Adware.Gexin.6633

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Accesses the ITelephony private interface.

Network activity:

Connects to:

UDP(DNS) <Google DNS>
UDP(DNS) 1####.29.29.29:53
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) api.1####.com:80
TCP(HTTP/1.1) log.1####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) c####.v####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) i####.1####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) ddd.1####.com:80
TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
TCP(TLS/1.0) h####.qktou####.com:443
TCP(TLS/1.0) et2-na6####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) and####.cli####.go####.com:443
TCP(TLS/1.0) qfy.innot####.com:443
TCP(TLS/1.0) res####.a####.com:443
TCP(TLS/1.0) api.1####.com:443
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) h####.1####.com:443
TCP(TLS/1.0) lo####.qutou####.net:443
TCP(TLS/1.0) recall-####.1####.com:443
TCP(TLS/1.0) msg.umengc####.com:443
TCP c####.g####.ig####.com:5224
UDP 1####.168.108.1:137
TCP sdk.o####.t####.####.com:5224
TCP ope####.m.ta####.com:443

DNS requests:

7j####.c####.z0.####.com
a####.man.aliy####.com
ag####.m.ta####.com
amap####.cn-hang####.oss####.####.com
amdc####.m.ta####.com
and####.b####.qq.com
and####.cli####.go####.com
api.1####.com
apk.1####.com
c####.g####.ig####.com
c####.v####.com
c-h####.g####.com
ddd.1####.com
h####.1####.com
h####.qktou####.com
i####.1####.com
lo####.qutou####.net
log.1####.com
msg.umengc####.com
plb####.u####.com
qfy.innot####.com
recall-####.1####.com
res####.a####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
u####.u####.com
umen####.m.ta####.com
umengj####.m.ta####.com

HTTP GET requests:

api.1####.com/activity/getActivityCardList?platform=####&lon=####&device...
api.1####.com/app/coldStart?lon=####&device_code=####&OSVersion=####&dev...
api.1####.com/app/getConfig?lon=####&device_code=####&OSVersion=####&dev...
api.1####.com/app/start?model=####&lon=####&device_code=####&OSVersion=#...
api.1####.com/component/getFeComponentInfo?name=####&currtime=####&sign=...
api.1####.com/search/static/middle/middle_1544531721722.zip?lon=####&tim...
i####.1####.com/qukan_new2/dest/art2/read/art2/template.html
i####.1####.com/qukan_new2/dest/art2/read/art2/template.html.md5
log.1####.com/a.gif?lon=####&device_code=####&OSVersion=####&deviceCode=...
sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
t####.c####.q####.####.com/tdata_vHH584
t####.c####.q####.####.com/tdata_wmL809
ti####.c####.l####.####.com/config/hz-hzv3.conf

HTTP POST requests:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
and####.b####.qq.com/rqd/async?aid=####
api.1####.com/app/extendReport
api.1####.com/member/isDeviceReport
c####.v####.com/public/appsdk/init
c-h####.g####.com/api.php?format=####&t=####
ddd.1####.com/report
sdk.o####.p####.####.com/api.php?format=####&t=####
sh.wagbr####.aliyun####.com/man/api?ak=####&s=####

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/427a1a85bec2908cae88976fa19f8fba
/data/data/####/427a1a85bec2908cae88976fa19f8fba.tmp
/data/data/####/846de1b5cced27919c5631c45d038e76.0.tmp
/data/data/####/846de1b5cced27919c5631c45d038e76.1.tmp
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/QK_room-journal
/data/data/####/T-AWI7kEW7zNO-6jUJxq6kUPuVPFi9rr
/data/data/####/T-C0WghytjaBBvgKlospQkWXL-Qzzwvk
/data/data/####/T-CbBye7sZg_GlpydJwuc0yrhoIdb_Os
/data/data/####/T0RyQUf2nVWlKvUlKo8so0NtU0_9ZsIm
/data/data/####/T0maYIOd0-k3Wp7F9J5ug05UhJWDH70Q
/data/data/####/T2nYAuUySe9KlMg7uYm6JkySbTaIMu5d
/data/data/####/T2vWjx8fC5RXEwdE1aM4z02-dPG9Q0-O
/data/data/####/T4IBtmTLHCTz2UVMqYPOl0xYYrtzMRhB
/data/data/####/T4XNmLNiB9eCc1VWoIxTu0-QWLhM4Fx0
/data/data/####/T5_Rg_YO_Tjfxuway75J8EzyhBxMvvbB
/data/data/####/T6K-k4nyy7QUJAnunIrwvUCYeEd4Dez8
/data/data/####/T6n5ztXNSemRbVHB64Jp_klV9KFic47M
/data/data/####/T6spAdzMMvRGErrD_pKpIUY3NdKvbABG
/data/data/####/T7hA5RCmgi2h7-3XGJnTOkrZNYpL05Dg
/data/data/####/T7nzNbnUyLJqIKbNE6dhIEeNIdpj1mPn
/data/data/####/T8i6QCCTi10kkkAtuL5OU0VeyEmv_b42
/data/data/####/T8t96dXqMXJ1TqOfqoMAN0Oy-KGkvYO1
/data/data/####/T8zijPhHlSqpgXtTvK-SAkKH5Un3dudI
/data/data/####/T98DZWgpjyp5iH1qpYUrqUsgvYDQssrS
/data/data/####/T9FuEYERHupZ1H0vdZpsL0igEdAiKdek
/data/data/####/T_6Wfjz8TCy-jlXpr66jVEw4Fi5JtuD9
/data/data/####/T_hmxoSBGOgI3C1ZJ6hMZE1e5mFE7PYC
/data/data/####/T_okYb9k_90TYxIxs4snbU_y-ghxEexY
/data/data/####/TwpHAHyA8Z_HLpwQE7jCR0dy3yjJUQ0u
/data/data/####/TxcK5ilN5URwlhvXmpNh0EXVqMd-KJMx
/data/data/####/Ty0VIg772euYHGKR6ZcNl0gq9ZWyqTPc
/data/data/####/TySvrwwTUqDc-6Cd-oPMIUQFByLb2T5j
/data/data/####/TyTYKKgnv46M_9_W8KST00FW49kUv8Np
/data/data/####/Ty_YB3c06q_6oDulDrLhrkDuTFJdhQhw
/data/data/####/TyzjYxTseZDxB8SNoaJ01UJbauvoJ3hM
/data/data/####/Tzzc4gPX2ut8EzEBz6GgIU886KtVc2zC
/data/data/####/_download_1544965116
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/andpatch.xml
/data/data/####/andpatch_extra.xml
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/com.jifen.qukan-journal
/data/data/####/com.jifen.qukan.xml
/data/data/####/com.jifen.qukan_preferences.xml
/data/data/####/com.jifen.qukan_prefs.xml
/data/data/####/com.sensorsdata.analytics.android.sdk.SensorsDataAPI.xml
/data/data/####/crashrecord.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0OTY1MDk0NTE2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0OTY1MTA3NTYw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0OTY1MTAwMTA3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0OTY1MTE1Njgz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0OTY1MTI2NTkx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0OTY1MTM2NDEy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0OTY1MTM5MDgy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0OTY1MTQ0MDI2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0OTY1MTQxNDY2;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTQ0OTY1MTUzMTk1;
/data/data/####/dW1weF9wdXNoX2xhdW5jaF8xNTQ0OTY1MTYzNjk2;
/data/data/####/dW1weF9wdXNoX3JlZ2lzdGVyXzE1NDQ5NjUxMDgwMjQ=;
/data/data/####/daemon
/data/data/####/dafile.db
/data/data/####/dafile.db-journal
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/hmdb
/data/data/####/hmdb-journal
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&3.9.1.000.1213.1041_1544965094776_envelope.log
/data/data/####/i==1.2.0&&3.9.1.000.1213.1041_1544965100224_envelope.log
/data/data/####/i==1.2.0&&3.9.1.000.1213.1041_1544965107647_envelope.log
/data/data/####/i==1.2.0&&3.9.1.000.1213.1041_1544965116667_envelope.log
/data/data/####/i==1.2.0&&3.9.1.000.1213.1041_1544965126708_envelope.log
/data/data/####/i==1.2.0&&3.9.1.000.1213.1041_1544965136738_envelope.log
/data/data/####/index
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal
/data/data/####/journal.tmp
/data/data/####/libjiagu-1385524905.so
/data/data/####/local_crash_lock
/data/data/####/loctemp.so
/data/data/####/logdb.db
/data/data/####/logdb.db-journal
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/pref.xml
/data/data/####/proc_monitor_local_rec_main.xml
/data/data/####/proc_monitor_local_rec_push.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qk_app.xml
/data/data/####/qk_app.xml.bak
/data/data/####/qk_app.xml.bak (deleted)
/data/data/####/qk_crash_report_cache.xml
/data/data/####/qk_push_sp.xml
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/sensorsdata.xml
/data/data/####/statistic_all_new_log.db
/data/data/####/statistic_all_new_log.db-journal
/data/data/####/statistic_all_new_log.db_init
/data/data/####/statistic_all_new_log.db_init-journal
/data/data/####/statistic_all_new_log.db_pushservice
/data/data/####/statistic_all_new_log.db_pushservice-journal
/data/data/####/sys_log_1544965101260689.txt
/data/data/####/tdata_vHH584
/data/data/####/tdata_vHH584.jar
/data/data/####/tdata_wmL809
/data/data/####/tdata_wmL809.jar
/data/data/####/timer_ab.xml
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/v5kf_client.xml
/data/data/####/v5kf_emoticons.db
/data/data/####/v5kf_emoticons.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.acid
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.acid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid
/data/media/####/.301d574ef42563b03638c8eae19225cb.acid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.acid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.cuid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.acid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.acid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.acid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.acid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid
/data/media/####/.5454aa1a50f52737de04f35ca206c3e6.acid
/data/media/####/.5454aa1a50f52737de04f35ca206c3e6.cuid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.acid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.cuid
/data/media/####/.595b157df788ac0a270a61af4e82461b.acid
/data/media/####/.595b157df788ac0a270a61af4e82461b.cuid
/data/media/####/.6829d1667526200f340b0ebbc50f1799.acid
/data/media/####/.6829d1667526200f340b0ebbc50f1799.cuid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.acid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid
/data/media/####/.79594990e265ac60591761aa24fbd681.acid
/data/media/####/.79594990e265ac60591761aa24fbd681.cuid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.acid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.acid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.acid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.acid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.cuid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.acid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.acid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.acid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid
/data/media/####/.a.dat
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.acid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid
/data/media/####/.a813fc513e2acbdc7dbb94a2b0444a01.acid
/data/media/####/.a813fc513e2acbdc7dbb94a2b0444a01.cuid
/data/media/####/.adfwe.dat
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.acid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.acid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.cuid
/data/media/####/.c3418983f96107fb595049c67426dc08.acid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.acid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.cuid
/data/media/####/.cc8dd1145e0a2d862cf37183282bd82c.acid
/data/media/####/.cc8dd1145e0a2d862cf37183282bd82c.cuid
/data/media/####/.cca.dat
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.acid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.cuid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.acid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.acid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.cuid
/data/media/####/.nomedia
/data/media/####/.umm.dat
/data/media/####/0c61135c2fdcd71f15ad7297245abe44
/data/media/####/378d7b2b99a34fad9ef1a20fc006c2a4
/data/media/####/38c2f2f80db54f2f9f84c5fdaa0291f7
/data/media/####/77e4a1addf9743fb89c96b8f0921bb2e
/data/media/####/8c3a3cea56db4cc59e6d5474876319c9
/data/media/####/976d006219f14624bd3c33b754fbf215
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/aacout
/data/media/####/af7f92bbc75e47d6a1e31486028979bd
/data/media/####/alsn.db
/data/media/####/alsn.db-journal
/data/media/####/app.db
/data/media/####/axacount
/data/media/####/b1f8a010618648baaba97d2b8027a764
/data/media/####/b7d336f9e8f244eab61be64113ccbccf
/data/media/####/b9391b40a8e34b2cbbeb6cf77143b5e0
/data/media/####/cb38d394ce764cadaf666f2eafa3340d
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.jifen.qukan.bin
/data/media/####/com.jifen.qukan.db
/data/media/####/crash-2018-12-16.log
/data/media/####/cusc
/data/media/####/cusys
/data/media/####/deviceToken
/data/media/####/qtac
/data/media/####/sysid.dat
/data/media/####/systemccu
/data/media/####/tdata_vHH584
/data/media/####/tdata_wmL809
/data/media/####/template.html
/data/media/####/test.log
/data/media/####/wcout
/data/media/####/weitac
/data/media/####/wxtac

