Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(TLS/1.0) api-gat####.gu####.com:443
- TCP(TLS/1.0) 1####.250.179.138:443
- TCP(TLS/1.0) md####.google####.com:443
- TCP(TLS/1.0) 2####.58.211.106:443
- TCP(TLS/1.2) 1####.250.179.138:443
- TCP(TLS/1.2) 1####.250.179.195:443
- TCP(TLS/1.2) 1####.250.179.174:443
- UDP 1####.250.179.138:443
DNS requests:
- api-gat####.gu####.com
- md####.google####.com
File system changes:
Creates the following files:
- /data/data/####/Jupiter.xml
- /data/data/####/com_guahao_webstorage.xml
- /data/data/####/commerce_business_config.xml
- /data/data/####/crash_dump.log
- /data/data/####/ib65f39ff9fb8875f
- /data/data/####/libexec.so
- /data/data/####/libexecmain.so
- /data/data/####/libweexjsb.so
- /data/data/####/proc_auxv
- /data/data/####/user_data.xml
- /data/data/####/weex_default_settings.xml
Miscellaneous:
Executes the following shell scripts:
- /data/app/<Package>-1/lib/arm//libweexjsb.so 44 45 1 /data/user/0/<Package>/app_crash/crash_dump.log
- /data/app/<Package>-1/lib/arm//libweexjsb.so 49 50 1 /data/user/0/<Package>/app_crash/crash_dump.log
- app_process /system/bin com.android.commands.pm.Pm list package -3
- getprop ro.product.cpu.abi
- sh
- sh -c cat /proc/3556/wchan
- sh -c cat /proc/3629/wchan
- sh -c cat /proc/3705/wchan
- sh -c cat /proc/5086/wchan
Uses the following algorithms to encrypt data:
- AES-ECB-PKCS5Padding
- RSA-ECB-PKCS1Padding
Accesses the ITelephony private interface.
Uses special library to hide executable bytecode.
Gets information about phone status (number, IMEI, etc.).
Requests the system alert window permission.
