Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(TLS/1.0) gw.al####.com:443
- TCP(TLS/1.0) ap####.bizh####.info:443
- TCP(TLS/1.0) tinyq####.ove####.b0.####.com:443
DNS requests:
- ap####.bizh####.info
- ganlan####.bizh####.vip
- gw.al####.com
File system changes:
Creates the following files:
- /data/data/####/.jg.ic
- /data/data/####/091d7fc4317e5560455d76e1b4dab560ed72176046534a6....0.tmp
- /data/data/####/10fa8fdafb8dc14938989b4dd6c0cbed5bdf7f759a0ee96....0.tmp
- /data/data/####/18873132cc53ad61ce95ca4634c6a210760543434167e2d....0.tmp
- /data/data/####/1f51cc2abafc7253cb8fb96b9765bbd7e02b6d2b60274bf....0.tmp
- /data/data/####/2423620b62aba498e2b630ebbf7233bbd7b2d20f43c07db....0.tmp
- /data/data/####/2810914de197cc2cfd1a54dab5310269898de930b157431....0.tmp
- /data/data/####/341d1af0fe5a52185b62fa832e7ff213e0b7f96b97f4d61....0.tmp
- /data/data/####/3441210f97eea73582027b7601e3461b0191b6bf51b1238....0.tmp
- /data/data/####/37a6df5739a1d39b0534fa2da2ce71888cd2bf5624fbedf....0.tmp
- /data/data/####/39ffc7c00b092917b0b120809f2c0ef7aa778727ad24665....0.tmp
- /data/data/####/51b9d46f1dfe5dfa2f53edf7026d9e361e36b800eb9794f....0.tmp
- /data/data/####/57b7f0efeca7cd2d07cb7518854288ed4411b8ff39d46e1....0.tmp
- /data/data/####/58a2f93bb28eed8bfc0b5674c2a1cdf1283501df92d128a....0.tmp
- /data/data/####/5b5b8730273fe78ad0bad8d46ac5013787fd732e25285b1....0.tmp
- /data/data/####/5daf57fdd8217c16c977eb00ed1694a9d2448f94d31ca86....0.tmp
- /data/data/####/5fce50876ebf4517b62a591872fb9c0aaf995cdb5a0a380....0.tmp
- /data/data/####/61792fd6bf08f535731c0f6221d3158099d655f34b3ebaa....0.tmp
- /data/data/####/6841fed4ed8b9ff55266c92359217e7ab6f1655e2069cd1....0.tmp
- /data/data/####/6841fed4ed8b9ff55266c92359217e7ab6f1655e2069cd1...eb3f.0
- /data/data/####/6ab2b84f6286af519bdc4b5b738b967c27e71b4ccedeb39....0.tmp
- /data/data/####/6d8bfe7ea12d4dd4dd8436bbfbb77c20979dc30264e8fb9....0.tmp
- /data/data/####/6e52d27367948f650633661035f68c39c0d536dbd146bda....0.tmp
- /data/data/####/71c8656f54cf4e0c17ca17ff5c3d02ae4915ce0ea29286f....0.tmp
- /data/data/####/7725c5cd4360af0fd0dc10b8f902fcab5ee99b792e617d1....0.tmp
- /data/data/####/7fc03a173ea97b6b2c6710e573c43cd3206d19baead8b95....0.tmp
- /data/data/####/82e13409160778e61f7d9d15da52d5df029baf953ea7417....0.tmp
- /data/data/####/8cc6c37768474c978afa6b39da5ffc00709f743b0319503....0.tmp
- /data/data/####/8e024f838ca89a22ed8ba2a6d3674cfb2087130d2f4562d....0.tmp
- /data/data/####/8e39d2ab60d264a3f5585736f7209b86fdf0a515863a860....0.tmp
- /data/data/####/9bfcf4c946b1f6bc5b28552d14e179723f4b775e5497503....0.tmp
- /data/data/####/BMWEEXOPEN_NATIVE_SP.xml
- /data/data/####/MultiDex.lock
- /data/data/####/a2ce1c9fc77347f2ef46c6dc3cf99bb8d02f6e0e7993557....0.tmp
- /data/data/####/b3876b4ea6de7c326d4a9cac948cbbffc7b3311767973a2....0.tmp
- /data/data/####/b87c6dc681de22be72e2bc13d1528db8bf97577a5a69d57....0.tmp
- /data/data/####/be8a5bcc574dcf2756c05a61486fdfd96ccea50a371af03....0.tmp
- /data/data/####/be998be9f993878a89b31ff6816a135fdf034890562c95c....0.tmp
- /data/data/####/c89a3dc65bfa3335dc588341198e50139fe398a17f7276e....0.tmp
- /data/data/####/caa384d147743411db39978e5823833682c1264def266fb....0.tmp
- /data/data/####/cb144c7532d55197cedf05fb7b0f45aec8663b2a016eb58....0.tmp
- /data/data/####/cc9b35a18c99931d65595de83249e513
- /data/data/####/ccb3877f47f291b12c55ae6227a284bfe46d0ae547b925b....0.tmp
- /data/data/####/d9533123cbd0a276ac22a5388d92b4f265aff62f8cee10b....0.tmp
- /data/data/####/d98639abb6d3d2327b71f9e725ef802bc0e7ed2588bad25....0.tmp
- /data/data/####/dc730bccc66b67c26e67c90f3e3b1723a96ab39799773c5....0.tmp
- /data/data/####/e27d69aa858f9c2a759d2aab7eda90d5fa85fbbf4ca934a....0.tmp