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/netcfg
/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:57578e4d67e58e4c810000d2","utdid":"XBZL5XdhkN0DAGdzx1FcaadG","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.jifen.framework.push.getui.GTCoreService 24479 300 0
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/app_bin/daemon
chmod 700 <Package Folder>/files/gdaemon_20161017
df
getprop
getprop net.hostname
getprop persist.service.bdroid.bdaddr
getprop ro.boot.bootloader
getprop ro.boot.boottime
getprop ro.build.date.utc
getprop ro.build.version.emui
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.product.cpu.abi
getprop ro.product.cpu.abi2
getprop ro.recovery_id
getprop ro.runtime.firstboot
getprop ro.serialno
getprop ro.smartisan.version
getprop ro.vivo.os.version
id
logcat -d -v threadtime
ls -i
ls -l
ls /sys/class/thermal
mount
ps
sh
sh -c cat /etc/sensor_def_hh.conf
sh -c cat /proc/devices
sh -c cat /proc/mounts
sh -c cat /proc/partitions
sh -c cat /proc/self/maps
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /system/ && stat etc
sh -c cd /acct && ls -i
sh -c cd /sys/class/ && stat net
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /sys/devices/system/cpu/cpu0/cpufreq/ && stat cpuinfo_max_freq
sh -c cd /sys/kernel/debug && ls -i
sh -c cd /system && stat app
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd /system/bin/ && stat cat
sh -c cd <SD-Card>/ && ls -i
sh <Package Folder>/files/T-AWI7kEW7zNO-6jUJxq6kUPuVPFi9rr
sh <Package Folder>/files/T-C0WghytjaBBvgKlospQkWXL-Qzzwvk
sh <Package Folder>/files/T0RyQUf2nVWlKvUlKo8so0NtU0_9ZsIm
sh <Package Folder>/files/T0maYIOd0-k3Wp7F9J5ug05UhJWDH70Q
sh <Package Folder>/files/T2nYAuUySe9KlMg7uYm6JkySbTaIMu5d
sh <Package Folder>/files/T2vWjx8fC5RXEwdE1aM4z02-dPG9Q0-O
sh <Package Folder>/files/T4IBtmTLHCTz2UVMqYPOl0xYYrtzMRhB
sh <Package Folder>/files/T4XNmLNiB9eCc1VWoIxTu0-QWLhM4Fx0
sh <Package Folder>/files/T5_Rg_YO_Tjfxuway75J8EzyhBxMvvbB
sh <Package Folder>/files/T6K-k4nyy7QUJAnunIrwvUCYeEd4Dez8
sh <Package Folder>/files/T6n5ztXNSemRbVHB64Jp_klV9KFic47M
sh <Package Folder>/files/T6spAdzMMvRGErrD_pKpIUY3NdKvbABG
sh <Package Folder>/files/T7hA5RCmgi2h7-3XGJnTOkrZNYpL05Dg
sh <Package Folder>/files/T7nzNbnUyLJqIKbNE6dhIEeNIdpj1mPn
sh <Package Folder>/files/T8i6QCCTi10kkkAtuL5OU0VeyEmv_b42
sh <Package Folder>/files/T8t96dXqMXJ1TqOfqoMAN0Oy-KGkvYO1
sh <Package Folder>/files/T8zijPhHlSqpgXtTvK-SAkKH5Un3dudI
sh <Package Folder>/files/T98DZWgpjyp5iH1qpYUrqUsgvYDQssrS
sh <Package Folder>/files/T9FuEYERHupZ1H0vdZpsL0igEdAiKdek
sh <Package Folder>/files/T_6Wfjz8TCy-jlXpr66jVEw4Fi5JtuD9
sh <Package Folder>/files/T_hmxoSBGOgI3C1ZJ6hMZE1e5mFE7PYC
sh <Package Folder>/files/T_okYb9k_90TYxIxs4snbU_y-ghxEexY
sh <Package Folder>/files/TwpHAHyA8Z_HLpwQE7jCR0dy3yjJUQ0u
sh <Package Folder>/files/TxcK5ilN5URwlhvXmpNh0EXVqMd-KJMx
sh <Package Folder>/files/Ty0VIg772euYHGKR6ZcNl0gq9ZWyqTPc
sh <Package Folder>/files/TySvrwwTUqDc-6Cd-oPMIUQFByLb2T5j
sh <Package Folder>/files/TyTYKKgnv46M_9_W8KST00FW49kUv8Np
sh <Package Folder>/files/TyzjYxTseZDxB8SNoaJ01UJbauvoJ3hM
sh <Package Folder>/files/Tzzc4gPX2ut8EzEBz6GgIU886KtVc2zC
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.jifen.framework.push.getui.GTCoreService 24479 300 0
stat /cache
stat /data
stat /data/app
stat /proc/sys/kernel/random
stat /root
stat app
stat cat
stat etc
stat net
stat random
uname -a
uname -r

Loads the following dynamic libraries:

Bugly
InnoSo
NativeExample
du
getuiext2
libjiagu-1385524905
tnet-3.1

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Manages Wi-Fi connectivity.

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical information

Curing recommendations

Free trial