Adware.Gexin.456

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Gains access to the ITelephony private interface.

Modified file system:

Creates the following files:

/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/015488e09d9fd1020793464f0cf4dbbe8b1
/data/data/####/01ded10df5316878b5d44300e4e230949e1
/data/data/####/02bcab83-4fed-48ab-b90d-22d4a44a16b3
/data/data/####/2033145970-602345128
/data/data/####/21c18572-c485-4aa7-ba1d-0bc2f04596de
/data/data/####/727E4F9E3DF834239309BBBDC87BC476.png
/data/data/####/8c87839ccb4b
/data/data/####/8edc94ed-5b8f-493f-8dcb-1ecf70d35d74
/data/data/####/940c4d66-3655-4ff8-aa1a-89e2d87c552e
/data/data/####/ACCS_BINDumeng;5a56c9198f4a9d0c2f0001a8.xml
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/AGOO_BIND.xml
/data/data/####/AKTorchDownload.db
/data/data/####/AKTorchDownload.db-journal
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alliance.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/FZ.TTF
/data/data/####/JPushSA_Config.xml
/data/data/####/MENU_CACHE.xml
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db-journal
/data/data/####/PendantConfig.xml
/data/data/####/QHA_JSON_PERSISTER_42998cf32d552343bc8e460416382dca
/data/data/####/QHDeviceFile
/data/data/####/QHDeviceID.lock
/data/data/####/QH_DeviceSDK.xml
/data/data/####/QH_SDK_M2.xml
/data/data/####/QH_SDK_UserData42998cf32d552343bc8e460416382dca.xml
/data/data/####/QH_SDK_UserData6766aa2750c19aad2fa1b32f36ed4aee.xml
/data/data/####/QH_SDK_sessionID42998cf32d552343bc8e460416382dca.xml
/data/data/####/TAB_CACHE.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/Y29tLmxpZ2h0c2t5LnZpZGVv.tick.lock
/data/data/####/ab_test_config.xml
/data/data/####/abtest_base_sp_filename42998cf32d552343bc8e4604...ca.xml
/data/data/####/accs.db-journal
/data/data/####/ad_config_file.xml
/data/data/####/agoo.pid
/data/data/####/android_player_20180722_115910_000.log_0
/data/data/####/appPackageNames_v2
/data/data/####/app_globel_config_file.xml
/data/data/####/auth_guide_config_sdk.xml
/data/data/####/banner.db-journal
/data/data/####/cache.ttf
/data/data/####/channel_webview.db-journal
/data/data/####/cloud_config_file.xml
/data/data/####/cloud_push_config_file.xml
/data/data/####/cloud_switch_cache
/data/data/####/cn.jpush.android.user.profile.xml
/data/data/####/cn.jpush.preferences.v2.rid.xml
/data/data/####/cn.jpush.preferences.v2.xml
/data/data/####/com.qihoo.livecloud.settings.GPWebrtcSettings.pref.xml
/data/data/####/com.tencent.open.config.json.1105557253
/data/data/####/core_update
/data/data/####/core_update_locker
/data/data/####/critical_service_config.xml
/data/data/####/daemon_webview.db-journal
/data/data/####/dbfocus-journal
/data/data/####/device_collector
/data/data/####/device_collector_locker
/data/data/####/download-journal
/data/data/####/dso_deps
/data/data/####/dso_lock
/data/data/####/dso_manifest
/data/data/####/dso_state
/data/data/####/e2fe3950-f081-40ed-b1e1-0d8138ec2230
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/finalcore.jar
