Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) hk.wagbr####.non####.####.com:80
- TCP(HTTP/1.1) o####.jd.com:80
- TCP(HTTP/1.1) ad####.m.ta####.com:80
- TCP(HTTP/1.1) 2####.205.239.188:80
- TCP(TLS/1.0) gm.mm####.com:443
- TCP(TLS/1.0) www.j####.com:443
- TCP(TLS/1.0) f####.gst####.com:443
- TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
- TCP(TLS/1.0) mobi####.91q####.com.####.com:443
- TCP(TLS/1.0) d####.k.jd.com:443
- TCP(TLS/1.0) 2####.77.129.238:443
- TCP(TLS/1.0) 1####.254.137.143:443
- TCP(TLS/1.0) nbsdk-b####.al####.com:443
- TCP(TLS/1.0) and####.cli####.go####.com:443
- TCP sdk.o####.t####.####.com:5224
DNS requests:
- ad####.m.ta####.com
- and####.cli####.go####.com
- cm-1####.ig####.com
- d####.k.jd.com
- dgst####.jd.com
- f####.gst####.com
- log.u####.com
- mobi####.91q####.com
- nbsdk-b####.al####.com
- o####.jd.com
- plb####.u####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- u####.u####.com
- wgo.mm####.com
- y####.al####.com
HTTP GET requests:
- ad####.m.ta####.com/rest/gc2?ak=####&av=####&c=####&d=####&sv=####&t=###...
HTTP POST requests:
- hk.wagbr####.non####.####.com/saveWb.json
- o####.jd.com/upload
File system changes:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/0a231bd8575dcf72.txt
- /data/data/####/8ef9c457b3bbb403.lock
- /data/data/####/Alvin2.xml
- /data/data/####/ContextData.xml
- /data/data/####/UTCommon.xml
- /data/data/####/UTCommon.xml.bak
- /data/data/####/a==7.5.0&&2.0.0_1565966525792_envelope.log
- /data/data/####/aliTradeConfigSP.xml
- /data/data/####/bugly_db_-journal
- /data/data/####/classes.dex
- /data/data/####/classes.dex;classes2.dex
- /data/data/####/com.tidu.sports.quzou_preferences.xml
- /data/data/####/dW1weF9zaGFyZV8xNTY1OTY2NTI3MDk0;
- /data/data/####/dW1weF9zaGFyZV8xNTY1OTY2NTI3NDI1;
- /data/data/####/deviceid_prefs.xml
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/getui_sp.xml
- /data/data/####/imei.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/kepler_public.xml
- /data/data/####/libsgmain_312768000000.dex
- /data/data/####/libsgmain_312768000000.dex.flock (deleted)
- /data/data/####/libsgsecuritybody_312768000000.dex
- /data/data/####/libsgsecuritybody_312768000000.dex.flock (deleted)
- /data/data/####/libsgsecuritybodyso-5.1.25.so.tmp
- /data/data/####/lock.lock
- /data/data/####/onesdk_device.xml
- /data/data/####/proc_auxv
- /data/data/####/push.pid
- /data/data/####/pushsdk.db-journal
- /data/data/####/run.pid
- /data/data/####/share.db-journal
- /data/data/####/share_data.xml
- /data/data/####/sp.lock
- /data/data/####/timestamp
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_common_config.xml
- /data/data/####/umeng_common_config.xml.bak
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/ut.db
- /data/data/####/ut.db-journal
Miscellaneous:
Executes the following shell scripts:
- /system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_SGLib/libsgsecuritybody_312768000000.zip --oat-fd=96 --oat-location=/data/user/0/<Package>/app_SGLib/libsgsecuritybody_312768000000.dex --compiler-filter=speed
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- AES-CBC-PKCS7Padding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Uses the following algorithms to decrypt data:
- AES-GCM-NoPadding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Displays its own windows over windows of other apps.
