Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) av1.x####.com:443
DNS requests:
- 7f5e492####.bug####.cn
- av1.x####.com
- i.t####.com
File system changes:
Creates the following files:
- /data/data/####/1556174141850_2295
- /data/data/####/1556174141897_2295
- /data/data/####/1556174141982_2295
- /data/data/####/1556174142929_2346
- /data/data/####/1556174143000_2346
- /data/data/####/1556174144036_2395
- /data/data/####/1556174144133_2395
- /data/data/####/1556174148323_2458
- /data/data/####/1556174149460_2507
- /data/data/####/1556174150868_2555
- /data/data/####/1556174153369_2613
- /data/data/####/1556174154547_2661
- /data/data/####/1556174155570_2709
- /data/data/####/1556174157806_2769
- /data/data/####/1556174158803_2817
- /data/data/####/1556174159846_2865
- /data/data/####/1556174162318_2924
- /data/data/####/1556174163444_2972
- /data/data/####/1556174164706_3020
- /data/data/####/1556174168767_3078
- /data/data/####/1556174169946_3127
- /data/data/####/1556174171017_3175
- /data/data/####/1556174175292_3233
- /data/data/####/1556174176350_3281
- /data/data/####/1556174177486_3329
- /data/data/####/1556174180352_3387
- /data/data/####/1556174181373_3435
- /data/data/####/1556174182463_3483
- /data/data/####/1556174185512_3541
- /data/data/####/1556174186505_3589
- /data/data/####/1556174187531_3638
- /data/data/####/1556174190776_3697
- /data/data/####/1556174191844_3745
- /data/data/####/1556174193097_3795
- /data/data/####/1556174195230_3852
- /data/data/####/1556174196316_3898
- /data/data/####/1556174197430_3944
- /data/data/####/1556174200397_4003
- /data/data/####/1556174201592_4051
- /data/data/####/1556174202602_4097
- /data/data/####/MultiDex.lock
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/TDpref_longtime.xml
- /data/data/####/TDpref_longtime0.xml
- /data/data/####/journal.tmp
- /data/data/####/libjiagu-917064677.so
- /data/data/####/multidex.version.xml
- /data/data/####/tdid.xml
- /data/media/####/.nomedia
- /data/media/####/.tcookieid
Miscellaneous:
Executes the following shell scripts:
- getprop
- logcat -v time -t 500 2295
- logcat -v time -t 500 2346
- logcat -v time -t 500 2395
- logcat -v time -t 500 2458
- logcat -v time -t 500 2507
- logcat -v time -t 500 2555
- logcat -v time -t 500 2613
- logcat -v time -t 500 2661
- logcat -v time -t 500 2709
- logcat -v time -t 500 2769
- logcat -v time -t 500 2817
- logcat -v time -t 500 2865
- logcat -v time -t 500 2924
- logcat -v time -t 500 2972
- logcat -v time -t 500 3020
- logcat -v time -t 500 3078
- logcat -v time -t 500 3127
- logcat -v time -t 500 3175
- logcat -v time -t 500 3233
- logcat -v time -t 500 3281
- logcat -v time -t 500 3329
- logcat -v time -t 500 3387
- logcat -v time -t 500 3435
- logcat -v time -t 500 3483
- logcat -v time -t 500 3541
- logcat -v time -t 500 3589
- logcat -v time -t 500 3638
- logcat -v time -t 500 3697
- logcat -v time -t 500 3745
- logcat -v time -t 500 3795
- logcat -v time -t 500 3852
- logcat -v time -t 500 3898
- logcat -v time -t 500 3944
- logcat -v time -t 500 4003
- logcat -v time -t 500 4051
- logcat -v time -t 500 4097
Loads the following dynamic libraries:
- Bugtags
- LanSongffmpeg
- libjiagu-917064677
Uses the following algorithms to encrypt data:
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- DES-CBC-PKCS5Padding
Accesses the ITelephony private interface.
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