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/hotrizon_sharepref.xml
/data/data/####/http_cookie.xml
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&1.2.28_1532260739366_envelope.log
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/jpush_device_info.xml
/data/data/####/jpush_local_notification.db
/data/data/####/jpush_local_notification.db-journal
/data/data/####/jpush_local_notification.db-wal
/data/data/####/jpush_stat_cache.json
/data/data/####/jpush_stat_cache_history.json
/data/data/####/jpush_statistics.db
/data/data/####/jpush_statistics.db-journal
/data/data/####/jpush_statistics.db-shm (deleted)
/data/data/####/jpush_statistics.db-wal
/data/data/####/jpushservice_webview.db-journal
/data/data/####/libdvrender.so.tmp
/data/data/####/libjiagu-71411075.so
/data/data/####/libjplayer.so.tmp
/data/data/####/liblocalserver.so.tmp
/data/data/####/libmyssl.so.1.1.tmp
/data/data/####/libtranscore.so.tmp
/data/data/####/libviewer.so.tmp
/data/data/####/libyfnet_360.so.tmp
/data/data/####/light_sky_avast.xml
/data/data/####/localserver_2.0.3.18042602.zip
/data/data/####/locker
/data/data/####/log_reupload_task
/data/data/####/log_reupload_task_locker
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/msplugin_ksp.xml
/data/data/####/multidex.version.xml
/data/data/####/p.l
/data/data/####/player_20180722_115915_000.log_0
/data/data/####/player_record_2.0.3.18051401.zip
/data/data/####/privacy_config_file.xml
/data/data/####/profile_task
/data/data/####/profile_task_locker
/data/data/####/profile_torch_platform
/data/data/####/push.db-journal
/data/data/####/push.pid
/data/data/####/push_share.xml
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qhvc_plugin.xml
/data/data/####/run.pid
/data/data/####/safe_user_info_file.xml
/data/data/####/screen_conf.xml
/data/data/####/session_base_sp_filename42998cf32d552343bc8e460...ca.xml
/data/data/####/session_base_sp_filenameandroidID.xml
/data/data/####/share_data.xml
/data/data/####/shortcut_badger_sharepref.xml
/data/data/####/sp.livecloud.database.xml
/data/data/####/sp_file_recommend_upload.xml
/data/data/####/tab_request_name.xml
/data/data/####/tdata_jVg168
/data/data/####/tdata_jVg168.jar
/data/data/####/tdata_pSF696
/data/data/####/tdata_pSF696.jar
/data/data/####/tools_2.0.3.18051401.zip
/data/data/####/torch_sdk_config.xml
/data/data/####/torch_sdk_config.xml.bak (deleted)
/data/data/####/trans_20180722_115915_000.log_0
/data/data/####/um_pri.xml
/data/data/####/umdat.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/uninstall_apk
/data/data/####/uninstall_apk_locker
/data/data/####/universalPopup.xml
/data/data/####/videolist.db-journal
/data/data/####/waitingDown
/data/data/####/waitingDown_locker
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/weibo_sdk_aid1
/data/data/####/yf_p2p_201804191558.zip
/data/media/####/-hJaeQ_p5hxcV7aV1xtc3e-74YI.616644062.tmp
/data/media/####/-syMaTGwf-9xq4n3cf8PaFZ2JcY.-1090696945.tmp
/data/media/####/-vkoNCixl4feT6apEPeymII-JGo.435312310.tmp
/data/media/####/.a.dat
/data/media/####/.adfwe.dat
/data/media/####/.cca.dat
/data/media/####/.deviceId
/data/media/####/.iddata
/data/media/####/.nomedia
/data/media/####/.push_deviceid
/data/media/####/.sfp
/data/media/####/.testf
/data/media/####/.umm.dat
/data/media/####/08pQic0yqw_GrJdCfZBWxUAAuvI.860063228.tmp
/data/media/####/0NYDKqW-XHvVopObgMnYIEt388k.1578295478.tmp
/data/media/####/0Qh4ouo0dre8QOFq-qtByhRFMuM.1581308001.tmp
/data/media/####/0U7A9t_oVy3j0obwaPWov9a7-xs.1028229182.tmp
/data/media/####/0vVoqPIBzN58fX_-LIl6FfKfAhU.-859338212.tmp
/data/media/####/1WOj6s0SVHNCzJJgbFUXV2EJ6qE.267465346.tmp
/data/media/####/1WuQKtu5UINI5BHVsVs-6EdFqVo.1757919951.tmp
/data/media/####/1Xu73TYCkcbfNjCJV834YdGpW5A.-86391620.tmp
/data/media/####/1gAPRraz7z1CPeUys5khdMmc6Y0.1379636408.tmp
/data/media/####/2EKL9dlyp5HFkfkyWAyaebTIQ2Y.1434842612.tmp
/data/media/####/2zW
/data/media/####/2zW (deleted)
/data/media/####/3wLiHea3StRKRqLCql1E3ovDGNo.36007284.tmp
/data/media/####/42998cf32d552343bc8e460416382dca
/data/media/####/4K52n5ygUeZXo_uOKvWTplMS2Qo.1207998513.tmp
/data/media/####/5T6J3qHNn5Fh44kBOuwojcc2-eM.-1519223246.tmp
/data/media/####/5ahE3wdkB2WpyMk0dzMVcnMkK9g.-1694431765.tmp
/data/media/####/6766aa2750c19aad2fa1b32f36ed4aee
/data/media/####/6766aa2750c19aad2fa1b32f36ed4aee (deleted)
/data/media/####/6766aa2750c19aad2fa1b32f36ed4aee.tmp
/data/media/####/6VzzC07JSEQODUKPvcU_1em1xjk.384620404.tmp
/data/media/####/6n8dPd1sGPIpykGUR5JgvlSjaHc.2043368433.tmp
/data/media/####/7Icm2gZWCnQAkJM1sHoPisRyeOY.-1706184729.tmp
/data/media/####/7NdE1Ce5fDeuBS3hxQUQiwZTl6U.-49597922.tmp
/data/media/####/7sJQubZNROJDXgQ8Mje7TOUCLt8.874757447.tmp
/data/media/####/8DT6r6qcIVHCe2htGFvfduIyEes.-964862628.tmp
/data/media/####/8P40QOwi4oQSTMT2Y2x7v_Iax4s.347776530.tmp
/data/media/####/8RVNy-FOCmqzTnndd_0-nlDPxCg.95124492.tmp
/data/media/####/8tMsOt4Y56iDae6s-YlK6mx0NIE.-1392297400.tmp
/data/media/####/9BNex7uO1FG80DOXCIV9NLayV8g.-2036631670.tmp
/data/media/####/9bb045dc9fd44b0692a16284f8271b17
/data/media/####/9bf2015ff53d4459b3f92c35d2c66fd4
/data/media/####/9d_3DNNDZ7SVuRQtbpPBNUtf6KM.-703190411.tmp
/data/media/####/A1CMDGGoqPIhh21PZDtF0hp5Oa4.-710006273.tmp
/data/media/####/Alvin2.xml
/data/media/####/AnVQe2emSbskzgMwcGU9vOj_rdI.-1756879981.tmp
/data/media/####/B7Lpzvr17ihrT7N2L9sqvSV87jU.1786636751.tmp
/data/media/####/C77B4imSMaXkjEGWyALL7NLJFYw.792160467.tmp
/data/media/####/C7LTCYXwfHRqS2F1NqwQrkgJ3ZM.1307688416.tmp
/data/media/####/CQ96Eom3tqXMWgP84tL3qpaKGMw.480921322.tmp
/data/media/####/Clhct9GKaHXmRw7sqmhXx4o0mzg.-901855436.tmp
/data/media/####/ContextData.xml
/data/media/####/CzlGHvDnFtqEuyzGXFuGY8tBWJc.742926370.tmp
/data/media/####/E3AmzmTPkUbKo7y4rusNxBE8iGU.-1708454123.tmp
/data/media/####/F7Dn5S-U5qq_v4wkLQMATJAJW5A.1009087460.tmp
/data/media/####/FDc4y3M0aUvuKQSxn60XTkffbj0.-347152168.tmp
/data/media/####/FIfozUpIGx_kQVD6klAeOHAzMSQ.-1531740886.tmp
/data/media/####/FW2Nbi6d76bjp_J6EN7YeiawKps.1887479783.tmp
/data/media/####/GE-FfCLYJ1cxt65hPHK_kz7jORs.1066182139.tmp
