Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) q####.c####.l####.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) rp-na####.ron####.com:80
- TCP(HTTP/1.1) st####.re####.com:80
- TCP(HTTP/1.1) and####.b####.qq.com:80
- TCP(HTTP/1.1) img.re####.com:80
- TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) app.re####.com:80
- TCP sdk.o####.t####.####.com:5224
- TCP cm-1####.ig####.com:5224
- TCP 1####.92.22.235:8630
DNS requests:
- 7j####.c####.z0.####.com
- a####.u####.com
- and####.b####.qq.com
- app.re####.com
- c-h####.g####.com
- cm-1####.ig####.com
- cm-1####.ig####.com
- img.re####.com
- log.u####.com
- nav.cn.ron####.com
- s####.cn.ron####.com
- s####.u####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- st####.re####.com
HTTP GET requests:
- app.re####.com/Case/gallery/id/1245/order/1
- app.re####.com/Case/gallery/id/1245/order/2
- app.re####.com/Case/index/id/1245
- et2-na6####.wagbr####.ali####.####.com/bar/get/5917fa74e88bad72b90020d5/...
- img.re####.com/201706/20170623/20170623_0fadab95b05d8059f3b2kxNnPV6btfrA...
- img.re####.com/201706/20170623/20170623_19daf6ca7533f7d99d87rfhFXShOnWt4...
- img.re####.com/201706/20170623/20170623_1c23039b78eac74bd1d0YEVhjAhprOZu...
- img.re####.com/201706/20170623/20170623_397bea3291b6e384f4919KZSw5uk0kSV...
- img.re####.com/201706/20170623/20170623_3c95b0f12cfa415ea655ccC6GJVfI25M...
- img.re####.com/201706/20170623/20170623_5b3b7db858baae3ed57f561agzczUGD7...
- img.re####.com/201706/20170623/20170623_8259d2b9428ab8111512qPdxZPDH8GVI...
- img.re####.com/201706/20170623/20170623_9c635328665aadfeef5dLzrWVuf4KNgG...
- img.re####.com/201706/20170623/20170623_bad583122e16039d73efnXUp51s3xmcR...
- img.re####.com/201706/20170623/20170623_d2a60f93140f1e2b3e558NCrxTMZ8Lmj...
- img.re####.com/201706/20170626/20170626_2b746572fc49819f5849mBmqPgBbV2Px...
- img.re####.com/201706/20170626/20170626_438c52f4ab712cd7675eUALs8Ihb0i4z...
- img.re####.com/201706/20170626/20170626_5772fd711f23b4e0e533iwBtFoJjXN8m...
- img.re####.com/201706/20170626/20170626_8a8bd00fed7b20e87faaDFOBVxk3WzCH...
- img.re####.com/201706/20170626/20170626_95b5fe2da02956701fb9ZWks420AFNzL...
- img.re####.com/201706/20170626/20170626_9ebcccb7af6ede0e628anDxkkAnIyGH2...
- img.re####.com/201706/20170626/20170626_d85a3d036d787795bc5d9FYBKiCDBUfX...
- img.re####.com/201707/20170712/20170712_4f0c5cf063d6be74d6f0sawEVhGY8WyH...
- img.re####.com/201709/20170927/20170927_8487a49e4ba20d9f4f974ugrgXP2M4lf...
- img.re####.com/201804/20180420/20180420_d5b3924ee68eb834768efSyFWFUYtTXR...
- img.re####.com/201809/20180911/20180911_37ebbb3f6982e8acfbe7I0yKI838Uzps...
- img.re####.com/201811/20181120/20181120_1c04ab814fa9e1186a80YFOH37quWnco...
- img.re####.com/201811/20181120/20181120_893358f7d2abc3fc72b7XyzR8KHpzbyB...
- img.re####.com/201811/20181120/20181120_8cd7031500a4681d0aaffFJGVgjQVPJR...
- img.re####.com/201811/20181120/20181120_94a8805cea41fba5b41bdhIUgu8PTA0n...
- img.re####.com/201811/20181120/20181120_aba7b94f39239ef0ba224xoE3jqXu20V...
- img.re####.com/201902/20190218/20190218_76ac3dadf5735e28c0d3TaKdSzSoYunT...
- img.re####.com/201903/20190306/20190306_fb53924a93d7849f663dCS3iLU5SGHae...
- img.re####.com/201904/20190410/20190410_68e48ec0d46369eb6cbaNN9lKgp76sJ2...
- img.re####.com/201911/20191104/20191104_7d50f00a8f818a781cb8UpipX3U1xG5N...
- img.re####.com/avatar/001/36/59/149803366835_avatar_big.jpg
- img.re####.com/avatar/001/36/59/150606001037_avatar_big.jpg
- img.re####.com/avatar/001/36/59/155576439138_avatar_big.jpg
- img.re####.com/avatar/001/72/70/150606009359_avatar_big.jpg
- img.re####.com/avatar/001/74/87/150606717921_avatar_big.jpg
- img.re####.com/avatar/002/83/99/149803374966_avatar_big.jpg
- img.re####.com/avatar/002/83/99/150606033672_avatar_big.jpg
- img.re####.com/avatar/005/20/14/150606006226_avatar_big.jpg
- img.re####.com/avatar/005/20/14/152566396530_avatar_big.jpg
- q####.c####.l####.####.com/config/hz-hzv6.conf
- q####.c####.l####.####.com/tdata_MkX219
- q####.c####.l####.####.com/tdata_RTc910
- q####.c####.l####.####.com/tdata_XeE960
- q####.c####.l####.####.com/tdata_mtl581
- st####.re####.com/app/css/app.min.css?t=####
- st####.re####.com/app/images/icon-back.png
- st####.re####.com/ckplayer/ckplayer.js
- st####.re####.com/public/css/reset.min.css?t=####
- st####.re####.com/usercenter/css/swiper.min.css
- st####.re####.com/usercenter/js/jquery1.8.min.js?t=####
- st####.re####.com/usercenter/js/swiper.min.js
HTTP POST requests:
- a####.u####.com/app_logs
- and####.b####.qq.com/rqd/async?aid=####
- app.re####.com/Index/index
- app.re####.com/Index/update_version
- c-h####.g####.com/api.php?format=####&t=####
- rp-na####.ron####.com/navipush.json
- sdk.o####.p####.####.com/api.php?format=####&t=####
File system changes:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/1004
- /data/data/####/1573309751809.log.bak (deleted)
- /data/data/####/1573309751909.log
- /data/data/####/29598bfd3ae9d4166b19dae8817e732c
- /data/data/####/4eEiHjNh6rPNo8VM95M48KUigYQ.330792424.tmp
- /data/data/####/8T_xnlS0mi6X5jJ3J50nup8Pkzk.1645483877.tmp
- /data/data/####/BfhIGuVbLlnFwfvflYzojgdqe-0.-658780746.tmp
- /data/data/####/COUNTLY_STORE.xml
- /data/data/####/E5X3OXXUg-j4bkS591prL0WAkFE.156698705.tmp
- /data/data/####/Gaq_1ing6LpU_v28LR6_x2vn4uM.387101784.tmp
- /data/data/####/LqLoqyPEkWsbvVX9iNMOpVE7Prg.-1098409386.tmp
- /data/data/####/MultiDex.lock
- /data/data/####/NeT4z2HqwRDI6-SKRjpSvYbdfV0.1925123554.tmp
- /data/data/####/RedocnConfig.xml
- /data/data/####/RedocnSearchModeldb-journal
- /data/data/####/RongPush.xml
- /data/data/####/Statistics.xml
- /data/data/####/U6BmV2YlH931Q6uZUtmxNoCPRVk.2137222167.tmp
- /data/data/####/YdEPWjpUBrc85ojAs5y4V88OWt4.923743589.tmp
- /data/data/####/bmpIbgqOjtLananbBaqnt0i2Gl0.1808150637.tmp
- /data/data/####/bmpIbgqOjtLananbBaqnt0i2Gl0.cnt
- /data/data/####/bugly_db_-journal
- /data/data/####/caAxaywzVJg3oHVLeGzonj-6Buw.-1311842878.tmp
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/crashrecord.xml
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/etQ9nkgZEieczROblzlkn4gK3q0.1045588885.tmp
- /data/data/####/etQ9nkgZEieczROblzlkn4gK3q0.cnt
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/getui_sp.xml
- /data/data/####/hPdzJlMFjDV1FsRR-CqH07_lJcg.1638983900.tmp
- /data/data/####/ig45TMBln9xp-E_bAx360YY2jDg.1650165131.tmp
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/jg_so_upgrade_setting.xml
- /data/data/####/journal.tmp
- /data/data/####/libjiagu.so
- /data/data/####/local_crash_lock
- /data/data/####/multidex.version.xml
- /data/data/####/native_record_lock
- /data/data/####/push.pid
- /data/data/####/push_daemon
- /data/data/####/pushsdk.db-journal
- /data/data/####/rfb53Xtlh578sVX78ruGZh7VYSs.1102160188.tmp
- /data/data/####/run.pid
- /data/data/####/security_info
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/umeng_socialize.xml (deleted)
- /data/data/####/wTTYHg3ottIoN1U8DTQNJGE2Jtk.1531609869.tmp
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/RongLog_2_8_17.log
- /data/media/####/app.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.redocn.redocn.db
Miscellaneous:
Executes the following shell scripts:
- /system/bin/chmod 777 <Package Folder>/app_lib/x86/push_daemon
- /system/bin/sh -c getprop
- /system/bin/sh -c type su
- <Package Folder>/app_lib/x86/push_daemon <Package> io.rong.push.PushService /storage/emulated/0/.rongLock
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- getprop
Loads the following dynamic libraries:
- Bugly
- RongIMLib
- getuiext2
- imagepipeline
- libjiagu
- push
Uses the following algorithms to encrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
- AES-GCM-NoPadding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
- AES-GCM-NoPadding
Accesses the ITelephony private interface.
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