- /data/data/####/e425cee3eb3c42a48a3061564609ac0446fa750d6399d9f....0.tmp
- /data/data/####/e4883c4a0993ab835fcfe8097442df6af4f47e984769287....0.tmp
- /data/data/####/f3cad047eabfa159f5d830e09dc90d95baac7cf07f74400....0.tmp
- /data/data/####/f3f899334758c7c3e6005dd75b9c6da8157771358ecb14c....0.tmp
- /data/data/####/f3fdd0aa58cb324e688e02a61a4765768da1d32fb6403bc....0.tmp
- /data/data/####/f8bc0198d0345fa78449dabbbffe38073ff637d1aba89d3....0.tmp
- /data/data/####/f901cc66a10b88b0d8b91e253b50987e69d7a2c53566c12....0.tmp
- /data/data/####/f9fd1e07f388fbedf81b29067f83f0059029bcae7f3bbe7....0.tmp
- /data/data/####/fa6a89699e97b6ceb18c477a209c4c98d7593dcb87842d8....0.tmp
- /data/data/####/journal.tmp
- /data/data/####/libjiagu-1436478090.so
- /data/data/####/libweexjsb.so
- /data/data/####/multidex.version.xml
- /data/media/####/ArticleDetail.js
- /data/media/####/Certification.js
- /data/media/####/CoinDetail.js
- /data/media/####/CoinDetailKs.js
- /data/media/####/CoinNodeMap.js
- /data/media/####/CoinTopList.js
- /data/media/####/Coins.js
- /data/media/####/ExtractBzh.js
- /data/media/####/FiltersCoinResult.js
- /data/media/####/Invite.js
- /data/media/####/Login.js
- /data/media/####/Notice.js
- /data/media/####/NoticeMessages.js
- /data/media/####/Plan.js
- /data/media/####/ReceiveBzh.js
- /data/media/####/SearchCoin.js
- /data/media/####/SetPassword.js
- /data/media/####/Settings.js
- /data/media/####/Stat.js
- /data/media/####/StatCompare.js
- /data/media/####/StatSingle.js
- /data/media/####/TaskCenter.js
- /data/media/####/Test.js
- /data/media/####/UpdateSetting.js
- /data/media/####/Wallet.js
- /data/media/####/ask.png
- /data/media/####/bundle.zip
- /data/media/####/buy.png
- /data/media/####/bzh.png
- /data/media/####/copylinks.png
- /data/media/####/default_header.jpg
- /data/media/####/demo.html
- /data/media/####/download.png
- /data/media/####/font_1469606063_76593.ttf
- /data/media/####/font_1469606522_9417143.woff
- /data/media/####/font_zn5b3jswpofuhaor.ttf
- /data/media/####/guide.png
- /data/media/####/guide_active.png
- /data/media/####/icomoon.eot
- /data/media/####/icomoon.svg
- /data/media/####/icomoon.ttf
- /data/media/####/icomoon.woff
- /data/media/####/iconfont-eros.ttf
- /data/media/####/iconfont.ttf
- /data/media/####/index.js
- /data/media/####/invite_poster_bg.jpg
- /data/media/####/invite_share.png
- /data/media/####/loading.gif
- /data/media/####/loading2.gif
- /data/media/####/market.jpg
- /data/media/####/market.png
- /data/media/####/market_active.png
- /data/media/####/market_cap.jpg
- /data/media/####/md5.json
- /data/media/####/media_hot.jpg
- /data/media/####/mine.png
- /data/media/####/mine_active.png
- /data/media/####/new.png
- /data/media/####/news.png
- /data/media/####/news_active.png
- /data/media/####/overdue.png
- /data/media/####/poster_bg1.jpg
- /data/media/####/selection.json
- /data/media/####/style.css
- /data/media/####/succeed_icon.png
- /data/media/####/technology_hot.jpg
- /data/media/####/times.jpg
- /data/media/####/update.png
- /data/media/####/view.png
- /data/media/####/view_active.png
- /data/media/####/wallet.png
- /data/media/####/wechat_pengyou.png
- /data/media/####/wechat_pengyouquan.png
Miscellaneous:
Executes the following shell scripts:
- /data/app-lib/<Package>-1/libweexjsb.so 50 0
- chmod 755 <Package Folder>/.jiagu/libjiagu-1436478090.so
Loads the following dynamic libraries:
- Patcher
- libjiagu-1436478090
- weexjsc
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
Uses special library to hide executable bytecode.
Displays its own windows over windows of other apps.
