Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) log.djdu####.com:80
- TCP(HTTP/1.1) o####.sn####.com:80
- TCP(HTTP/1.1) cdnuser####.shoujid####.com.####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
- TCP(HTTP/1.1) r####.shoujid####.com:80
- TCP(HTTP/1.1) cdnri####.shoujid####.com.####.com:80
- TCP(HTTP/1.1) thi####.q####.cn:80
- TCP(HTTP/1.1) log.shoujid####.com:80
- TCP(TLS/1.0) s####.we####.com:443
DNS requests:
- a####.u####.com
- cdnri####.shoujid####.com
- cdnuser####.shoujid####.com
- log.djdu####.com
- log.shoujid####.com
- log.u####.com
- o####.sn####.com
- oc.u####.com
- q.q####.cn
- r####.shoujid####.com
- s####.u####.com
- s####.we####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- thi####.q####.cn
HTTP GET requests:
- cdnri####.shoujid####.com.####.com/ringres/mm/m96/176/94221176-9.mp3
- cdnri####.shoujid####.com.####.com/ringres/userv1/m96/172/92541172.mp3
- cdnri####.shoujid####.com.####.com/ringres/userv1/m96/277/94589277.mp3
- cdnri####.shoujid####.com.####.com/ringres/userv1/m96/364/94589364.mp3
- cdnri####.shoujid####.com.####.com/ringres/userv1/m96/462/94550462.mp3
- cdnri####.shoujid####.com.####.com/ringres/userv1/m96/608/94553608.mp3
- cdnri####.shoujid####.com.####.com/ringres/verify.dat
- cdnuser####.shoujid####.com.####.com/head_pic/01/user_head_41491051_2019...
- cdnuser####.shoujid####.com.####.com/head_pic/09/user_head_31213619_2019...
- cdnuser####.shoujid####.com.####.com/head_pic/12/user_head_21765305_2019...
- cdnuser####.shoujid####.com.####.com/head_pic/49/user_head_7925843_20191...
- cdnuser####.shoujid####.com.####.com/head_pic/56/user_head_41297050_2019...
- cdnuser####.shoujid####.com.####.com/head_pic/59/user_head_49203230_2019...
- et2-na6####.wagbr####.ali####.####.com/bar/get/4fa4d53e5270157de9000014/...
- log.shoujid####.com/log.php?user=####&prod=####&isrc=####&mac=####&dev=#...
- r####.shoujid####.com/ring_enc.php?cmd=####&q=cTCi0####
- r####.shoujid####.com/ring_enc.php?type=####&q=####
- r####.shoujid####.com/ringv1/verify.dat
- r####.shoujid####.com/ringv1/xmldata/searchad.xml
- thi####.q####.cn/g?b=####&k=####&s=####
- thi####.q####.cn/g?b=####&k=####&s=####&t=####
- thi####.q####.cn/qqapp/100382066/099D9C4AF5050B89A8D85DDEF62F014D/100
- thi####.q####.cn/qqapp/100382066/646A713C0850C56BBF997CE6E5F34119/100
HTTP POST requests:
- a####.u####.com/app_logs
- log.djdu####.com/logs/log.php
- o####.sn####.com/access_token/register/device/v2/?
- oc.u####.com/v2/check_config_update
- oc.u####.com/v2/get_update_time
File system changes:
Creates the following files:
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/1571278963247.log
- /data/data/####/MultiDex.lock
- /data/data/####/__xadsdk__remote__final__builtin__.jar
- /data/data/####/_dexmob.xml
- /data/data/####/_duoduonews.xml
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/duoduo.ringtone.database
- /data/data/####/duoduo.ringtone.database-journal
- /data/data/####/duoduom_gdt_1.jpg.jar
- /data/data/####/duomobad_0_1_4.jpg.jar
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/gdt_plugin.jar
- /data/data/####/gdt_plugin.jar.sig
- /data/data/####/getui_sp.xml
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/libjiagu178973751.so
- /data/data/####/lock_dm
- /data/data/####/lock_gt
- /data/data/####/multidex.version.xml
- /data/data/####/onlineconfig_agent_online_setting_com.shoujiduo...ne.xml
- /data/data/####/push.pid
- /data/data/####/pushsdk.db-journal
- /data/data/####/ring.shoujiduoduo.com.xml
- /data/data/####/run.pid
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/umeng_socialize.xml
- /data/data/####/update_lc
- /data/media/####/-353165572
- /data/media/####/-571044654
- /data/media/####/.nomedia
- /data/media/####/126316368
- /data/media/####/1464764088
- /data/media/####/1549526838
- /data/media/####/1792764582
- /data/media/####/1878762277
- /data/media/####/1895979987
- /data/media/####/7805697
- /data/media/####/93703260
- /data/media/####/category.tmp
- /data/media/####/com.shoujiduoduo.ringtone.bin
- /data/media/####/config.tmp
- /data/media/####/hotkey.tmp
- /data/media/####/list_0.tmp
- /data/media/####/list_1.tmp
- /data/media/####/list_20.tmp
- /data/media/####/list_6.tmp
- /data/media/####/make_ring.xml
- /data/media/####/search_ad.tmp
- /data/media/####/toplist.tmp
- /data/media/####/verify_cdn.dat
- /data/media/####/verify_duoduo1.dat
- /data/media/####/铃声多多_姚智鑫 - 野狼disco (抒情完整版)_K K.mp3
- /data/media/####/铃声多多_婷妹.♡——「说唱」好好生活 慢慢相遇._婷婷爱靓仔..mp3
- /data/media/####/铃声多多_我与神明画过押 赌你有天会回来. Imade a bet with the god....♥.mp3
- /data/media/####/铃声多多_暗示分离_E N.mp3
- /data/media/####/铃声多多_苏媚娘.Music️千万不要招惹一个整天看着嘻嘻哈哈跟谁都能开玩笑的女孩子因为你承...媚娘.mp3
- /data/media/####/铃声多多_道不同不相为谋- 花手摇起来_煜煜.mp3
Miscellaneous:
Executes the following shell scripts:
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
Loads the following dynamic libraries:
- getuiext2
- libjiagu178973751
- mad
- opencore_aac
- url_encode
Uses the following algorithms to encrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-NoPadding
- AES-CBC-PKCS7Padding
Uses special library to hide executable bytecode.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