/data/media/####/Gi237f0nHbG7g4WiRB3nDuAgYcE.-964592595.tmp
/data/media/####/GmmaQnZyxRTX5eFqbaJs9MIzq24.-2066833183.tmp
/data/media/####/GpfCXsoeW8idejFf3_0qLa7WQ6E.304510103.tmp
/data/media/####/GpupakIFDEcSSAzGb6Jeh1_Z7ko.858901681.tmp
/data/media/####/GuaETviUGJkVkVKLEywuE_1VXIQ.106993977.tmp
/data/media/####/HMbZwb0dKH7zacOHlh0YHADMr4g.147387716.tmp
/data/media/####/HYJBWvURqsyTttvfRta4seeivKM.1270312250.tmp
/data/media/####/HY_hI7cpBH_w_0vW9us1z-O7KNE.-1082047136.tmp
/data/media/####/Her_UAPxvABfvVlRlKoZsvkqNbI.1733094418.tmp
/data/media/####/I45
/data/media/####/I45 (deleted)
/data/media/####/ITZ0F29ChbWak6HBdVv3T1Jb_48.512210814.tmp
/data/media/####/IZ9VR0WRikP-QGKhZzu1oOtTvGo.-1265326988.tmp
/data/media/####/JPdq02k-6spMyvftAWt_90vmFxs.-1564990732.tmp
/data/media/####/JS4RNdA1hlxWwcIOjCgJ-4v38hc.864547437.tmp
/data/media/####/K11wrfQqXiTnGQ9v8eRPORsVkjg.-1164713675.tmp
/data/media/####/LGRynj-dqSmqqtswoaGZApKye3Q.1510864228.tmp
/data/media/####/LKTSpwZRzYv8WZkSB3iUV-slQiY.-933013907.tmp
/data/media/####/MGfIr-YkdDtaDb97EgcRCtCC_gU.-27531161.tmp
/data/media/####/MdzkIMMnw-Pqb_s9BIRWUNs4v1g.282155603.tmp
/data/media/####/MmzbPDjXP-dNW0ZXVCQkGTLeKlY.-808565303.tmp
/data/media/####/N1U8OTQ8vm8rHKSO5hNFnC5590E.498487851.tmp
/data/media/####/NRXKruHi43wdLAwpYB-WhvH2eqo.-773760375.tmp
/data/media/####/O5Q5kIU7-0JTlquzdMXicXaPML8.-1708130315.tmp
/data/media/####/ODKehhbS5ElgW1mtTEC-S_7yD_U.505196704.tmp
/data/media/####/OKTBX5NtrU-GMsVQ_j0e64fYec8.2061240919.tmp
/data/media/####/OOPKgleLkt9JlwmsaJwtg68TP-U.-1593853411.tmp
/data/media/####/O_OhkZstdWSF9Ci9PxreK7SepK0.-455395569.tmp
/data/media/####/On3Vh4hIJteoicAs0x_UHM-c8MQ.1737926377.tmp
/data/media/####/OnLLOU9zW6GA0EJI2GmMUvWI_UY.1717440390.tmp
/data/media/####/PXGdgBpVxH327ipknn9PLp0Rlqw.-575689276.tmp
/data/media/####/Q92xGcfAC2Ex6alznSH-pIY96yc.1101567937.tmp
/data/media/####/QHiQFm80p8FYYjoAoIYkQB0OP5A.498285433.tmp
/data/media/####/QP31PivTL_oMc36ewZ8NjJDo_xo.661912784.tmp
/data/media/####/QUZKEC3AraYavkDFWr-yziJLHMM.1679199372.tmp
/data/media/####/RGMtvGGPhcWKGQm0rJyZSsQQdOk.-1242224334.tmp
/data/media/####/RdNbGUXiDNxN8C0nulo6SgdDqFk.1086203184.tmp
/data/media/####/Rj9MRQGJ3qGDf_iKxrXOFShf3xI.355983857.tmp
/data/media/####/RopdKvRa9UQ6Zrx7lqJoVPJA8To.-2043324349.tmp
/data/media/####/S66iElVOTWJykV4GwKJYj4ObQ7Y.1045929814.tmp
/data/media/####/SrEL3JQYfDiUenWIBbrqRyu-jt0.2048347969.tmp
/data/media/####/TE8Q_y_BTCvjltGSXUKw3r66pAQ.267041037.tmp
/data/media/####/TroRiXhPpxaTTm9gLPGp8PmyE-Y.600175695.tmp
/data/media/####/U68JezBRN6YPDNHMm7RXBCXhC84.177423271.tmp
/data/media/####/UAwe8mkoClu1j3ozAFM6y6kOSAw.-535433532.tmp
/data/media/####/UCP1DQbbj44zP6r7mEV3lHloq8o.-1028164249.tmp
/data/media/####/Ul596dy6EEaB0bwzEZ-UXk6-45Y.-679328060.tmp
/data/media/####/UlpZctTf3NuSQHMlfv9T2ml9ffg.868568963.tmp
/data/media/####/VOFuq0qnpwIKHoFMEMglSMhAuVg.-674954390.tmp
/data/media/####/VYvGJkiUaTEJoIlSn8r0lqxcBxI.1437058887.tmp
/data/media/####/Vx4mb1EvPbFYOy0Pw6SE22D7ZUA.302112209.tmp
/data/media/####/W1s2y4DvoyLbSH5Y_ml_RWXx5Sc.-226516739.tmp
/data/media/####/WYyIhksfybSdr2grMzvle2mm4Y8.1453271148.tmp
/data/media/####/WezaCP7FauhBtLLUMqZGMqgQvyg.-799293240.tmp
/data/media/####/WgRWxB4wy32yu4JTKX7fl-8cJEY.64358245.tmp
/data/media/####/Wlyx6-lIgKYXAJSVTrXKoJtG4u4.2009980668.tmp
/data/media/####/WuqmTDovwSyGBQbRS7awu7OMlm8.1585971391.tmp
/data/media/####/XEBpd0Ur8C-mibB7pP9nnkxupac.1435989661.tmp
/data/media/####/XdCZHvCjMDWa39Cc_GjQvGf8TcE.-1267460973.tmp
/data/media/####/XwYLCJ1jr0886-otecpMTj8OeZQ.-1586289826.tmp
/data/media/####/Y29tLmxpZ2h0c2t5LnZpZGVv
/data/media/####/Y29tLmxpZ2h0c2t5LnZpZGVv (deleted)
/data/media/####/YT4uQLNuniG73H8jQADG8cXFxbo.534459714.tmp
/data/media/####/YcF5SAyzq8m3-5vjAPSy26KUQ8Q.-686336561.tmp
/data/media/####/YtPRhrggenO00jz3td3HdRpt-zk.1730934147.tmp
/data/media/####/ZzaVKK-IJln7kFXHS20H1xbORKU.1822224108.tmp
/data/media/####/__VERSION__
/data/media/####/_gD7KIIREWM_oEPYYDUUuPlrVPY.1541013287.tmp
/data/media/####/acb0a02cd38c446294dd4e095be5ad3e
/data/media/####/ahc9NXU37ELc35Asf1IL4Y6f2U8.1386247986.tmp
/data/media/####/app.db
/data/media/####/avast_done
/data/media/####/b05ce39c1fe9e72dc1df70989e7e6d14
/data/media/####/bcwbbiIXk8JHeoHkTeGQATX9zgY.-820055387.tmp
/data/media/####/biDKgJhNxd_wogTti_n_yEKbvLU.1545149248.tmp
/data/media/####/c962d8d43fa849679e2f9a3c0dd4ad43
/data/media/####/cC2pyKKei0EvhioBr2kqWoIm5n8.-1742492304.tmp
/data/media/####/cHHBXyRLqJdPTuPku3bx0hbZ4FE.-1567605442.tmp
/data/media/####/cIOsGvLWQwvdl8sr9h-zYJe8PEY.-304231173.tmp
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.lightsky.video.bin
/data/media/####/com.lightsky.video.db
/data/media/####/d46LvKcILL1uYHt4k1yzDxcz7ic.-834579828.tmp
/data/media/####/data.lock
/data/media/####/de-izI_GUKhPmEdbCCewREg5WKk.2064512554.tmp
/data/media/####/deR2KZ4-B6FBy0p8H1dbyaJ8gJ8.-948798077.tmp
/data/media/####/deviceToken
/data/media/####/eDfSeMpKM6inPuCZle_B5__YLiE.1887042271.tmp
/data/media/####/eLTK0e0pQQU1z9J4ceFyY_dhwTI.-149854238.tmp
/data/media/####/eMzDlt9J_0RiW4KWBDgXoiFYxAs.103032682.tmp
/data/media/####/ePZ8ffBDH8Dk4SwDNeIXLCeIaAA.-1133930735.tmp
/data/media/####/el9UqGnK43y0eQZ-AVlbIGnL8hI.1175682570.tmp
/data/media/####/f8C8Pagy8bW2c_jeQTKiubD7hBo.1639800835.tmp
/data/media/####/fGXsCub7haeUrcKv2mR32Ns1nWg.1399703643.tmp
/data/media/####/fHWZhYMI2JKDros47RlNZtJbq2U.-1003974761.tmp
/data/media/####/fHcgPWk71MrGLBBKVk3tCmGQvNE.1201850059.tmp
/data/media/####/fLqd1lqbRjbSGkGgC5p7ezMACcE.-1680714078.tmp
/data/media/####/fYGu8AL4gvMep_d9Fl004LcRfcY.-882618890.tmp
/data/media/####/frSm1FG1X_Bm69hauYS1rs_Ylbc.-1144600043.tmp
/data/media/####/gJiqxO3PyMq2LTBaP4-F6yguM-M.1590233146.tmp
/data/media/####/gqSjDr3NDAsT3LXzHDzyAIxpS1I.1172702923.tmp
/data/media/####/gqSjDr3NDAsT3LXzHDzyAIxpS1I.cnt
/data/media/####/gsrfQkStoFSQEIL3Qzi1YHCW9y0.1803575036.tmp
/data/media/####/hUAQtI3uYTRErip9WHXy5TaQiC8.-82253019.tmp
/data/media/####/i1OxSLOGnK5IEp4K4NPAagsox5E.624483694.tmp
/data/media/####/i7qavwScVy2s7tfKFPwCFFmRHpc.913185123.tmp
/data/media/####/iJOLsoGmZNVF-KjQYcJ-Mh_vQLI.-1318569341.tmp
/data/media/####/iT6
