Android.Gexin.1853

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.Gexin.1

Network activity:

Connects to:

UDP(DNS) <Google DNS>
UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) d####.opensp####.cn:80
TCP(HTTP/1.1) v.xuewe####.com:80
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(HTTP/1.1) h####.opensp####.cn:80
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) i####.easy####.com:443
TCP(TLS/1.0) views####.easy####.com:443
TCP(TLS/1.0) u####.u####.com:443
TCP(TLS/1.0) u####.g####.cn:443
TCP(TLS/1.0) group-l####.easy####.com:443
TCP(TLS/1.0) reso####.g####.cn:443
TCP(TLS/1.0) adt.x####.com:443
TCP(TLS/1.0) r####.tc.qq.com:443
TCP(TLS/1.0) 1####.177.14.94:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.0) scr####.easy####.com:443
TCP(TLS/1.0) i####.gu####.com:443
TCP(TLS/1.0) plb####.u####.com:443
TCP(TLS/1.0) a.gu####.com:443
TCP(TLS/1.0) v.xuewe####.com:443
TCP(TLS/1.2) 1####.177.14.94:443
TCP(TLS/1.2) p####.google####.com:443
TCP(TLS/1.2) 1####.177.14.106:443
UDP rr2---s####.g####.com:443
UDP p####.google####.com:443
TCP sdk.o####.t####.####.com:5224
UDP 1####.250.150.101:443
TCP cm-1####.g####.com:5225

DNS requests:

7j####.c####.z0.####.com
a.gu####.com
adt.x####.com
and####.b####.qq.com
cm-1####.g####.com
d####.opensp####.cn
group-l####.easy####.com
h####.opensp####.cn
hm.b####.com
i####.easy####.com
i####.gu####.com
i.t####.com
l####.easy####.com
p####.google####.com
pass####.gu####.com
plb####.u####.com
r####.wx.qq.com
reso####.g####.cn
rr2---s####.g####.com
scr####.easy####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
u####.g####.cn
u####.u####.com
v.xuewe####.com
views####.easy####.com

HTTP GET requests:

h####.opensp####.cn/launchconfig?t=####&p=eHVlL####
reso####.g####.cn:443/98b3e3_ltml36jj5.jpg
scr####.easy####.com:443/group-prd1/wav/sound.wav
u####.g####.cn:443/v/images/201908/189600e89feb865c52ba11ce091661c7.jpg
u####.g####.cn:443/v/images/201908/3c00fce24b8abb71ff40a9d58527a3f2.jpg
u####.g####.cn:443/v/images/201908/9a9578c405bf8d33bfd890c202ed7241.jpg
u####.g####.cn:443/v/images/201908/ce18377ba389aa8e6972d00b9aabe64b.jpg
u####.g####.cn:443/v/images/202004/be2d36dd9f5670271e8a334afa2c4a7d.jpg
u####.g####.cn:443/v/res/201801/05-18/icon_dabanke@2x.png
u####.g####.cn:443/v/res/201801/05-18/icon_kouyu@2x.png
u####.g####.cn:443/v/res/201801/05-18/icon_recording@2x.png
u####.g####.cn:443/v/res/201801/05-18/icon_test@2x.png
u####.g####.cn:443/v/res/201801/05-18/icon_zhenjing@2x.png
u####.g####.cn:443/v/res/201801/05-18/icon_zhibo@2x.png
u####.g####.cn:443/v/res/201902/19-11/WechatIMG2.png
v.xuewe####.com/api/loadimg?channel=####
v.xuewe####.com/apiielts
v.xuewe####.com/index/heartbeat
v.xuewe####.com:443/api/androidupgrade
views####.easy####.com:443/view/live-view/v1.8.0.9/wav/sound.wav

HTTP POST requests:

adt.x####.com:443/4e76f11b/1
adt.x####.com:443/e316d0c2/1
and####.b####.qq.com/rqd/async?aid=####
d####.opensp####.cn/index.php/clientrequest/clientcollect/isCollect
plb####.u####.com:443/umpx_internal
sdk.o####.p####.####.com/api.php?format=####&t=####
u####.u####.com:443/unify_logs

File system changes:

Creates the following files:

/data/data/####/-12330662181155601715
/data/data/####/-15014107921037031402
/data/data/####/-15014107921957077145
/data/data/####/-1677175712901174818
/data/data/####/-350165309-688389722
/data/data/####/-48322587-1792661395
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/02728429ad15a016_0
/data/data/####/028a041c422d01f2ae3b715304fe5800894bf7483c59466...dbe0.0
/data/data/####/02966f381092b40e_0
/data/data/####/030367989563821893e87d6a7f3e9528e8790987a67df37...cc1e.0
/data/data/####/030d037c492a1b87_0
/data/data/####/039d28b4b28685b7_0
/data/data/####/04781400c8ddccbe_0
/data/data/####/0703c5cef196c11f_0
/data/data/####/074a11854f92b1fb_0
/data/data/####/08f9d855c2dda6c9_0
/data/data/####/09ffcef627bab45e_0
/data/data/####/0d873a686fd8fde2_0
/data/data/####/0df23f2ea2a84c62_0
/data/data/####/1002
/data/data/####/1004
/data/data/####/1206326a852684ab_0
/data/data/####/1229bed5813e80c6_0
/data/data/####/1422294321d229ee_0
/data/data/####/14c652a732cb3de29dac6371229784dae85afb8cf9da118...7f18.0
/data/data/####/1571ea4f17338f49_0
/data/data/####/1571ea4f17338f49_1
/data/data/####/16cb7f926f9c5e12b4d31242b0557e095833a5154087946....0.tmp
/data/data/####/1716934080732_5003
/data/data/####/1716934080791_5003
/data/data/####/1716934084467_5183
/data/data/####/1716934084514_5183
/data/data/####/1716934087580_5183
/data/data/####/1716934087622_5183
/data/data/####/1716934087673_5183
/data/data/####/1716934087712_5183
/data/data/####/1716934088223_5199
/data/data/####/1716934088251_5199
/data/data/####/1716934088874_5199
/data/data/####/1716934088925_5199
/data/data/####/18be65508ce71540_0
/data/data/####/18f6a0a678dcbbbd_0
/data/data/####/1a5588dc3e0c9312_0
/data/data/####/1b2a2c959b599327_0
/data/data/####/1cf1d92283bc8189_0
/data/data/####/1cf1d92283bc8189_1
/data/data/####/1f6cec09631e791f_0
/data/data/####/20297773721440660730
/data/data/####/2082901684677746208
/data/data/####/20f59e938af62ee5_0
/data/data/####/2167d03f64cfb574_0
/data/data/####/226c7b2440e5a50b_0
/data/data/####/226c7b2440e5a50b_1
/data/data/####/22b1126f552c306e_0
/data/data/####/22d11072ca573a46_0
/data/data/####/251d39ffd177e335a771805520c501551d02f25d2a0e6a0...dc50.0
/data/data/####/253244048-505890021
/data/data/####/27e2bc64e58b67b3_0
/data/data/####/27e2bc64e58b67b3_1
/data/data/####/28fa31f91c62ca11_0
/data/data/####/2ae6d39b9525734e_0
/data/data/####/2cf04e28785c31eb_0
/data/data/####/2e14c3eda6649fe59504414c267f332e9084d9bed7ab312...77ee.0
/data/data/####/2fbc9e0c3399800d_0
/data/data/####/2fe6d06a16deb195_0
/data/data/####/2ffe4521dc20676c_0
/data/data/####/302faa7af173aeee_0
/data/data/####/33811a33d1e5fc7d_0
/data/data/####/33f7b3e08eb2dcc0_0
/data/data/####/354537e28bb85a53_0
/data/data/####/3677a9fd89ef9fcf_0
/data/data/####/369216849503e3be_0
/data/data/####/3862d6371c63844f_0
/data/data/####/389f5741b6132bc5_0
/data/data/####/3a0386c183aadc39_0
/data/data/####/3db44917d07ca99a_0
/data/data/####/3e6ec32fcedbd32f_0
/data/data/####/3e70b27f6235c1c6_0
/data/data/####/3e952d0b5a1f235f_0
/data/data/####/40a20a5a93d55741_0
/data/data/####/41381cf637bae7fa_0
/data/data/####/432692857099713e_0
/data/data/####/44208d95f3ce0d5a_0
/data/data/####/44208d95f3ce0d5a_1
/data/data/####/44c6ffafd3977841_0
/data/data/####/45a1e6d2663f5389c7de3af7c5db9ebefbf07731ec066a3...716c.0
/data/data/####/478de47f08f4fb38_0
/data/data/####/4c401cec8cb21327_0
/data/data/####/4cf3ac096075e148_0
/data/data/####/4d95e26d664651dd_0
/data/data/####/4d98aa841ae55300_0
/data/data/####/4e53b3fd398a2383_0
/data/data/####/4eb54ff15f7f1b4c_0
/data/data/####/4eb54ff15f7f1b4c_1
/data/data/####/4fdc969e855bfe0e_0
/data/data/####/508cca60b7a7f0c5_0
/data/data/####/50c77cfc4afcc1f1_0
/data/data/####/50c77cfc4afcc1f1_1
/data/data/####/511eecc8e803fa4e_0
/data/data/####/534bf48d6dac283f_0
/data/data/####/55cf5b163a3bceb5_0
/data/data/####/58b46c539997f083_0
/data/data/####/5b95ad5dbb6524aa48919b8d3434807735abadde2ca36d5...6bc1.0
/data/data/####/5cd9d5c1aa6a3808_0
/data/data/####/5cf08394bce434f0_0
/data/data/####/5d70a9762259a0c6_0
/data/data/####/5d70a9762259a0c6_1
/data/data/####/5fa387557655acf2_0
/data/data/####/642d003ec179062d_0
/data/data/####/64e8a12095ddf8b6_0
/data/data/####/660a7974967964ac_0
/data/data/####/6668036332d3129d_0
/data/data/####/68645ca922ce20cc_0
/data/data/####/68dd792a189bfb43_0
/data/data/####/68dd792a189bfb43_1
/data/data/####/6a36a72496639b17_0
/data/data/####/6a447ebb96176a29_0
/data/data/####/6a8736a99f93c6d693c27c6b890b3bc91a51c89b6ac34e5...6ccb.0
/data/data/####/6d9d0150d71573b7_0
/data/data/####/6f9dbbe524d3aca7_0
/data/data/####/700905820-562451430
/data/data/####/70492d67869162f5_0
/data/data/####/705601d6e5037515_0
/data/data/####/70af973c821bc960_0
/data/data/####/7203cfba459b6787_0
/data/data/####/7203cfba459b6787_1
/data/data/####/7417d89682309174_0
/data/data/####/7428ab2dd7c925bb_0
/data/data/####/757b25932009386a_0
/data/data/####/7586978ed620b814_0
/data/data/####/759f8620fd2b9ebb_0
/data/data/####/764c4271047118e1_0
/data/data/####/77cb098f057c5f91_0
/data/data/####/795ca810cfd5d6f8a22ba931d2cbba63413c08482469d35...bd9c.0
/data/data/####/7a7a33effe62f2c0_0
/data/data/####/7aefbd328da0f5f6_0
/data/data/####/7cd390dcc4dbb16a_0
/data/data/####/7dce42738f02e8c4_0
/data/data/####/7f31df91473b6f7d_0
/data/data/####/8332eac8dfbac578_0
/data/data/####/83e8a479093e65c8_0
/data/data/####/846762017ae00b79_0
/data/data/####/84bebf3919f38b08_0
/data/data/####/87faeb8fbb6d12b8_0
/data/data/####/89f37cbc4fd0d709_0 (deleted)
/data/data/####/8b82d638e47e9380_0
/data/data/####/8be4beb28ba9b9b8_0
/data/data/####/8be4beb28ba9b9b8_1
/data/data/####/8c85e2641cf2939d_0
/data/data/####/8c8ee29596ef3411_0
/data/data/####/8da0c5fa619c1bf3_0
/data/data/####/8fb87a825a7ad519_0
/data/data/####/9071dfdc4bf886ac_0
/data/data/####/90c75879c1271b3b_0
/data/data/####/914d8e5cb0fd6966_0
/data/data/####/91f4552f24204ad4_0
/data/data/####/92ec1b316f798326_0
/data/data/####/92ec1b316f798326_1
/data/data/####/9896a1594213db6a_0
/data/data/####/9a0469ef7c1f446b_0
/data/data/####/9f81eabb5f8a2042_0
/data/data/####/9faf5d0e9f212522_0
/data/data/####/Alvin2.xml
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/ContextData.xml
/data/data/####/CookiePrefsFile.xml
/data/data/####/CookiePrefsFile.xml.bak
/data/data/####/Cookies-journal
/data/data/####/QDNSSupport.xml
/data/data/####/TD_app_pefercen_profile.xml
/data/data/####/TD_app_pefercen_profile.xml.bak
/data/data/####/TDpref_longtime.xml
/data/data/####/TDpref_longtime1.xml
/data/data/####/TDpref_longtime1.xml.bak
/data/data/####/TDpref_shorttime.xml
/data/data/####/TDpref_shorttime1.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/WebViewChromiumPrefs.xml
/data/data/####/XNSDKStore1.0.xml
/data/data/####/XNclientid.xml
/data/data/####/XNmachineid.xml
/data/data/####/_nohttp_cookies_db.db
/data/data/####/_nohttp_cookies_db.db-journal
/data/data/####/a04d7737f621e8c0_0
/data/data/####/a06278c140711f50_0
/data/data/####/a257d823eab1f683_0
/data/data/####/a2b9cda528c998a6_0
/data/data/####/a34eeedb77c6c503_0
/data/data/####/a3e333f086a68f7d_0
/data/data/####/a3e333f086a68f7d_s
/data/data/####/a665a39082047616_0
/data/data/####/a71a28a0898af2e3_0
/data/data/####/a8f4e6be67c652c2_0
/data/data/####/a9506103facec4b5_0
/data/data/####/a97ca8407ebed677_0
/data/data/####/a==7.5.0&&3.1.4_1716934090310_envelope.log
/data/data/####/ab07045171714a9e_0
/data/data/####/ac031e04c08829ec_0
/data/data/####/ac86982d4dfb69f9_0
/data/data/####/ad052bbfdc0f624a_0
/data/data/####/ada2214fa69d1fbc_0
/data/data/####/ae3b31795a8888f6_0
/data/data/####/b0bfc87c61a287b6_0
/data/data/####/b1ac6e8818119cdbf8209620ab7b6883adb1e22a50493fc...3e19.0
/data/data/####/b3f0e39245934526_0
/data/data/####/b4212bfd8c7c3d53_0
/data/data/####/b4bc473297c2f6c8_0
/data/data/####/b50889bae8479e43_0
/data/data/####/b6bbd168a101f4e6_0
/data/data/####/b6bbd168a101f4e6_1
/data/data/####/b6df387118083278_0
/data/data/####/b79a96f776038cb9_0
/data/data/####/ba2835d4b8476310_0
/data/data/####/ba2835d4b8476310_1
/data/data/####/bbf10300fe5d82e5_0
/data/data/####/bc221609222a688f50623d88dd18c5b5ac4ee49ea6e15dd...f357.0
/data/data/####/bd74e6235cba290e_0
/data/data/####/beaf922171b57039659aa96a3ac8ef78b0368aa18ea0b02...dc59.0
/data/data/####/bf02ef70c338157c_0
/data/data/####/bugly_db_-journal
/data/data/####/c09595eb0cb392eb_0
/data/data/####/c346376016598aeb_0
/data/data/####/c3803ab46ee9530d_0
/data/data/####/c3803ab46ee9530d_s
/data/data/####/c4ccdc6642e50e22_0
/data/data/####/c521ae00c9b44d97_0
/data/data/####/c6b7da70ff724d2f_0
/data/data/####/c6f577e737722c0bdec2fd17af0a9147814f76e0a6376dd...b44e.0
/data/data/####/c73d9b9ab20aabd0_0
/data/data/####/c855d4779f7d7d68_0
/data/data/####/c909aabc426ed066_0
/data/data/####/cbaa391b9fd532d7_0
/data/data/####/cbf60f22f88c1ea9_0
/data/data/####/cc6dcc2f93bd91a2_0
/data/data/####/cc8eb89d9f30b467_0
/data/data/####/cd5b62b7fbf9d8d0_0
/data/data/####/cd5b62b7fbf9d8d0_1
/data/data/####/cd64206658f60101_0
/data/data/####/classes.dex
/data/data/####/classes.oat
/data/data/####/classes2.dex
/data/data/####/classes3.dex
/data/data/####/classes4.dex
/data/data/####/com.guixue.m.BETA_VALUES.xml
/data/data/####/com.guixue.m.BETA_VALUES.xml.bak
/data/data/####/com.guixue.m.ielts.xml
/data/data/####/com.guixue.m_preferences.xml
/data/data/####/com.iflytek.id.xml
/data/data/####/com.iflytek.msc.xml
/data/data/####/corpusdata-db-journal
/data/data/####/course.db-journal
/data/data/####/crashrecord.xml
/data/data/####/d06e16fd0fd5cbaf_0
/data/data/####/d1b77e68dd8780c3_0
/data/data/####/d27dc8d21025d5f7_0
/data/data/####/d27dc8d21025d5f7_1
/data/data/####/d2a6db290453051e_0
/data/data/####/d7de5cb339083343877a9cf6d579faa07d7b7afe0550566...997a.0
/data/data/####/d7e22cc001cbb9550f8375343aec5d062a692ca9a172d6d...ffc0.0
/data/data/####/d9234e74141d388a_0
/data/data/####/d9251899446d5ece_0
/data/data/####/dW1weF9pbnRlcm5hbF8xNzE2OTM0MDg1MTEy;
/data/data/####/dW1weF9pbnRlcm5hbF8xNzE2OTM0MDgxNDk0;
/data/data/####/de33a74b9bcd60c8_0
/data/data/####/dffbd8be5c44b581_0
/data/data/####/e05f97bc36f29311_0
/data/data/####/e34fdb6a3fbec9ad_0
/data/data/####/e46ddc84b8b10073_0
/data/data/####/e5d5bca3fad65be7_0
/data/data/####/e5dc3d01c6807c57_0
/data/data/####/e6a22808cb2c6845_0
/data/data/####/e879256a01808921_0
/data/data/####/e94834ee8abe3497_0
/data/data/####/e9ac43290663dac1_0
/data/data/####/eac955872fbe9241c16272c7a25e003c9691ca055b480c0...052d.0
/data/data/####/eb9d3b10259abd02af73def4fb59e08d88beafeb8ccaea1...77e7.0
/data/data/####/ed34f8e0e436a5496c82fdbbfa94bca562e8bb2afa9fee6...df25.0
/data/data/####/edcd0c6cf9a2e4c9_0
/data/data/####/ee2afccf9577f8b2_0
/data/data/####/ee41306bf67e705c_0
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f03a1f1ba1522904_0
/data/data/####/f38237f3fb92094fec36d8ee2d35931a82eb708d22348a1...71aa.0
/data/data/####/f3eb37256c9bee79_0
/data/data/####/f3ef1235dc393e35_0
/data/data/####/f42ae37c7e37f50d69d458952388afcc9e4f2bf89ded49a....0.tmp
/data/data/####/f42ae37c7e37f50d69d458952388afcc9e4f2bf89ded49a...a620.0
/data/data/####/f5af737c4d8147cd5f6172d6208c55157408f42dfa0ff03...89e3.0
/data/data/####/f7152d386ff78e35_0
/data/data/####/fef13a9c43c013d9_0
/data/data/####/ff954c3365e05d1e_0
/data/data/####/https_a.guixue.com_0.localstorage-journal
/data/data/####/i==1.2.0&&3.1.4_1716934081415_envelope.log
/data/data/####/ifly_launch_lib.xml
/data/data/####/ifly_launch_lib.xml.bak
/data/data/####/iflytek_state_com.guixue.m.xml
/data/data/####/index
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/journal
/data/data/####/kf_9006_ISME9754_guest3983662388064521299888295...ournal
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/metrics_guid
/data/data/####/mock.db-journal
/data/data/####/native_record_lock
/data/data/####/ondemand.db-journal
/data/data/####/proc_auxv
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/sp.gensee.xml
/data/data/####/tdid.xml
/data/data/####/the-real-index
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/um_pri.xml
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/xnsdkconfig.xml
/data/data/####/xnsdkconfig.xml.bak
/data/data/####/xpush.xml
/data/media/####/-798317169
/data/media/####/.nomedia
/data/media/####/.tcookieid
/data/media/####/1.app.log
/data/media/####/1467456980
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/app-20240529010809536.log
/data/media/####/app.db
/data/media/####/com.guixue.m.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/iflyworkdir_test (deleted)
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/sh -c getprop
/system/bin/sh -c type su
chmod 755 <Package Folder>/.jiagu/libjiagu.so
getprop
ls /
ls /sys/class/thermal

Loads the following dynamic libraries:

libAVCDecoder
libBugly
libH264Android
libSoundTouch
libgensee-log
libgsolcomp-jni
libjiagu
libmsc
libspeex
libstlport_shared
libucamf
libucbase
libucdflvreader
libucflv
libucnet
libucoffplayer
libucrtmpcli
libucrtp
libuctinyxml
libucts
libunidecoder

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-GCM-NoPadding
DES
DES-CBC-PKCS5Padding
RSA-ECB-PKCS1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-GCM-NoPadding
DES
DES-CBC-PKCS5Padding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Requests the system alert window permission.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial