data/####/716c6639f0bb8268612fe3b74e036e0886035d562c67187....0.tmp
/data/data/####/774e406687f6d51faf80b5b2f4a4dfad7025896e713e694....0.tmp
/data/data/####/8.png
/data/data/####/840fa5aef13c2f68fd5859188498a8bc944c1f066e91e6a....0.tmp
/data/data/####/87463b800ea638b60f7ad6dc46a537d93440b1158d65c33....0.tmp
/data/data/####/9.png
/data/data/####/9296965b320013d243c633fdc7e3cf2a.png
/data/data/####/9654d3a491918be11aa11889a3d128186fe8f9052799507....0.tmp
/data/data/####/Gift.xml
/data/data/####/MultiDex.lock
/data/data/####/MyAnalytics_VERSION_INFO.xml
/data/data/####/MyAnalytics_device_id.xml
/data/data/####/MyAnalytics_general_config.xml
/data/data/####/MyAnalytics_send_config.xml
/data/data/####/TwitterAdvertisingInfoPreferences.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/YouPaiSDK.xml
/data/data/####/YouPaiSDK.xml.bak
/data/data/####/YouPai_emoji.json
/data/data/####/a33b23816ef1e42b7b5ad154d275a4544bf71b1cb1ddd0f....0.tmp
/data/data/####/a==8.0.0&&3.1.1.38_1554260558763_envelope.log
/data/data/####/bedab197b0b8ef08aa7d283c38477571f860b633c29578c....0.tmp
/data/data/####/bf2f6a3864d20eb8f5f7b2201a75d812c6682cccf09b299....0.tmp
/data/data/####/bugly_db_legu-journal
/data/data/####/c0d9e6bc8688e5f34f68848285bdb33c3980c368dc45357....0.tmp
/data/data/####/c3a9218a414e89f66cb3c664d4851755ec52d49a44dc13a....0.tmp
/data/data/####/com.crashlytics.prefs.xml
/data/data/####/com.crashlytics.sdk.android;answers;settings.xml
/data/data/####/com.crashlytics.settings.json
/data/data/####/com.m4399.youpai_preferences.xml
/data/data/####/crashlytics-userlog-5CA4224B035A-0001-08FD-44BB...mp.tmp
/data/data/####/d57a591b64628fa38274d949da177d2eb34294fa4cd4097....0.tmp
/data/data/####/dW1weF9pbnRlcm5hbF8xNTU0MjYwNTU1ODEw;
/data/data/####/dW1weF9zaGFyZV8xNTU0MjYwNTYwMzA1;
/data/data/####/dW1weF9zaGFyZV8xNTU0MjYwNTYxMjg5;
/data/data/####/da3daf36e27fc34d573e8cab218a1f71d565ffb0fb70708....0.tmp
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/db675bc9c3ba74445ed49ffff2175823c74131a9e3a71f5....0.tmp
/data/data/####/description
/data/data/####/e125d40ac74bd5e37e95577c409eda2c.png
/data/data/####/e5bdc035243b
/data/data/####/e7d2614a84ae8835977fb373e1e6a67621308d6beed7cc0....0.tmp
/data/data/####/e97886dd6ffadc872eb80597711cc708ce8f416ad24ddf3....0.tmp
/data/data/####/emoji.xml
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f70f34a9c32dfa02c3c0717a9ed787c15b4b5561f7bc814....0.tmp
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/feedbackConfig.xml
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/home_tab_config.xml
/data/data/####/i==1.2.0&&3.1.1.38_1554260555887_envelope.log
/data/data/####/icon.png
/data/data/####/im.db-journal
/data/data/####/index
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/initialization_marker
/data/data/####/io.fabric.sdk.android;fabric;io.fabric.sdk.android.m.xml
/data/data/####/journal.tmp
/data/data/####/libnfix.so
/data/data/####/libshella-3.0.0.0.so
/data/data/####/libufix.so
/data/data/####/local_crash_lock
/data/data/####/m4399_gift_multi_3.png
/data/data/####/m4399_gift_multi_4.png
/data/data/####/m4399_gift_multi_5.png
/data/data/####/m4399_gift_multi_6.png
/data/data/####/m4399_gift_type_100.png
/data/data/####/m4399_gift_type_101.png
/data/data/####/m4399_gift_type_101_multi.gif
/data/data/####/m4399_gift_type_101_multi.png
/data/data/####/m4399_gift_type_102.gif
/data/data/####/m4399_gift_type_103.gif
/data/data/####/m4399_gift_type_103.png
/data/data/####/m4399_gift_type_104.gif
/data/data/####/m4399_gift_type_104.png
/data/data/####/m4399_gift_type_105.png
/data/data/####/m4399_gift_type_105_multi.gif
/data/data/####/m4399_gift_type_105_multi.png
/data/data/####/m4399_gift_type_106.png
/data/data/####/m4399_gift_type_107.gif
/data/data/####/m4399_gift_type_107.png
/data/data/####/m4399_gift_type_108.gif
/data/data/####/m4399_gift_type_108.png
/data/data/####/m4399_gift_type_109.png
/data/data/####/m4399_gift_type_109_multi.gif
/data/data/####/m4399_gift_type_109_multi.png
/data/data/####/m4399_gift_type_110.png
/data/data/####/m4399_gift_type_111.gif
/data/data/####/m4399_gift_type_111.png
/data/data/####/m4399_gift_type_112.gif
/data/data/####/m4399_gift_type_112.png
/data/data/####/m4399_gift_type_113.gif
/data/data/####/m4399_gift_type_113.png
/data/data/####/m4399_gift_type_114.gif
/data/data/####/m4399_gift_type_114.png
/data/data/####/m4399_gift_type_115.png
/data/data/####/m4399_gift_type_116.gif
/data/data/####/m4399_gift_type_116.png
/data/data/####/m4399_gift_type_117.gif
/data/data/####/m4399_gift_type_117.png
/data/data/####/m4399_gift_type_118.png
/data/data/####/m4399_gift_type_119.png