/data/media/####/iT6 (deleted)
/data/media/####/iq3CkzPrIGCLRIOXJfc1BDmACi0.-220442974.tmp
/data/media/####/iz1xq3Cl7LMibS5zGT9nnAVapqI.-1069675235.tmp
/data/media/####/jcSAOr9jGZwkhQZMXMgqUBAFH0c.1506264570.tmp
/data/media/####/jeDfDQkHEzmcCb3h3juSy_utrlM.249328211.tmp
/data/media/####/kCRLmLBM82Ye1HTZ9ggAT9d_AwE.589635927.tmp
/data/media/####/kkr1q-krYsskxp2R5w4u_OkcR8Q.255885766.tmp
/data/media/####/krROKQ0rxIBE6I0fbrPDTzHWrRQ.1247705082.tmp
/data/media/####/ksTedK7rLDgUQJOHZSYyHKJKjN4.1724415543.tmp
/data/media/####/lOekPJ3ejKPo6Vf5CufK5rCYShQ.-368607298.tmp
/data/media/####/lsvPDKsSBTyUOURFa0LM8fqTbE0.-267926786.tmp
/data/media/####/mutqLQFmgNUQbkmCVyWII6MLS14.1776653167.tmp
/data/media/####/n9hGh0rBjIKZ3GB78LvZ1iAHtow.-138330531.tmp
/data/media/####/o8Fjl6p1BXM-3pL8Gvp-x-5lHpo.1143887575.tmp
/data/media/####/oCAw3RjQYxVTe-YeDQXkhHKtuJk.1090468872.tmp
/data/media/####/oiHq6f8OpQyVsaNnCLqa_hXNzdQ.168769743.tmp
/data/media/####/ojTroq2heE1UbwISukTbbZ0EHZY.-606897551.tmp
/data/media/####/oyn0l1n4ZFd8T2MldT1KL1mhIFU.1910832308.tmp
/data/media/####/p1mnQgUmA8W0ohQLEDV2C5vV1j8.-1979623248.tmp
/data/media/####/pIbuUuzZYsyoCYw2SFb60ItCdmo.-837849943.tmp
/data/media/####/pRWxbTLgGVpWjWj2D5e4wHQ1O1c.712095982.tmp
/data/media/####/p_JektdRrZ8r8EM9UBmssevbCEs.-42918153.tmp
/data/media/####/p_XYJBYk7QId_P8UEVOUoy8LqC4.-39774541.tmp
/data/media/####/q4XlxXuWVJDA_IBfel3vu_3eFh4.-1764013576.tmp
/data/media/####/q6a
/data/media/####/q6a (deleted)
/data/media/####/qLEWOszDfdfG3lcCGWKMJwd1360.1211262564.tmp
/data/media/####/rajDhVOhv6ERKFNCgK-ngH7LWU4.-1777878851.tmp
/data/media/####/report.lock
/data/media/####/rq8
/data/media/####/rq8 (deleted)
/data/media/####/rx3h7CNtWz9WVzw7kmYT2hPlQdI.1197022382.tmp
/data/media/####/s5-pfq3UQDWUjLDIZ5tvrHnvUl0.1052265166.tmp
/data/media/####/tRCGdBA-FyALv6Tguf7px8qzRTo.1002370273.tmp
/data/media/####/tdata_jVg168
/data/media/####/tdata_pSF696
/data/media/####/test.log
/data/media/####/tqH52AYKqSL3CkhA8syNVLQtqok.1855340842.tmp
/data/media/####/tyqJ38-QbILB6WafiE_SPzfmAq4.1139064561.tmp
/data/media/####/u3yVGFFZBPLh0O_5sphVgkvCL_E.-181976783.tmp
/data/media/####/uTK9xc46lbGRGKFVKfaNGnFUIMk.1019050365.tmp
/data/media/####/uXPLK7N3GZBQskAxDRngbbDE428.1616392564.tmp
/data/media/####/uninstall_apk_list
/data/media/####/upx7XF1y4Fdzh7FHY7eLAmgOIew.-391880487.tmp
/data/media/####/vpowdQer1HLBfCe-0oKva4fE2k4.-2019488718.tmp
/data/media/####/wCCjs1bWkLckUxcK04XhOL3tPMk.1852553148.tmp
/data/media/####/wZeeIG0VxBAeepU9WTXs2s02t88.2144301995.tmp
/data/media/####/w_ULG3RFb0oJWbcF3Kr9sdn_NkY.-464033936.tmp
/data/media/####/wiw6HJ-r-PIpfIb3Qbyd_6sP7Hg.-1266606773.tmp
/data/media/####/xUm-uHLZseen7-xzU1dB1QKFots.1708015651.tmp
/data/media/####/xXbAGmzT44ZIBjF8b9KHCb73K5w.1521905323.tmp
/data/media/####/yDi79v4-9dYjK2nPWpQPn0JMrwY.588969393.tmp
/data/media/####/zaP9BQbwzeoFMPtgI34NOjtWt48.676055609.tmp
/data/media/####/zawJVVfrgM1kNgMu938RCnFULfk.1213127617.tmp
/data/media/####/zq9L2al1KGKjruYCGS_Uja5nZEw.185630447.tmp
/data/media/####/zyX5qmyFFxbnAsmBoYuqZgApMIE.-1770374708.tmp

