Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) av1.x####.com:443
DNS requests:
- 7f5e492####.bug####.com
- av1.x####.com
- i.t####.com
File system changes:
Creates the following files:
- /data/data/####/1548267097754_2278
- /data/data/####/1548267097781_2278
- /data/data/####/1548267097823_2278
- /data/data/####/1548267098569_2330
- /data/data/####/1548267098616_2330
- /data/data/####/1548267099431_2380
- /data/data/####/1548267099485_2380
- /data/data/####/1548267102491_2440
- /data/data/####/1548267102555_2440
- /data/data/####/1548267103337_2490
- /data/data/####/1548267104135_2540
- /data/data/####/1548267106870_2600
- /data/data/####/1548267107712_2649
- /data/data/####/1548267108523_2698
- /data/data/####/1548267112933_2757
- /data/data/####/1548267114000_2807
- /data/data/####/1548267115044_2856
- /data/data/####/1548267116703_2915
- /data/data/####/1548267117605_2964
- /data/data/####/1548267118553_3013
- /data/data/####/1548267121106_3073
- /data/data/####/1548267121985_3122
- /data/data/####/1548267122883_3171
- /data/data/####/1548267126795_3231
- /data/data/####/1548267127780_3280
- /data/data/####/1548267128747_3329
- /data/data/####/1548267130350_3389
- /data/data/####/1548267131260_3438
- /data/data/####/1548267132151_3487
- /data/data/####/1548267136262_3561
- /data/data/####/1548267137205_3610
- /data/data/####/1548267138132_3659
- /data/data/####/1548267140388_3717
- /data/data/####/1548267141324_3765
- /data/data/####/1548267142307_3814
- /data/data/####/1548267143985_3872
- /data/data/####/1548267145000_3920
- /data/data/####/1548267145936_3968
- /data/data/####/1548267148108_4027
- /data/data/####/1548267149040_4074
- /data/data/####/1548267150022_4121
- /data/data/####/1548267151774_4180
- /data/data/####/1548267152774_4228
- /data/data/####/1548267153728_4276
- /data/data/####/1548267157896_4334
- /data/data/####/1548267159064_4381
- /data/data/####/1548267160128_4428
- /data/data/####/MultiDex.lock
- /data/data/####/TD_app_pefercen_profile.xml
- /data/data/####/TDpref_longtime.xml
- /data/data/####/TDpref_longtime0.xml
- /data/data/####/journal.tmp
- /data/data/####/libjiagu-1443753483.so
- /data/data/####/multidex.version.xml
- /data/data/####/tdid.xml
- /data/media/####/.nomedia
- /data/media/####/.tcookieid
Miscellaneous:
Executes the following shell scripts:
- getprop
- logcat -v time -t 500 2278
- logcat -v time -t 500 2330
- logcat -v time -t 500 2380
- logcat -v time -t 500 2440
- logcat -v time -t 500 2490
- logcat -v time -t 500 2540
- logcat -v time -t 500 2600
- logcat -v time -t 500 2649
- logcat -v time -t 500 2698
- logcat -v time -t 500 2757
- logcat -v time -t 500 2807
- logcat -v time -t 500 2856
- logcat -v time -t 500 2915
- logcat -v time -t 500 2964
- logcat -v time -t 500 3013
- logcat -v time -t 500 3073
- logcat -v time -t 500 3122
- logcat -v time -t 500 3171
- logcat -v time -t 500 3231
- logcat -v time -t 500 3280
- logcat -v time -t 500 3329
- logcat -v time -t 500 3389
- logcat -v time -t 500 3438
- logcat -v time -t 500 3487
- logcat -v time -t 500 3561
- logcat -v time -t 500 3610
- logcat -v time -t 500 3659
- logcat -v time -t 500 3717
- logcat -v time -t 500 3765
- logcat -v time -t 500 3814
- logcat -v time -t 500 3872
- logcat -v time -t 500 3920
- logcat -v time -t 500 3968
- logcat -v time -t 500 4027
- logcat -v time -t 500 4074
- logcat -v time -t 500 4121
- logcat -v time -t 500 4180
- logcat -v time -t 500 4228
- logcat -v time -t 500 4276
- logcat -v time -t 500 4334
- logcat -v time -t 500 4381
- logcat -v time -t 500 4428
Loads the following dynamic libraries:
- Bugtags
- LanSongffmpeg
- libjiagu-1443753483
Uses the following algorithms to encrypt data:
- DES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- DES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
