Technical information
- Android.Backdoor.657.origin
- Android.DownLoader.2083
- Android.DownLoader.546.origin
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) as.lie####.cn:80
- TCP(HTTP/1.1) t####.zhiz####.com:80
- TCP(HTTP/1.1) dpa.helianh####.com:80
- TCP(HTTP/1.1) api.s####.mob.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) www.ggcarr####.com:80
- TCP(HTTP/1.1) c####.mob.com:80
- TCP(HTTP/1.1) ap####.adi####.com:80
- TCP(HTTP/1.1) d####.d####.mob.com:80
- TCP(HTTP/1.1) ga####.lotu####.com:80
- TCP(HTTP/1.1) a####.exc.mob.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) api.m####.adwan####.com:80
- TCP(HTTP/1.1) v.g####.qq.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) pic.e####.cn:80
- TCP(HTTP/1.1) w####.x.jd.com:80
- TCP(HTTP/1.1) adx2rt####.adi####.com:80
- TCP(HTTP/1.1) cm.adi####.com:80
- TCP(HTTP/1.1) dsp.zhiz####.com:80
- TCP(HTTP/1.1) app.mijia####.com:80
- TCP(HTTP/1.1) api.e####.cn:80
- TCP(HTTP/1.1) 1####.26.247.23:80
- TCP(HTTP/1.1) v.z####.red:80
- TCP(HTTP/1.1) m####.e####.cn:80
- TCP(HTTP/1.1) ga####.lotu####.com:88
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) s.ad####.com:80
- TCP(HTTP/1.1) i####.jd.com:80
- TCP(HTTP/1.1) api.m####.w####.cn:80
- TCP(HTTP/1.1) apilo####.a####.com:80
- TCP(HTTP/1.1) api.map.b####.com:80
- TCP(HTTP/1.1) o####.ad####.cn:80
- TCP(TLS/1.0) lf.sn####.com:443
- TCP(TLS/1.0) www.ggcarr####.com:443
- TCP(TLS/1.0) cdn-boo####.b0.a####.com:443
- TCP(TLS/1.0) mal####.e####.cn:443
- TCP(TLS/1.0) pic.e####.cn:443
- TCP(TLS/1.0) m####.e####.cn:443
- TCP(TLS/1.0) regi####.xm####.xi####.com:443
- TCP(TLS/1.0) api.e####.cn:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5227
- 7j####.c####.z0.####.com
- a####.exc.mob.com
- a####.u####.com
- adx2rt####.adi####.com
- ap####.adi####.com
- api####.a####.com
- api.e####.cn
- api.m####.adwan####.com
- api.m####.w####.cn
- api.map.b####.com
- api.s####.mob.com
- app.mijia####.com
- as.lie####.cn
- c####.g####.ig####.com
- c####.mob.com
- c-h####.g####.com
- cdn.boo####.com
- cm.adi####.com
- d####.d####.mob.com
- dpa.helianh####.com
- dsp.zhiz####.com
- ga####.lotu####.com
- hm.b####.com
- i####.jd.com
- lf.sn####.com
- m####.e####.cn
- mal####.e####.cn
- o####.ad####.cn
- on####.lotu####.com
- pic.e####.cn
- pub-####.qin####.com
- regi####.xm####.xi####.com
- s.ad####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- t####.zhiz####.com
- v.g####.qq.com
- v.z####.red
- w####.x.jd.com
- www.ggcarr####.com
- adx2rt####.adi####.com/nc?t=####&adxid=####&id=####&adtype=####&traffic=...
- ap####.adi####.com/tj?key=####&rd=####&req=####&token=####
- ap####.adi####.com/tj?key=####&rd=####&req=YWR####&token=####
- api.e####.cn/public/postoutservlet?platform=####&type=####
- api.e####.cn/public/rab.shtml?id=####&network=####&machine=####
- api.m####.adwan####.com/displayNotice.api?reqId=####
- api.m####.w####.cn/apidata/ad?tid=####
- api.map.b####.com/location/ip?ak=####&qq-pf-to=####&machine=####&version...
- app.mijia####.com/ad/show?adtype=####&uid=####&adid=####&adclass=####&os...
- as.lie####.cn/v2/forward/imp/ch/25?version=####&sspaid=####&sid=####&gui...
- c####.mob.com/caconf?appkey=####&plat=####&apppkg=####&appver=####&netwo...
- cm.adi####.com/?t=####&code=####&pcode=####&bid=####&ext=####
- cm.adi####.com/?t=####&d=####&k=####&rd=####&c=####&code=####&pcode=####...
- dpa.helianh####.com/webapi/apply/ope/1?uid=####&adid=####&adclass=####&a...
- dsp.zhiz####.com/track/pixel?op=####&ct=####&price=####&ext=####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&ep=####&et=#...
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?b63ff32####
- i####.jd.com/dsp/np?log=####&v=####&seq=####&n=####&p=####
- m####.e####.cn/good/getGoodDetail?goodId=####
- m####.e####.cn/resources/images/clo.png
- m####.e####.cn/resources/images/jia.png
- m####.e####.cn/resources/images/jian.png
- m####.e####.cn/resources/images/kf201610.png
- m####.e####.cn/resources/layer/layer.js
- m####.e####.cn/resources/layer/need/layer.css
- m####.e####.cn/resources/script/root.js?v=####
- m####.e####.cn/resources/styles/myshop.css?v=####
- o####.ad####.cn/agent/openDisplay.do?st=####&m_lat=####&uuidEncType=####...
- pic.e####.cn/web/260370320.jpg
- s.ad####.com/showsuc?pid=####&bid=####&sid=####&cid=####&size=####&cat=#...
- t####.c####.q####.####.com/tdata_EDT356
- t####.c####.q####.####.com/tdata_LhB659
- t####.c####.q####.####.com/tdata_SzD730
- t####.zhiz####.com/mac.do?turl=http://www.ggcarry888.com/download?aff=##...
- t####.zhiz####.com/mad.do?zzat=####&siteid=####&zzid=####&pr=####&adx=##...
- ti####.c####.l####.####.com/config/hz-hzv3.conf
- v.g####.qq.com/gdt_stats.fcg?viewid=####&i=####&os=####&datatype=####&xp...
- v.z####.red/v2?p=5GH1R####
- w####.x.jd.com/adx/nurl/jiatou?price=####&v=####&ad=####&info=####&ot=##...
- www.ggcarr####.com/download?aff=####
- a####.exc.mob.com/errconf
- a####.u####.com/app_logs
- api.s####.mob.com/conf5
- api.s####.mob.com/conn
- api.s####.mob.com/data2
- api.s####.mob.com/log4
- apilo####.a####.com/v3/log/init
- c####.mob.com/ca
- c-h####.g####.com/api.php?format=####&t=####
- d####.d####.mob.com/dinfo
- d####.d####.mob.com/dsign
- ga####.lotu####.com/?st=####&sv=####&tm=####&sid=GyA####&apn=####&ct=###...
- ga####.lotu####.com:88/?mid=####&st=####&sv=####&tm=####&sid=GyA####&apn...
- sdk.o####.p####.####.com/api.php?format=####&t=####
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/.lock
- /data/data/####/.log.lock
- /data/data/####/.log.ls
- /data/data/####/.statistics
- /data/data/####/46ad860eda76
- /data/data/####/ThrowalbeLog.db-journal
- /data/data/####/cc.db
- /data/data/####/cc.db-journal
- /data/data/####/cn.ecook.xml
- /data/data/####/cn.xn.ecook.odex
- /data/data/####/cn.xn.ecook.zip
- /data/data/####/collectiondatabase
- /data/data/####/collectiondatabase-journal
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/ecookdatabase
- /data/data/####/ecookdatabase-journal
- /data/data/####/exchangeIdentity.json
- /data/data/####/exid.dat
- /data/data/####/f_000001
- /data/data/####/f_000002
- /data/data/####/f_000003
- /data/data/####/f_000004
- /data/data/####/f_000005
- /data/data/####/f_000006
- /data/data/####/f_000007
- /data/data/####/f_000008
- /data/data/####/f_000009
- /data/data/####/f_00000a
- /data/data/####/f_00000b
- /data/data/####/f_00000c
- /data/data/####/f_00000d
- /data/data/####/gdaemon_20161017
- /data/data/####/gx_sp.xml
- /data/data/####/index
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/last_know_location.xml
- /data/data/####/libjiagu.so
- /data/data/####/lotuseed.apps
- /data/data/####/lotuseed.s
- /data/data/####/lotuseed.task
- /data/data/####/lotuseed_global.xml
- /data/data/####/lotuseed_global.xml.bak
- /data/data/####/material.db-journal
- /data/data/####/mipush.xml
- /data/data/####/mipush_extra.xml
- /data/data/####/mob_sdk_exception_1.xml
- /data/data/####/multidex.version.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/recipedatabase-journal
- /data/data/####/run.pid
- /data/data/####/share_sdk_1.xml
- /data/data/####/sharesdk.db-journal
- /data/data/####/tdata_LhB659
- /data/data/####/tdata_LhB659.jar
- /data/data/####/tdata_SzD730
- /data/data/####/tdata_SzD730.jar
- /data/data/####/ua.db
- /data/data/####/ua.db-journal
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/media/####/.db_accache
- /data/media/####/.db_rtcache
- /data/media/####/.dk
- /data/media/####/.duid
- /data/media/####/.globalLock
- /data/media/####/.nomedia
- /data/media/####/.pkg_lock
- /data/media/####/.rc_lock
- /data/media/####/13gfymrav8nkex5a64bmiyrec.tmp
- /data/media/####/1e0tvwg0p3bpqwvap49ho8zwd.tmp
- /data/media/####/1gkjmaf5vt4wfqf9nlq1msru7.tmp
- /data/media/####/1jdrsw9gwbgu9bb3oo86k5t8e.tmp
- /data/media/####/1ky534vea7qakg1bk861axsj3.tmp
- /data/media/####/1mux81z21nusduj1eg1cby9d1.tmp
- /data/media/####/1rj68c06leozp34iwfue2nthl.tmp
- /data/media/####/1s08t25tiout1rtrkborhptai.tmp
- /data/media/####/1zlw3azvqkznn66nj0wxre4di.tmp
- /data/media/####/261pq1vxpb901omz5iiwa3fek.tmp
- /data/media/####/28fv00td82q3h16hck29bm6n6.tmp
- /data/media/####/28hx0onjkxpt5396ow9kv9ynx.tmp
- /data/media/####/28j1l2tplhpqhs2yre6mxebzw.tmp
- /data/media/####/2b98nhczb4dfnaodhfmq8gxm2.tmp
- /data/media/####/2bic88s6g77vqin2uenov29oj.tmp
- /data/media/####/2iaalp2y2krdba7vbdh3fccq6
- /data/media/####/2lm51yne31o86vhqn2v8z0gps.tmp
- /data/media/####/2lr6meenz94wa66o02r968icl.tmp
- /data/media/####/2mgbiic8f9tkxetjlrftz8nue.tmp
- /data/media/####/31hwhr5dn5dlymy7913mj0u16.tmp
- /data/media/####/32l35v5d99a61d63g8uqxc933.tmp
- /data/media/####/32x46n1u4ridhaaao2dljm8bz.tmp
- /data/media/####/3aemspwgbbumi5kh5uz4nsegx.tmp
- /data/media/####/3e1yo5r0pnrxm5k32xdrhxbxr.tmp
- /data/media/####/3fg5mp1ujxzsb0z2b3amm95od.tmp
- /data/media/####/3frsddacy2c4vhu0hs593ag5f.tmp
- /data/media/####/3ha3l9o27oprqe59tvy2awnst.tmp
- /data/media/####/3remjkg3b31gv02mqs3h8i1fb.tmp
- /data/media/####/3s2cw48gagutwmn5vzpszdcj2.tmp
- /data/media/####/3yg7csg0ilzlzlld16iffinhe.tmp
- /data/media/####/3zna15ya2lzrizi386f18b1pp.tmp
- /data/media/####/42a36r3fl075dcqqh0p05rc2i.tmp
- /data/media/####/45y9zfyxextd8fckch5wglnhk.tmp
- /data/media/####/4bvj1f51fqxxdzdgysp51itmb.tmp
- /data/media/####/4c1gcjdykq9nov7u4jcb02gfn.tmp
- /data/media/####/4ez10wabyp8i2fzsgav633r5c.tmp
- /data/media/####/4jqrl53er5jn79w3ugbyg1bdj.tmp
- /data/media/####/4z4nnslh8veuuctz2405txmyk.tmp
- /data/media/####/50rjdcttrtz951c3q4evkpxvs.tmp
- /data/media/####/59j7e5zjudt52ntqg0jfq24jl.tmp
- /data/media/####/5hirej70qrg841n0wg3va141m.tmp
- /data/media/####/5j0wug4hz5k9uh231yb5t4pmo.tmp
- /data/media/####/5jhcd09rgqs1tqu2nk4dk5tq5.tmp
- /data/media/####/5jm5lfwua7dvhg96vjoomro6e.tmp
- /data/media/####/5plmhz52pos8etnqoczg1gjao.tmp
- /data/media/####/61occ3rulhrp5pcyzqv6pcrlp.tmp
- /data/media/####/65xk9buxxuocq02eh2iu25iba.tmp
- /data/media/####/6c4f9wlsugr9x2hcif9fsfvfe.tmp
- /data/media/####/6cg0gddj93882f2xp0fx1h6qn
- /data/media/####/6i8ui47hqy8dcwmdjxgel3kx5.tmp
- /data/media/####/6loqte4dtr3anz5hjkg75m704.tmp
- /data/media/####/6vqlaoa8zz08ythq4s4x2jrpg.tmp
- /data/media/####/70o0ybum5j8pbrie5gr2q2sva.tmp
- /data/media/####/71w98mp3zgkqnb8iqdlmjk281.tmp
- /data/media/####/7e1tlnl4edyleq3nsyu20vuzj.tmp
- /data/media/####/app.db
- /data/media/####/carfsjl1k85vhq4fmehljwrg.tmp
- /data/media/####/cn.xn.ecook.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/ezllji5mzhktk6gwktyi0ebe.tmp
- /data/media/####/journal
- /data/media/####/journal.tmp
- /data/media/####/l1860lle6aof2jw2ihivl41f.tmp
- /data/media/####/log.lock
- /data/media/####/log1.txt
- /data/media/####/lotuseed.devid
- /data/media/####/tdata_LhB659
- /data/media/####/tdata_SzD730
- /data/media/####/test.log
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 24060 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- mount
- ps
- ps 2101
- top -d 0 -n 1
- getuiext2
- libjiagu
- neh
- tusdk-library
- AES-CBC-PKCS7Padding
- AES-ECB-PKCS5Padding
- AES-ECB-PKCS7Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
- AES-CBC-PKCS7Padding
- DES