Miscellaneous:

Executes next shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/xbin/which su
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:5a56c9198f4a9d0c2f0001a8","utdid":"W1RxgW6JdX0DAGdzx1GtDzyY","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.qihoo.qpush.sdk.GeTuiPushService 24825 300 0
cat /proc/version
cat /sys/class/net/wlan0/address
chmod 500 <Package Folder>/files/DaemonServer
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu-71411075.so
ls /
ls /sys/class/thermal
mount
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.qihoo.qpush.sdk.GeTuiPushService 24825 300 0

Loads the following dynamic libraries:

GPBreakpad
getuiext2
jcore120
libdvrender
libimagepipeline
libjiagu-71411075
libjplayer
liblocalserver
libtranscore
libviewer
libyfnet_360
tnet-3.1
weibosdkcore

Uses the following algorithms to encrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS7Padding
DES
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-NoPadding
DES

Uses elevated priveleges.

Uses special library to hide executable bytecode.

Gains access to geolocation.

Gains access to network information.

Gains access to telephone information (number, imei, etc.).

Gains access to information about APN settings.

Gains access to information about installed applications.

Gains access to information about running applications.

Gains access to information about accounts (Google, Facebook, etc.) registered on the device.

Adds tasks to the system scheduler.

Displays its own windows over windows of other applications.

技术

术语

教育培训

误区

Technical information

Curing recommendations

Free trial