Adware.Gexin.17832

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) cl####.map.n.####.com:80
TCP(HTTP/1.1) loc.map.b####.com:80
TCP(HTTP/1.1) vec####.map.b####.####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(TLS/1.0) api.map.b####.com:443
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.ig####.com:5227

DNS requests:

7j####.c####.z0.####.com
api.map.b####.com
c-h####.g####.com
c.sz.gt.####.com
cl####.map.b####.com
cm-1####.ig####.com
loc.map.b####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
vec####.map.b####.com

HTTP GET requests:

cl####.map.n.####.com/imap/sdk/tj?qt=####&mb=####&os=####&sv=####&net=##...
q####.c####.l####.####.com/config/hz-hzv6.conf
q####.c####.l####.####.com/tdata_SzD730
q####.c####.l####.####.com/tdata_ZCi456
q####.c####.l####.####.com/tdata_zdX887
sdk.o####.p####.####.com/api/addr.htm
vec####.map.b####.####.com/vecdata/?qt=####&fv=####&p=####&mb=####&os=##...
vec####.map.b####.####.com/vecdata/?qt=####&p=####&mb=####&os=####&sv=##...

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
loc.map.b####.com/sdk.php
sdk.o####.p####.####.com/api.php?format=####&t=####

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/CustomIndex
/data/data/####/DVDirectory.cfg
/data/data/####/DVHotMap.cfg
/data/data/####/DVHotcity.cfg
/data/data/####/DVIndoor.cfg
/data/data/####/DVVersion.cfg
/data/data/####/ResPack.rs
/data/data/####/ResPackIndoorMap.rs
/data/data/####/authStatus_com.jieshunpay.smartpark.xml
/data/data/####/authStatus_com.jieshunpay.smartpark;pushservice.xml
/data/data/####/authStatus_com.jieshunpay.smartpark;remote.xml
/data/data/####/baseindoormap.sty
/data/data/####/clientid_igexin.xml
/data/data/####/firll.dat
/data/data/####/gdaemon_20161017
/data/data/####/gkt-journal
/data/data/####/hst.db
/data/data/####/hst.db-journal
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/jstapp.xml
/data/data/####/libcuid.so
/data/data/####/libjiagu2058771772.so
/data/data/####/map_pref.xml
/data/data/####/mapstyle.sty
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qihoo_jiagu_crash_report.xml
/data/data/####/run.pid
/data/data/####/satellitestyle.sty
/data/data/####/tdata_SzD730
/data/data/####/tdata_SzD730.jar
/data/data/####/tdata_ZCi456
/data/data/####/tdata_ZCi456.jar
/data/data/####/tdata_zdX887
/data/data/####/tdata_zdX887.jar
/data/data/####/trafficstyle.sty
/data/data/####/ver.dat
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/media/####/.cuid2
/data/media/####/.nomedia
/data/media/####/DTTempdat.dat
/data/media/####/DTTempdat.idx
/data/media/####/HMTempdat.dat
/data/media/####/HMTempdat.idx
/data/media/####/ITTempdat.dat
/data/media/####/ITTempdat.idx
/data/media/####/account-a7fc37961d.js
/data/media/####/account-b86c9c6dfe.css
/data/media/####/account.html
/data/media/####/account_bill-195b487942.js
/data/media/####/account_bill-ebf61e94ad.css
/data/media/####/account_bill.html
/data/media/####/account_bill_sub-0cc82c9d72.js
/data/media/####/account_bill_sub-9ebd595b41.css
/data/media/####/account_bill_sub.html
/data/media/####/account_bindcard-3e376f8703.css
/data/media/####/account_bindcard-7548d47922.js
/data/media/####/account_bindcard.html
/data/media/####/account_mycard-87265a275f.css
/data/media/####/account_mycard-f4a3c3014c.js
/data/media/####/account_mycard.html
/data/media/####/account_recharge-3c1d225c00.css
/data/media/####/account_recharge-f1344016fb.js
/data/media/####/account_recharge.html
/data/media/####/account_result-123dd3efb5.js
/data/media/####/account_result-975388c325.css
/data/media/####/account_result.html
/data/media/####/account_takepay-4f96fdb774.js
/data/media/####/account_takepay-d8daed1def.css
/data/media/####/account_takepay.html
/data/media/####/agreement-18e3227a59.js
/data/media/####/agreement-68ce5a8a9d.css
/data/media/####/agreement.html
/data/media/####/app.db
/data/media/####/bank_logo.jpg
/data/media/####/base-d00b8a8ad1.css
/data/media/####/beij.png
/data/media/####/bg_about_us.png
/data/media/####/bg_banner_more.png
/data/media/####/bg_banner_yxyz.png
/data/media/####/bg_biaog.png
/data/media/####/bg_charge_arrow.png
/data/media/####/bg_charge_battery.png
/data/media/####/bg_charge_car.png
/data/media/####/bg_charge_charing.png
/data/media/####/bg_charge_kf.png
/data/media/####/bg_charge_lighting.png
/data/media/####/bg_charge_result.png
/data/media/####/bg_charge_scancode.png
/data/media/####/bg_charge_status_dynamic.svg
/data/media/####/bg_charge_status_shadow.svg
/data/media/####/bg_charge_status_static.svg
/data/media/####/bg_cloud_banner.png
/data/media/####/bg_cloud_banner_big.png
/data/media/####/bg_conpon_nodata.png
/data/media/####/bg_coupon_expired.png
/data/media/####/bg_coupon_left.png
/data/media/####/bg_coupon_left_expired.png
/data/media/####/bg_coupon_right.png
/data/media/####/bg_coupon_right_expired.png
/data/media/####/bg_daikoulb.png
/data/media/####/bg_index.png
/data/media/####/bg_index_big.png
/data/media/####/bg_lub.png
/data/media/####/bg_lubjs.png
/data/media/####/bg_main_news1_tip1.png
/data/media/####/bg_main_news1_tip2.png
/data/media/####/bg_main_news1_tip3.png
/data/media/####/bg_main_news2_tip1.png
/data/media/####/bg_main_news2_tip2.png
/data/media/####/bg_main_news2_tip3.png
/data/media/####/bg_main_top_banner.png
/data/media/####/bg_msg_empty.png
/data/media/####/bg_park_stop.png
/data/media/####/bg_parkinfo_default.png
/data/media/####/bg_peccancy_chelshb.png
/data/media/####/bg_peccancy_fadjh.png
/data/media/####/bg_peccancy_wujl.png
/data/media/####/bg_quan.png
/data/media/####/bg_tingc.png
/data/media/####/bg_wode.png
/data/media/####/bg_youyuan.png
/data/media/####/bg_yuekh.png
/data/media/####/bg_yueku.png
/data/media/####/bg_zhuclb.png
/data/media/####/bj_guany.png
/data/media/####/boh.png
/data/media/####/business-05ea6efd50.css
/data/media/####/business-1a70eae605.js
/data/media/####/business.html
/data/media/####/car_appeal-5ecb1bb6fe.css
/data/media/####/car_appeal-859ed36301.js
/data/media/####/car_appeal.html
/data/media/####/car_appeal_input-9476d516af.css
/data/media/####/car_appeal_input-c20055798e.js
/data/media/####/car_appeal_input.html
/data/media/####/change_password-1e831df6c4.css
/data/media/####/change_password-c91c3d35b3.js
/data/media/####/change_password.html
/data/media/####/charge_detail-a03e39696e.css
/data/media/####/charge_detail-f6c8b2468e.js
/data/media/####/charge_detail.html
/data/media/####/charge_help-6a0ab5913f.js
/data/media/####/charge_help-cdbebd4da1.css
/data/media/####/charge_help.html
/data/media/####/charge_input-c23739e0a0.css
/data/media/####/charge_input-c45dc9b9e0.js
/data/media/####/charge_input.html
/data/media/####/charge_record-957abc78c2.js
/data/media/####/charge_record-bc51220513.css
/data/media/####/charge_record.html
/data/media/####/charge_record_sub-8aa84ec364.css
/data/media/####/charge_record_sub-f0bfc923e4.js
/data/media/####/charge_record_sub.html
/data/media/####/charge_state-5325e33f4b.js
/data/media/####/charge_state-befc7971f1.css
/data/media/####/charge_state.html
/data/media/####/cloud_index-0bb3e9faf3.css
/data/media/####/cloud_index-de6b6f024d.js
/data/media/####/cloud_index.html
/data/media/####/cloud_indoor_detail-bacc37cba2.js
/data/media/####/cloud_indoor_detail-dbe4717721.css
/data/media/####/cloud_indoor_detail.html
/data/media/####/cloud_navigation-a733802b27.css
/data/media/####/cloud_navigation-cd02f3a22f.js
/data/media/####/cloud_navigation.html
/data/media/####/cloud_nearby-2429dd431b.css
/data/media/####/cloud_nearby-da2def499e.js
/data/media/####/cloud_nearby.html
/data/media/####/cloud_park_indoor-406d232ca7.css
/data/media/####/cloud_park_indoor-bdecb73704.js
/data/media/####/cloud_park_indoor.html
/data/media/####/cloud_park_info-78873ef6c1.js
/data/media/####/cloud_park_info-fdbf450dc5.css
/data/media/####/cloud_park_info.html
/data/media/####/cloud_park_record-bc51220513.css
/data/media/####/cloud_park_record-c04e48a875.js
/data/media/####/cloud_park_record.html
/data/media/####/cloud_park_record_sub-42acd08b60.js
/data/media/####/cloud_park_record_sub-f8841aee53.css
/data/media/####/cloud_park_record_sub.html
/data/media/####/cloud_pay_result-5f7458760c.css
/data/media/####/cloud_pay_result-af4ce79489.js
/data/media/####/cloud_pay_result.html
/data/media/####/cloud_pay_way-8ba26e890b.js
/data/media/####/cloud_pay_way-fe26b1d323.css
/data/media/####/cloud_pay_way.html
/data/media/####/cloud_search-05ef4135fa.css
/data/media/####/cloud_search-d39a1598db.js
/data/media/####/cloud_search.html
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.jieshunpay.smartpark.db
/data/media/####/common-e454de341f.js
/data/media/####/confirm-6217243e05.css
/data/media/####/core.js
/data/media/####/coupon_list-a7a68e2c42.js
/data/media/####/coupon_list-b78d80e29c.css
/data/media/####/coupon_list.html
/data/media/####/coupon_select-72c3b384a0.js
/data/media/####/coupon_select-913eb6b638.css
/data/media/####/coupon_select.html
/data/media/####/empty-a463d3357f.css
/data/media/####/enc-base64.js
/data/media/####/feedback-4a01f69ca7.js
/data/media/####/feedback-5b3ff39e41.css
/data/media/####/feedback.html
/data/media/####/feedback_list-470cc841c5.js
/data/media/####/feedback_list-66caa903f8.css
/data/media/####/feedback_list.html
/data/media/####/finding_car-21a0404815.js
/data/media/####/finding_car-bc51220513.css
/data/media/####/finding_car.html
/data/media/####/footer-309202a200.css
/data/media/####/forget_login_pwd-424af6aa52.js
/data/media/####/forget_login_pwd-ad0f9d7cf5.css
/data/media/####/forget_login_pwd.html
/data/media/####/forget_pay_pwd-2d1e3a12c3.js
/data/media/####/forget_pay_pwd-de54b2ab75.css
/data/media/####/forget_pay_pwd.html
/data/media/####/getback_password-98db21e878.js
/data/media/####/getback_password-9feeede8df.css
/data/media/####/getback_password.html
/data/media/####/gongs.png
/data/media/####/guangd.png
/data/media/####/guangf.png
/data/media/####/header-bc51220513.css
/data/media/####/huax.png
/data/media/####/huis.png
/data/media/####/icon_account_mobile.png
/data/media/####/icon_add_car.png
/data/media/####/icon_add_feedback.png
/data/media/####/icon_alipay_pay.png
/data/media/####/icon_ask.png
/data/media/####/icon_autogoods.png
/data/media/####/icon_balance_charge.png
/data/media/####/icon_bank_boc.png
/data/media/####/icon_bchch.png
/data/media/####/icon_bill.png
/data/media/####/icon_bill_other.png
/data/media/####/icon_bill_recharge.png
/data/media/####/icon_bill_tuik.png
/data/media/####/icon_bill_xiaof.png
/data/media/####/icon_blackdelete.png
/data/media/####/icon_bxz.png
/data/media/####/icon_car_card.png
/data/media/####/icon_card_car.png
/data/media/####/icon_card_help.png
/data/media/####/icon_card_null.png
/data/media/####/icon_card_phone.png
/data/media/####/icon_cha.png
/data/media/####/icon_charge.png
/data/media/####/icon_charge_status_item_tip.png
/data/media/####/icon_checked.png
/data/media/####/icon_chel.png
/data/media/####/icon_chengg.png
/data/media/####/icon_cloud_chec.png
/data/media/####/icon_cloud_chech.png
/data/media/####/icon_cloud_checxz.png
/data/media/####/icon_cloud_daohang.png
/data/media/####/icon_cloud_normal_car.png
/data/media/####/icon_cloud_overtime_car.png
/data/media/####/icon_cloud_tcjl.png
/data/media/####/icon_cloud_tianjcl.png
/data/media/####/icon_cloud_tishi.png
/data/media/####/icon_cloud_zidjf.png
/data/media/####/icon_collection_off.png
/data/media/####/icon_collection_on.png
/data/media/####/icon_cou_bxz.png
/data/media/####/icon_cou_xz.png
/data/media/####/icon_daik.png
/data/media/####/icon_delete.png
/data/media/####/icon_deposit.png
/data/media/####/icon_face.gif
/data/media/####/icon_fail_green.png
/data/media/####/icon_footer_home.png
/data/media/####/icon_footer_home_on.png
/data/media/####/icon_footer_my.png
/data/media/####/icon_footer_my_on.png
/data/media/####/icon_footer_nearby.png
/data/media/####/icon_footer_nearby_on.png
/data/media/####/icon_gou.png
/data/media/####/icon_home.png
/data/media/####/icon_index_car.png
/data/media/####/icon_index_left.png
/data/media/####/icon_index_right.png
/data/media/####/icon_index_roadpark.png
/data/media/####/icon_index_warnorder.png
/data/media/####/icon_input_clear.png
/data/media/####/icon_input_mobile.png
/data/media/####/icon_input_pwd.png
/data/media/####/icon_input_smscode.png
/data/media/####/icon_jiant.png
/data/media/####/icon_jies.png
/data/media/####/icon_jil.png
/data/media/####/icon_jstc.png
/data/media/####/icon_jyf_pay.png
/data/media/####/icon_kong.png
/data/media/####/icon_left_top_close.png
/data/media/####/icon_lianj.png
/data/media/####/icon_light_off.png
/data/media/####/icon_light_on.png
/data/media/####/icon_ljck.png
/data/media/####/icon_loading.gif
/data/media/####/icon_logo.png
/data/media/####/icon_main_car_overtime.png
/data/media/####/icon_main_car_park.png
/data/media/####/icon_main_charge.png
/data/media/####/icon_main_charge_park.png
/data/media/####/icon_main_hint.png
/data/media/####/icon_main_indoor.png
/data/media/####/icon_main_park_overtime_hint.png
/data/media/####/icon_main_park_tip.png
/data/media/####/icon_main_road.png
/data/media/####/icon_maintain.png
/data/media/####/icon_mian_park_jt.png
/data/media/####/icon_mian_tip.png
/data/media/####/icon_mobile.png
/data/media/####/icon_monthcard.png
/data/media/####/icon_my_msg.png
/data/media/####/icon_my_msg_tip_big.png
/data/media/####/icon_my_msg_tip_small.png
/data/media/####/icon_navi.png
/data/media/####/icon_next.png
/data/media/####/icon_park_withhold.png
/data/media/####/icon_parktype_indoor.png
/data/media/####/icon_parktype_jieshunyun.png
/data/media/####/icon_parktype_outside.png
/data/media/####/icon_peccancy.png
/data/media/####/icon_peccancy_check.png
/data/media/####/icon_peccancy_detail.png
/data/media/####/icon_phone.png
/data/media/####/icon_picker_selected.png
/data/media/####/icon_plate_close.png
/data/media/####/icon_ps_head.png
/data/media/####/icon_pwd_eye.png
/data/media/####/icon_pwd_eye_on.png
/data/media/####/icon_qieh.png
/data/media/####/icon_recharge_ad_close.png
/data/media/####/icon_return.png
/data/media/####/icon_right.png
/data/media/####/icon_right_park_list.png
/data/media/####/icon_setting.png
/data/media/####/icon_sha.png
/data/media/####/icon_shezh.png
/data/media/####/icon_shibai.png
/data/media/####/icon_shij.png
/data/media/####/icon_shin.png
/data/media/####/icon_shineit.png
/data/media/####/icon_shinp.png
/data/media/####/icon_shouj.png
/data/media/####/icon_sous.png
/data/media/####/icon_standline.png
/data/media/####/icon_success_green.png
/data/media/####/icon_suod.png
/data/media/####/icon_tianj.png
/data/media/####/icon_tp_how.png
/data/media/####/icon_tp_intro.png
/data/media/####/icon_tp_jyf.png
/data/media/####/icon_tyre.png
/data/media/####/icon_view_charge.png
/data/media/####/icon_view_dh.png
/data/media/####/icon_view_find.png
/data/media/####/icon_wash.png
/data/media/####/icon_wchat.png
/data/media/####/icon_weiz.png
/data/media/####/icon_wumim.png
/data/media/####/icon_wx_pay.png
/data/media/####/icon_xiaox.png
/data/media/####/icon_xz.png
/data/media/####/icon_yij.png
/data/media/####/icon_yinhangk.png
/data/media/####/icon_youh.png
/data/media/####/icon_yuebanl.png
/data/media/####/icon_yuek.png
/data/media/####/icon_yueka.png
/data/media/####/icon_yz_kong.png
/data/media/####/icon_yz_park_withhold.png
/data/media/####/icon_yz_parktype_indoor.png
/data/media/####/icon_yz_parktype_outside.png
/data/media/####/icon_zhangd.png
/data/media/####/icon_zhfb.png
/data/media/####/index-3b3975745f.css
/data/media/####/index-82e703ba4c.js
/data/media/####/index.html
/data/media/####/index_backup-1eadc795ae.css
/data/media/####/index_backup-887d2716ea.js
/data/media/####/index_backup.html
/data/media/####/input-c020fbb42f.css
/data/media/####/jians.png
/data/media/####/jiaot.png
/data/media/####/kp_invoice-bc51220513.css
/data/media/####/kp_invoice-fb2e331cfd.js
/data/media/####/kp_invoice.html
/data/media/####/lanuch-f2a51bc572.js
/data/media/####/lanuch.html
/data/media/####/loading.gif
/data/media/####/login-4dadc51c45.js
/data/media/####/login-96446c9d35.css
/data/media/####/login.html
/data/media/####/login_bg.png
/data/media/####/lub_h_bg1.png
/data/media/####/lub_h_bg2.png
/data/media/####/lub_h_bg3.png
/data/media/####/manifest.json
/data/media/####/md5.js
/data/media/####/mings.png
/data/media/####/month_card_help-047aa7be30.js
/data/media/####/month_card_help-af65cdeeeb.css
/data/media/####/month_card_help.html
/data/media/####/month_card_renew-4e90081a7e.js
/data/media/####/month_card_renew-890834c0cb.css
/data/media/####/month_card_renew.html
/data/media/####/month_card_result-b3bfbffdb6.css
/data/media/####/month_card_result-e8cfd1e846.js
/data/media/####/month_card_result.html
/data/media/####/monthcard_pay_record-81f65853de.js
/data/media/####/monthcard_pay_record-ac6a85ea34.css
/data/media/####/monthcard_pay_record.html
/data/media/####/more-0dcccfda8b.css
/data/media/####/more-f966e3b5c7.js
/data/media/####/more.html
/data/media/####/more_banner.png
/data/media/####/mui-b91faa237c.picker.css
/data/media/####/mui.js
/data/media/####/mui.picker.js
/data/media/####/mui.poppicker.js
/data/media/####/mui.previewimage.js
/data/media/####/mui.slider.pullrefresh.js
/data/media/####/mui.view.js
/data/media/####/mui.zoom.js
/data/media/####/my_car-76f5d948b0.js
/data/media/####/my_car-f88ddf6cb3.css
/data/media/####/my_car.html
/data/media/####/my_collection_list-068fa17f98.css
/data/media/####/my_collection_list-a4bc3a4732.js
/data/media/####/my_collection_list.html
/data/media/####/my_monthcard-2e1f7f21d1.js
/data/media/####/my_monthcard-6d7b9244b9.css
/data/media/####/my_monthcard.html
/data/media/####/my_monthcard_open-a0984c764c.js
/data/media/####/my_monthcard_open-c5a2d0808d.css
/data/media/####/my_monthcard_open.html
/data/media/####/my_monthcard_sub-1c710b6731.css
/data/media/####/my_monthcard_sub-f42fbb533d.js
/data/media/####/my_monthcard_sub.html
/data/media/####/my_msg-0ad94d8117.js
/data/media/####/my_msg-bc51220513.css
/data/media/####/my_msg.html
/data/media/####/my_msg_info-6e7aa9eaab.css
/data/media/####/my_msg_info-d746f8190f.js
/data/media/####/my_msg_info.html
/data/media/####/my_msg_sub-540f92a195.js
/data/media/####/my_msg_sub-97682fb199.css
/data/media/####/my_msg_sub.html
/data/media/####/my_park_record-8ffd01ad84.js
/data/media/####/my_park_record-bc51220513.css
/data/media/####/my_park_record.html
/data/media/####/my_park_record_sub-7a001a2904.css
/data/media/####/my_park_record_sub-9100d60d9c.js
/data/media/####/my_park_record_sub.html
/data/media/####/nearby-053ec7c286.css
/data/media/####/nearby-0d2142bb04.js
/data/media/####/nearby.html
/data/media/####/news_info-bc51220513.css
/data/media/####/news_info-f87c43676d.js
/data/media/####/news_info.html
/data/media/####/news_info_detail-1e4806a28b.css
/data/media/####/news_info_detail-6af43ac21b.js
/data/media/####/news_info_detail.html
/data/media/####/news_info_sub-1d2ce0751c.js
/data/media/####/news_info_sub-416d4a030b.css
/data/media/####/news_info_sub.html
/data/media/####/nongy.png
/data/media/####/page_view-f74e24b18d.css
/data/media/####/park_detail-80da26f30f.js
/data/media/####/park_detail-dbe4717721.css
/data/media/####/park_detail.html
/data/media/####/park_info-58d30799b5.js
/data/media/####/park_info-b62e5b6108.css
/data/media/####/park_info.html
/data/media/####/park_list-6c84700158.js
/data/media/####/park_list-a172216142.css
/data/media/####/park_list.html
/data/media/####/park_list_sub-4851d78934.css
/data/media/####/park_list_sub-8a999958b2.js
/data/media/####/park_list_sub.html
/data/media/####/park_stop-406d232ca7.css
/data/media/####/park_stop-a06bb7ad2a.js
/data/media/####/park_stop.html
/data/media/####/pay_result-5f7458760c.css
/data/media/####/pay_result-6e934c89be.js
/data/media/####/pay_result.html
/data/media/####/pay_way-0175d72076.js
/data/media/####/pay_way-e53c6dbdcc.css
/data/media/####/pay_way.html
/data/media/####/payment-0d72dcbd1b.css
/data/media/####/payment-46842393a1.js
/data/media/####/payment.html
/data/media/####/peccancy_check-3ecb50d8d3.js
/data/media/####/peccancy_check-957a03910c.css
/data/media/####/peccancy_check.html
/data/media/####/peccancy_result-8554283223.js
/data/media/####/peccancy_result-c49e6c53f3.css
/data/media/####/peccancy_result.html
/data/media/####/pinga.png
/data/media/####/popup_pay_password-2823fa7bcf.css
/data/media/####/popup_pay_password.html
/data/media/####/popup_plate_number-eeca55efa1.css
/data/media/####/popup_plate_number.html
/data/media/####/popup_sms_input-83e0188ac7.css
/data/media/####/popup_sms_input.html
/data/media/####/puf.png
/data/media/####/register-3624e23837.css
/data/media/####/register-d610fa53d5.js
/data/media/####/register.html
/data/media/####/road_stop-081033606f.css
/data/media/####/road_stop-3ff0243573.js
/data/media/####/road_stop.html
/data/media/####/set-2be7331093.css
/data/media/####/set-46692b0d17.js
/data/media/####/set.html
/data/media/####/slider-30bd856d6a.css
/data/media/####/sprite-d41d8cd98f.css
/data/media/####/switch-6f56273dd2.css
/data/media/####/takepay_explain-23890ed31c.js
/data/media/####/takepay_explain-6ad2761544.css
/data/media/####/takepay_explain.html
/data/media/####/takepay_intro-1368b875b6.js
/data/media/####/takepay_intro-30582d1e23.css
/data/media/####/takepay_intro.html
/data/media/####/tdata_SzD730
/data/media/####/tdata_ZCi456
/data/media/####/tdata_zdX887
/data/media/####/test.0
/data/media/####/test.log
/data/media/####/union_pay_icon.png
/data/media/####/xingy.png
/data/media/####/yoh.dat
/data/media/####/yol.dat
/data/media/####/yom.dat
/data/media/####/youz.png
/data/media/####/zhaos.png
/data/media/####/zhes.png
/data/media/####/zhongg.png
/data/media/####/zhongx.png

Miscellaneous:

Executes the following shell scripts:

<Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25480 300 0
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu2058771772.so
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.igexin.sdk.PushService 25480 300 0

Loads the following dynamic libraries:

BaiduMapSDK_base_v4_2_1
BaiduMapSDK_map_v4_2_1
getuiext2
libjiagu2058771772
locSDK7a

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial