Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.3.origin
Network activity:
Connects to:
- UDP(DNS) 8####.8.4.4:53
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) a####.u####.com.####.com:80
- TCP(HTTP/1.1) qzs.gd####.com.####.com:80
- TCP(HTTP/1.1) mi.g####.qq.com:80
- TCP(HTTP/1.1) sdk.c####.g####.####.cn:80
- TCP(HTTP/1.1) s####.e.qq.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) l####.cc:80
- TCP(HTTP/1.1) amap####.cn-hang####.oss####.####.com:80
- TCP(HTTP/1.1) v0-clie####.r####.cn:80
- TCP(HTTP/1.1) gs.g####.com:80
- TCP(HTTP/1.1) marke####.et####.cn:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) zhwn####.et####.cn.####.cn:80
- UDP(NTP) 2.and####.p####.####.org:123
- TCP(TLS/1.0) rr1---s####.g####.com:443
- TCP(TLS/1.0) p####.google####.com:443
- TCP(TLS/1.0) and####.a####.go####.com:443
- TCP(TLS/1.0) v2-st####.et####.cn.####.com:443
- TCP(TLS/1.0) img####.9l####.com.####.com:443
- TCP(TLS/1.0) res####.a####.com:443
- TCP(TLS/1.2) 1####.250.27.94:443
- TCP(TLS/1.2) p####.google####.com:443
- UDP p####.google####.com:443
- TCP 1####.9.125.184:7003
- TCP sdk.o####.t####.####.com:5224
- UDP easytom####.com:19000
- TCP cm-1####.g####.com:5225
- TCP ads.weilito####.net:443
DNS requests:
- 2.and####.p####.####.org
- 67x9####.api.l####.####.8
- 67x9####.api.l####.net
- a####.u####.com
- ads.weilito####.net
- amap####.cn-hang####.oss####.####.com
- and####.a####.go####.com
- and####.google####.com
- b####.g####.com
- b-log####.suishe####.cn
- b.pc.suishe####.net
- c####.g####.com
- c-h####.g####.com
- clien####.r####.cn
- cm-1####.g####.com
- easytom####.com
- enhance####.r####.cn
- gs.g####.com
- img####.9l####.com
- l####.cc
- m####.go####.com
- marke####.et####.cn
- mi.g####.qq.com
- p####.google####.com
- pc.suishe####.net
- pub-####.qin####.com
- qzs.gd####.com
- res####.a####.com
- rr1---s####.g####.com
- s####.e.qq.com
- s.j####.cn
- sdk.c####.g####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- sis.j####.io
- v0-clie####.r####.cn
- v2-st####.et####.cn
- woaizgg####.com
- www.google####.com
- zhwn####.et####.cn
HTTP GET requests:
- amap####.cn-hang####.oss####.####.com/sdkcoor/android/armeabi-v7a/libJni...
- img####.9l####.com.####.com:443/image/202212/05/4c94782c55fbb61fd003f18f...
- img####.9l####.com.####.com:443/image/202212/05/6602fa56f0eb42633210967c...
- img####.9l####.com.####.com:443/image/202212/05/83bf08dae63189f53d269504...
- img####.9l####.com.####.com:443/image/202212/06/636b15e2f3d92668d0ec50dc...
- img####.9l####.com.####.com:443/image/202212/06/660bb0bd9f7595e49632ebc2...
- img####.9l####.com.####.com:443/image/202212/06/fc90633064805d40a68f4b12...
- img####.9l####.com.####.com:443/image/202212/08/3342921ae5443e5b782e067f...
- l####.cc/i/sdk/is_gal?os=####&android_id_md5=####&imei_md5=####×tam...
- marke####.et####.cn/api/ckver?app_ts=####&epid=####&app_key=####&device_...
- mi.g####.qq.com/gdt_mview.fcg?count=####&adposcount=####&fc=####&datatyp...
- qin####.com.www.####.com/tdata_EDT356
- qzs.gd####.com.####.com/union/res/android/plugin/plugin.dex-1063.jar
- sdk.c####.g####.####.cn/config/hzv9.conf
- v0-clie####.r####.cn/lizhi/api/client-config/get?app_ts=####&device=####...
- v0-clie####.r####.cn/lizhi/api/life/day_pics?city_key=####&app_ts=####&d...
- v0-clie####.r####.cn/lizhi/api/plistenV2?app_ts=####&app_key=####&device...
- v0-clie####.r####.cn/lizhi/api/zhwnl/v1/settings/ab?app_ts=####&app_key=...
- v0-clie####.r####.cn/lizhi/api/zhwnl/v3/headline?&ver_code=####&device_i...
- v0-clie####.r####.cn/peacock/api/zhwnl/v3/awake?app_ts=####&acctk=####&a...
- v2-st####.et####.cn.####.com:443/apis/holiday-in-law.json?date=####
- zhwn####.et####.cn.####.cn/Ecalender/api/city?ver_code=####&device_id=##...
HTTP POST requests:
- a####.u####.com.####.com/app_logs
- c-h####.g####.com/api.php?format=####&t=####
- gs.g####.com/encryption/key/fetch
- gs.g####.com/geshu/sdkStatistics/bindInfo
- gs.g####.com/geshu/sdkStatistics/uploadBI
- l####.cc/i/sdk/install
- res####.a####.com:443/v3/iasdkauth?key=####&ts=####&scode=####
- s####.e.qq.com/activate
- sdk.o####.p####.####.com/api.php?format=####&t=####
Miscellaneous:
Uses special library to hide executable bytecode.
Requests the system alert window permission.