/data/data/####/m4399_gift_type_120.png
/data/data/####/m4399_gift_type_121.png
/data/data/####/m4399_gift_type_121_multi.gif
/data/data/####/m4399_gift_type_121_multi.png
/data/data/####/m4399_gift_type_122.gif
/data/data/####/m4399_gift_type_122.png
/data/data/####/m4399_gift_type_123.gif
/data/data/####/m4399_gift_type_123.png
/data/data/####/m4399_gift_type_124.gif
/data/data/####/m4399_gift_type_124.png
/data/data/####/m4399_gift_type_125.gif
/data/data/####/m4399_gift_type_125.png
/data/data/####/m4399_gift_type_126.gif
/data/data/####/m4399_gift_type_126.png
/data/data/####/m4399_gift_type_127.gif
/data/data/####/m4399_gift_type_127.png
/data/data/####/m4399_gift_type_128.gif
/data/data/####/m4399_gift_type_128.png
/data/data/####/m4399_gift_type_129.png
/data/data/####/m4399_gift_type_129_multi.gif
/data/data/####/m4399_gift_type_129_multi.png
/data/data/####/m4399_gift_type_130.png
/data/data/####/m4399_gift_type_130_multi.gif
/data/data/####/m4399_gift_type_130_multi.png
/data/data/####/m4399_gift_type_97.png
/data/data/####/m4399_gift_type_98.png
/data/data/####/m4399_gift_type_99.gif
/data/data/####/m4399_gift_type_99.png
/data/data/####/mix.dex
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/resource.zip
/data/data/####/run.pid
/data/data/####/sa_031de860-df61-405a-95ee-79dbf178d49a_1554260558862.tap
/data/data/####/sa_ce1abaee-45d8-4a3c-bb23-a232fe80aa07_1554260556317.tap
/data/data/####/security_info
/data/data/####/session_analytics.tap
/data/data/####/session_analytics.tap.tmp
/data/data/####/share.db-journal
/data/data/####/statistics_agent_cached_com.m4399.youpai
/data/data/####/switch_config.xml
/data/data/####/t==8.0.0&&3.1.1.38_1554260558228_envelope.log
/data/data/####/tdata_JNg986
/data/data/####/tdata_JNg986.jar
/data/data/####/tdata_MkX219
/data/data/####/tdata_MkX219.jar
/data/data/####/tdata_iRz660
/data/data/####/tdata_iRz660.jar
/data/data/####/tdata_zzW503
/data/data/####/tdata_zzW503.jar
/data/data/####/temp_-1109133710_handled
/data/data/####/temp_-1109404866_handled
/data/data/####/temp_-1284373008_handled
/data/data/####/temp_-1527050104_handled
/data/data/####/temp_-1565136716_handled
/data/data/####/temp_-1585050353_handled
/data/data/####/temp_-1803631969_handled
/data/data/####/temp_-1860618003_handled
/data/data/####/temp_-1894249619_handled
/data/data/####/temp_-1943283976_handled
/data/data/####/temp_-2043024344_handled
/data/data/####/temp_-2096919079_handled
/data/data/####/temp_-2101498452_handled
/data/data/####/temp_-2120813278_handled
/data/data/####/temp_-303562188_handled
/data/data/####/temp_-381786810_handled
/data/data/####/temp_-461584333_handled
/data/data/####/temp_-548735123_handled
/data/data/####/temp_-620892306_handled
/data/data/####/temp_-624363591_handled
/data/data/####/temp_-647426056_handled
/data/data/####/temp_-671752895_handled
/data/data/####/temp_-819145909_handled
/data/data/####/temp_1090262690_handled
/data/data/####/temp_1115339674_handled
/data/data/####/temp_1310482493_handled
/data/data/####/temp_1372042681_handled
/data/data/####/temp_1429448333_handled
/data/data/####/temp_1443805914_handled
/data/data/####/temp_1490755561_handled
/data/data/####/temp_1532317357_handled
/data/data/####/temp_1583372673_handled
/data/data/####/temp_1739559587_handled
/data/data/####/temp_1798335989_handled
/data/data/####/temp_2022235159_handled
/data/data/####/temp_2055308959_handled
/data/data/####/temp_263473427_handled
/data/data/####/temp_355118904_handled
/data/data/####/temp_499124322_handled
/data/data/####/temp_528774421_handled
/data/data/####/temp_565852231_handled
/data/data/####/temp_667821959_handled
/data/data/####/temp_695190380_handled
/data/data/####/temp_915868489_handled
/data/data/####/temp_945381045_handled
/data/data/####/type_game_select.png
/data/data/####/type_game_unselect.png
/data/data/####/type_home_select.png
/data/data/####/type_home_unselect.png
/data/data/####/type_mine_select.png
/data/data/####/type_mine_unselect.png
/data/data/####/type_mycircle_select.png
/data/data/####/type_mycircle_unselect.png
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/youpai.db-journal
/data/data/####/youpaiConfig.xml
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.disys
/data/media/####/.systemudid
/data/media/####/.test.txt
/data/media/####/.umm.dat
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.m4399.youpai.bin
/data/media/####/com.m4399.youpai.db
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/tdata_JNg986
/data/media/####/tdata_MkX219
/data/media/####/tdata_iRz660
/data/media/####/tdata_zzW503
/data/media/####/test.log

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop ro.aa.romver
/system/bin/sh -c getprop ro.board.platform
/system/bin/sh -c getprop ro.build.fingerprint
/system/bin/sh -c getprop ro.build.nubia.rom.name
/system/bin/sh -c getprop ro.build.rom.id
/system/bin/sh -c getprop ro.build.tyd.kbstyle_version
/system/bin/sh -c getprop ro.build.version.emui
/system/bin/sh -c getprop ro.build.version.opporom
/system/bin/sh -c getprop ro.gn.gnromvernumber
/system/bin/sh -c getprop ro.lenovo.series
/system/bin/sh -c getprop ro.lewa.version
/system/bin/sh -c getprop ro.meizu.product.model
/system/bin/sh -c getprop ro.miui.ui.version.name
/system/bin/sh -c getprop ro.vivo.os.build.display.id
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.push.GTPushService 24400 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 700 <Package Folder>/tx_shell/libnfix.so
chmod 700 <Package Folder>/tx_shell/libshella-3.0.0.0.so
chmod 700 <Package Folder>/tx_shell/libufix.so
getprop ro.aa.romver
getprop ro.board.platform
getprop ro.build.fingerprint
getprop ro.build.nubia.rom.name
getprop ro.build.rom.id
getprop ro.build.tyd.kbstyle_version
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.gn.gnromvernumber
getprop ro.lenovo.series
getprop ro.lewa.version
getprop ro.meizu.product.model
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id
getprop ro.yunos.version
logcat -d -v threadtime
ls /
ls /sys/class/thermal
mount
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.service.push.GTPushService 24400 300 0

Loads the following dynamic libraries:

Bugly
getuiext2
ijkffmpeg
ijkplayer
ijksdl
libnfix
libshella-3.0.0.0
libufix
nfix
ufix

Uses the following algorithms to encrypt data:

AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Uses special library to hide executable bytecode.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial