Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.DownLoader.657.origin
Gains access to the ITelephony private interface.
Network activity:
Connecting to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) l####.b####.com:80
- TCP(HTTP/1.1) tfs.alipayo####.com:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(HTTP/1.1) l####.sope####.com:80
- TCP(HTTP/1.1) 19.o####.com:80
- TCP(HTTP/1.1) hm.b####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) 39.1####.71.148:80
- TCP(HTTP/1.1) dt.o####.com:80
- TCP(HTTP/1.1) img.xin####.net:80
- TCP(HTTP/1.1) yun-st####.sope####.com:80
- TCP(HTTP/1.1) cdn.img.h####.top:80
- TCP(HTTP/1.1) www.chin####.net:80
- TCP(HTTP/1.1) www.j####.com:80
- TCP(HTTP/1.1) m####.l####.com:80
- TCP(HTTP/1.1) 1####.76.224.67:80
- TCP(HTTP/1.1) loc.map.b####.com:80
- TCP(HTTP/1.1) 47.92.1####.96:80
- TCP(HTTP/1.1) m.o####.com:80
- TCP(HTTP/1.1) d14uy7w####.cloudf####.net:80
- TCP(HTTP/1.1) api.map.b####.com:80
- TCP(HTTP/1.1) cm####.chin####.net.####.com:80
- TCP(HTTP/1.1) st####.an####.org:80
- TCP(HTTP/1.1) www.o####.com:80
- TCP(TLS/1.0) tag.b####.com:443
- TCP(TLS/1.0) z####.l####.top:443
- TCP(TLS/1.0) c3####.xin####.com:443
- TCP(TLS/1.0) img.xin####.com:443
- TCP(TLS/1.0) hm.b####.com:443
DNS requests:
- 19.o####.com
- api.map.b####.com
- api.s####.b####.com
- c3####.xin####.com
- cdn.img.h####.top
- cm####.chin####.net
- d14uy7w####.cloudf####.net
- dt.o####.com
- hm.b####.com
- i####.xin####.net
- img.xin####.com
- img.xin####.net
- l####.b####.com
- l####.sope####.com
- loc.map.b####.com
- m####.l####.com
- m.o####.com
- mt####.go####.com
- p####.zhanz####.b####.com
- r####.xin####.com
- st####.an####.org
- tag.b####.com
- tfs.alipayo####.com
- www.chin####.net
- www.j####.com
- www.o####.com
- yun-st####.sope####.com
- z####.l####.top
HTTP GET requests:
- 19.o####.com/external_system_api/m_master_station_courses_tmp/?&is_free=...
- api.map.b####.com/geocoder/v2/?ak=####&coordtype=####&output=####&locati...
- cdn.img.h####.top/upload/201806/12/img/20180612151346798.png
- cm####.chin####.net.####.com/statics/css/hcgw/favicon.ico?2018061####
- cm####.chin####.net.####.com/statics/css/hcgw/reset_base.css?2018061####
- cm####.chin####.net.####.com/statics/css/hcgw/style.css?2018061####
- cm####.chin####.net.####.com/statics/css/hcgw/style_mobile_iPad.css
- cm####.chin####.net.####.com/statics/images/hcgw/bg_news.png
- cm####.chin####.net.####.com/statics/images/hcgw/eduPic01.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/eduPic02.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/eduPic03.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/eduPic05.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/flogo_hc.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/flogo_xuexi.jpg?2018061...
- cm####.chin####.net.####.com/statics/images/hcgw/flogo_yongdao.png?20180...
- cm####.chin####.net.####.com/statics/images/hcgw/gongfupic.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/logo.png
- cm####.chin####.net.####.com/statics/images/hcgw/navbmline_h.jpg
- cm####.chin####.net.####.com/statics/images/hcgw/navbmline_ng.jpg
- cm####.chin####.net.####.com/statics/images/hcgw/navsearchnew.png
- cm####.chin####.net.####.com/statics/images/hcgw/point.jpg
- cm####.chin####.net.####.com/statics/images/hcgw/sch_bhdx.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_bjjt.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_bjwgy.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_by_h.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_bzxy.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_cq_h.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_cslg.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_cz.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_czdx.png?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_czjd.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_czxxzyjs.png?201806...
- cm####.chin####.net.####.com/statics/images/hcgw/sch_dbsf.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_dc_h.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_dzkj.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_fjgb.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_fzsf.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_hblgdx.jpg?2018061#...
- cm####.chin####.net.####.com/statics/images/hcgw/sch_hgd.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_hl_h.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_hn_h.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_hnsf.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_jd_h.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_jl_h.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_jlsf.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_jsdx.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_jskj.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_ludong.jpg?2018061#...
- cm####.chin####.net.####.com/statics/images/hcgw/sch_ly.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_lz.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_nd_h.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_nj.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_njgy.png?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_njxx.png?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_njykdx.jpg?2018061#...
- cm####.chin####.net.####.com/statics/images/hcgw/sch_qdny_h.jpg?2018061#...
- cm####.chin####.net.####.com/statics/images/hcgw/sch_qfsfdx.jpg?2018061#...
- cm####.chin####.net.####.com/statics/images/hcgw/sch_qingdao.jpg?2018061...
- cm####.chin####.net.####.com/statics/images/hcgw/sch_qlgy.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_rd_h.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_sdjm.png?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_sdkj.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_sdlg.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_sdny.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_sdyy.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_sheg.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_shsf.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_tsxy.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_tsysy_h.jpg?2018061...
- cm####.chin####.net.####.com/statics/images/hcgw/sch_tzzy.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_up.jpg
- cm####.chin####.net.####.com/statics/images/hcgw/sch_whkj.png?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_xbmz.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_xd_h.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_xnjt.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_xnzfdx.jpg?2018061#...
- cm####.chin####.net.####.com/statics/images/hcgw/sch_xsdx.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_zc_h.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_zgdz.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_zghl.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_zgsy.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_zgyy.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_zjhy.png?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_zn.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_zzkj.png?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/sch_zzzf.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/serSystem.png
- cm####.chin####.net.####.com/statics/images/hcgw/slidePic01.jpg?2018061#...
- cm####.chin####.net.####.com/statics/images/hcgw/slidePic02.jpg?2018061#...
- cm####.chin####.net.####.com/statics/images/hcgw/slide_Cur.png
- cm####.chin####.net.####.com/statics/images/hcgw/small-img1.png
- cm####.chin####.net.####.com/statics/images/hcgw/weiboCode.jpg?2018061####
- cm####.chin####.net.####.com/statics/images/hcgw/weixinCode.jpg?2018061#...
- cm####.chin####.net.####.com/statics/js/hcgw/jquery-1.11.0.min.js
- cm####.chin####.net.####.com/statics/js/hcgw/jquery.cookie.js
- cm####.chin####.net.####.com/statics/js/hcgw/public.js?2018061####
- cm####.chin####.net.####.com/statics/js/hcgw/slide.js
- d14uy7w####.cloudf####.net/download/key
- dt.o####.com/dcs4z5cx4100004v6ds8atsl2_4c9q/dcs.gif?WT.branch=####&dcssi...
- dt.o####.com/dcs4z5cx4100004v6ds8atsl2_4c9q/dcs.gif?dcsredirect=####&WT....
- hm.b####.com/h.js?ae0121e####
- hm.b####.com/hm.gif?cc=####&ck=####&cl=####&ds=####&vl=####&et=####&ja=#...
- hm.b####.com/hm.js?1c22a46####
- img.xin####.net/Uploads/3950/Navigation/0/58bd2af42a379.png
- img.xin####.net/Uploads/3950/Navigation/0/59194e426cc30.png
- img.xin####.net/Uploads/3950/Navigation/0/59194e59ca035.png
- img.xin####.net/Uploads/3950/Navigation/0/59194e709b2a5.png
- img.xin####.net/Uploads/3950/Navigation/0/59194e86e3a4a.png
- img.xin####.net/Uploads/3950/Navigation/149_142/58bd325106282.png
- img.xin####.net/Uploads/3950/Navigation/149_142/58bd32674884e.png
- img.xin####.net/Uploads/3950/Navigation/299_142/58bd2ff729f3f.png
- img.xin####.net/Uploads/3950/Navigation/300_283/58bd2fe588e2e.png
- img.xin####.net/Uploads/3950/Navigation/600_80/58bd2b1a74606.png
- img.xin####.net/Uploads/3950/Navigation/75_75/58bd2d5b8ef17.png
- img.xin####.net/Uploads/3950/Navigation/75_75/58bd2d69195e7.png
- img.xin####.net/Uploads/3950/Navigation/75_75/58bd2d7b92b2d.png
- img.xin####.net/Uploads/3950/Navigation/75_75/58bd2d896d3bd.png
- img.xin####.net/Uploads/3950/Navigation/75_75/58bd2efcca6a8.png
- img.xin####.net/Uploads/3950/Navigation/75_75/58bd2f300276a.png
- img.xin####.net/Uploads/3950/Navigation/75_75/58bd2f511cb4a.png
- img.xin####.net/Uploads/3950/Navigation/75_75/58bd2f72eebe8.png
- l####.b####.com/float/_l.js?siteid=####&bdclickid=####&bdcbid=####&refer...
- l####.b####.com/float/log.gif?fType=####&name=####&t=####&uuid=####
- l####.b####.com/lxb.js?sid=####
- l####.sope####.com/20003383/10094063.js
- m####.l####.com/monitor/s?c=a&i=20003383&v=55180ca19060aeef26b2a5fe0d8c5...
- m.o####.com/
- m.o####.com/favicon.ico
- m.o####.com/statics/css/index2017.css?t=####
- m.o####.com/statics/css/swiper.min.css
- m.o####.com/statics/images/images2017/add1_0207.jpg
- m.o####.com/statics/images/images2017/click.gif
- m.o####.com/statics/images/images2017/close_03.png
- m.o####.com/statics/images/images2017/foot_04.png
- m.o####.com/statics/images/images2017/ht0207_bt_left.jpg
- m.o####.com/statics/images/images2017/ht0207_bt_right.jpg
- m.o####.com/statics/images/images2017/index17_ksrl.jpg
- m.o####.com/statics/images/images2017/index17_rili.jpg
- m.o####.com/statics/images/images2017/index17_zpcl.jpg
- m.o####.com/statics/images/images2017/index17_zwcx.jpg
- m.o####.com/statics/images/images2017/ksrl_ksxm.jpg
- m.o####.com/statics/images/images2017/ksrl_span.gif
- m.o####.com/statics/images/images2017/ksrl_time.gif
- m.o####.com/statics/images/images2017/logo.gif
- m.o####.com/statics/images/images2017/m_xtb_03.gif
- m.o####.com/statics/images/images2017/m_xtb_07.gif
- m.o####.com/statics/images/images2017/m_xtb_09.gif
- m.o####.com/statics/images/images2017/m_xtb_11.gif
- m.o####.com/statics/images/images2017/m_xtb_13.gif
- m.o####.com/statics/images/images2017/m_xtb_15.gif
- m.o####.com/statics/images/images2017/m_xtb_17.gif
- m.o####.com/statics/images/images2017/m_xtb_19.gif
- m.o####.com/statics/images/images2017/m_xtb_21.gif
- m.o####.com/statics/images/images2017/new_btn1.jpg
- m.o####.com/statics/images/images2017/new_btn10.jpg
- m.o####.com/statics/images/images2017/new_btn2.jpg
- m.o####.com/statics/images/images2017/new_btn3.jpg
- m.o####.com/statics/images/images2017/new_btn4.jpg
- m.o####.com/statics/images/images2017/new_btn5.jpg
- m.o####.com/statics/images/images2017/new_btn6.jpg
- m.o####.com/statics/images/images2017/new_btn7.jpg
- m.o####.com/statics/images/images2017/new_btn8.jpg
- m.o####.com/statics/images/images2017/new_btn9.jpg
- m.o####.com/statics/images/images2017/off_foot.png
- m.o####.com/statics/images/images2017/span_0207.gif
- m.o####.com/statics/images/images2017/to-bot.png
- m.o####.com/statics/images/images2017/to-top.png
- m.o####.com/statics/images/images2017/zg_dayli.gif
- m.o####.com/statics/images/images2017/zg_li.gif
- m.o####.com/statics/js/jquery.SuperSlide.js
- m.o####.com/statics/js/jquery.min.js
- m.o####.com/statics/js/js2017.js?3####
- m.o####.com/statics/js/phpdaohang.js?t=####
- m.o####.com/statics/js/sdc_offcn_wapcode.js
- m.o####.com/statics/js/swiper.min.js
- m.o####.com/statics/js/zixianqq.js
- s####.jom####.com/push.js
- s####.jom####.com/s.gif?r=####&l=####
- st####.an####.org/static/outer/js/aq_auth.js
- t####.c####.q####.####.com/Uploads/3950/Links/0/58bcbe7f0d11b.jpg?imageV...
- t####.c####.q####.####.com/Uploads/3950/Links/0/58bcbef890a17.jpg?imageV...
- t####.c####.q####.####.com/Uploads/3950/Links/0/58bcbf437de82.jpg?imageV...
- t####.c####.q####.####.com/Uploads/3950/Links/0/58bcbf8e22de6.jpg?imageV...
- t####.c####.q####.####.com/Uploads/3950/Links/0/58bcbfdb967b8.jpg?imageV...
- t####.c####.q####.####.com/Uploads/3950/Links/0/58bcc05abf977.jpg?imageV...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd2af42a379.png
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd2b1a74606.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd2d5b8ef17.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd2d69195e7.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd2d7b92b2d.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd2d896d3bd.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd2efcca6a8.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd2f300276a.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd2f511cb4a.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd2f72eebe8.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd2fe588e2e.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd2ff729f3f.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd325106282.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/58bd32674884e.png?i...
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/59194e426cc30.png
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/59194e59ca035.png
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/59194e709b2a5.png
- t####.c####.q####.####.com/Uploads/3950/Navigation/0/59194e86e3a4a.png
- t####.c####.q####.####.com/Uploads/3950/Product/0/58ba73f2ef92e.jpg?imag...
- t####.c####.q####.####.com/Uploads/3950/Product/0/58ba834de2c73.jpg?imag...
- t####.c####.q####.####.com/Uploads/3950/Product/0/58ba843c328bd.jpg?imag...
- t####.c####.q####.####.com/Uploads/3950/Product/0/58bcdb83c40c5.jpg?imag...
- tfs.alipayo####.com/L1/71/1000/and/koubei/client/koubei_sh2345.apk
- www.chin####.net/
- www.j####.com/
- www.j####.com/app/images/logo.png
- www.j####.com/favicon.ico
- www.j####.com/html/app/
- www.j####.com/images/batb.png
- www.j####.com/images/fxtb1.png
- www.j####.com/images/fxtb3.png
- www.j####.com/images/wx.jpg
- www.j####.com/images/zxzx.png
- www.j####.com/images_sj/2.jpg
- www.j####.com/images_sj/Icon_03.png
- www.j####.com/images_sj/Icon_05.png
- www.j####.com/images_sj/Icon_07.png
- www.j####.com/images_sj/Icon_10.png
- www.j####.com/images_sj/dian.png
- www.j####.com/images_sj/h_buoon.png
- www.j####.com/images_sj/jia.png
- www.j####.com/images_sj/log.png
- www.j####.com/images_sj/tab.png
- www.j####.com/images_sj/top.png
- www.j####.com/index.php?m=####&c=####&specialid=####&pc_hash=####
- www.j####.com/js/jquery-1.7.2.min.js
- www.j####.com/style_sj/css/css.css
- www.j####.com/style_sj/css/goole.css
- www.j####.com/style_sj/js/index.js
- www.j####.com/style_sj/js/jquery-1.7.2.min.js
- www.j####.com/style_sj/js/jquery-finger-v0.1.0.min.js
- www.j####.com/style_sj/js/modernizr-custom-v2.7.1.min.js
- www.j####.com/uploadfile/2017/0302/20170302041519110.jpg
- www.j####.com/uploadfile/2018/0330/20180330013116791.jpg
- www.j####.com/uploadfile/2018/0330/20180330013154827.jpg
- www.j####.com/uploadfile/2018/0404/20180404030316600.jpg
- www.j####.com/uploadfile/2018/0413/20180413023801310.png
- www.j####.com/uploadfile/2018/0413/20180413023923837.png
- www.j####.com/uploadfile/2018/0509/20180509041946414.jpg
- www.j####.com/uploadfile/2018/0511/20180511035918559.jpg
- www.j####.com/uploadfile/2018/0615/20180615095610801.jpg
- www.j####.com/zhuanti/2018/gaokaozhenti/css/css.css
- www.j####.com/zhuanti/2018/gaokaozhenti/images/banner_01.jpg
- www.j####.com/zhuanti/2018/gaokaozhenti/images/top1.png
- www.j####.com/zhuanti/2018/gaokaozhenti/js/index.js?v=####
- www.j####.com/zhuanti/css/animate.min.css
- www.j####.com/zhuanti/css/goole.css
- www.o####.com/
- www.o####.com/caches/js/1049.js
- www.o####.com/caches/js/1050.js
- www.o####.com/caches/js/1051.js
- www.o####.com/caches/js/1052.js
- www.o####.com/caches/js/1053.js
- www.o####.com/caches/js/1054.js
- www.o####.com/caches/js/1055.js
- www.o####.com/caches/js/1056.js
- www.o####.com/caches/js/1057.js
- www.o####.com/caches/js/1058.js
- www.o####.com/caches/js/1139.js
- www.o####.com/caches/js/1140.js
- www.o####.com/caches/js/1141.js
- www.o####.com/caches/js/1142.js
- www.o####.com/caches/js/1143.js
- www.o####.com/caches/js/1144.js
- www.o####.com/caches/js/1145.js
- www.o####.com/caches/js/1146.js
- www.o####.com/caches/js/1147.js
- www.o####.com/caches/js/1148.js
- www.o####.com/caches/js/1149.js
- www.o####.com/caches/js/1150.js
- www.o####.com/caches/js/1151.js
- www.o####.com/caches/js/1152.js
- www.o####.com/caches/js/1153.js
- www.o####.com/caches/js/1154.js
- www.o####.com/caches/js/1155.js
- www.o####.com/caches/js/1156.js
- www.o####.com/caches/js/1157.js
- www.o####.com/caches/js/1158.js
- www.o####.com/caches/js/1159.js
- www.o####.com/caches/js/1160.js
- www.o####.com/caches/js/1161.js
- www.o####.com/caches/js/1162.js
- www.o####.com/caches/js/1163.js
- www.o####.com/caches/js/1165.js
- www.o####.com/caches/js/1166.js
- www.o####.com/caches/js/1167.js
- www.o####.com/caches/js/1168.js
- www.o####.com/caches/js/1169.js
- www.o####.com/caches/js/1170.js
- www.o####.com/caches/js/1171.js
- www.o####.com/caches/js/1172.js
- www.o####.com/caches/js/1173.js
- www.o####.com/caches/js/1174.js
- www.o####.com/caches/js/1175.js
- www.o####.com/caches/js/1176.js
- www.o####.com/caches/js/1177.js
- www.o####.com/caches/js/1178.js
- www.o####.com/caches/js/1179.js
- www.o####.com/caches/js/1181.js
- www.o####.com/caches/js/1182.js
- www.o####.com/caches/js/1185.js
- www.o####.com/caches/js/1186.js
- www.o####.com/caches/js/1187.js
- www.o####.com/caches/js/1189.js
- www.o####.com/caches/js/1190.js
- www.o####.com/caches/js/1191.js
- www.o####.com/caches/js/1192.js
- www.o####.com/caches/js/1194.js
- www.o####.com/caches/js/1195.js
- www.o####.com/caches/js/1225.js
- www.o####.com/caches/js/1226.js
- www.o####.com/caches/js/1298.js
- www.o####.com/caches/js/1299.js
- www.o####.com/caches/js/745.js
- www.o####.com/caches/js/748.js
- www.o####.com/caches/js/916.js
- www.o####.com/dl/2017/0824/20170824091531121.jpg
- www.o####.com/dl/2017/0824/20170824091913169.jpg
- www.o####.com/dl/2017/0918/20170918113545593.jpg
- www.o####.com/dl/2017/1211/20171211023818956.jpg
- www.o####.com/dl/2017/1225/20171225022406819.jpg
- www.o####.com/dl/2018/0109/20180109091933740.jpg
- www.o####.com/dl/2018/0208/20180208113054291.jpg
- www.o####.com/dl/2018/0320/20180320041202105.jpg
- www.o####.com/dl/2018/0329/20180329113835413.jpg
- www.o####.com/dl/2018/0411/20180411120128695.png
- www.o####.com/dl/2018/0427/20180427045250303.jpg
- www.o####.com/dl/2018/0427/20180427045618556.png
- www.o####.com/dl/2018/0427/20180427051157288.png
- www.o####.com/dl/2018/0511/20180511073540106.jpg
- www.o####.com/dl/2018/0529/20180529120002247.jpg
- www.o####.com/dl/2018/0529/20180529120134364.jpg
- www.o####.com/dl/2018/0530/20180530015327463.jpg
- www.o####.com/dl/2018/0530/20180530115719899.jpg
- www.o####.com/dl/2018/0604/20180604095213985.jpg
- www.o####.com/dl/2018/0612/20180612110339261.png
- www.o####.com/dl/2018/0613/20180613060230104.jpg
- www.o####.com/dl/2018/0613/20180613093540208.jpg
- www.o####.com/dl/2018/0614/20180614094210757.jpg
- www.o####.com/statics/css/index2015.css
- www.o####.com/statics/css/index_news.css?t=####
- www.o####.com/statics/css/topNewStyle.css?t=####
- www.o####.com/statics/js/19kecheng.js
- www.o####.com/statics/js/base.js?d####
- www.o####.com/statics/js/bdbot.js
- www.o####.com/statics/js/bdtop.js
- www.o####.com/statics/js/gksearch.js
- www.o####.com/statics/js/gzbot.js
- www.o####.com/statics/js/index2015.js?3####
- www.o####.com/statics/js/index_cygj.js
- www.o####.com/statics/js/index_java.js?1####
- www.o####.com/statics/js/jquery.SuperSlide.2.1.1.js
- www.o####.com/statics/js/jquery.jscrollpane.min.js
- www.o####.com/statics/js/jquery.min.js
- www.o####.com/statics/js/jquery.mousewheel.js
- www.o####.com/statics/js/sdc_offcn_wap.js
- www.o####.com/statics/webappservice/uaredirect.js?e####
- yun-st####.sope####.com/131221/oms.css?17####
- yun-st####.sope####.com/131221/oms.js?18####
HTTP POST requests:
- loc.map.b####.com/offline_loc
- loc.map.b####.com/sdk.php
Modified file system:
Creates the following files:
- /data/data/####/-fLEacg6xdA1cW7pT1WDDhZKfTI.1511391269.tmp
- /data/data/####/-uKbfd3Uih8A7Z4_91otN3hqZiw.-517424011.tmp
- /data/data/####/.jg.ic
- /data/data/####/0P_0U008h6H5tzM01v9DSxquSbU.2093384209.tmp
- /data/data/####/30f28fd9-2165-4d24-b380-f443beb448e6
- /data/data/####/4au5pOjG73_twJMXEMVyHXfb-lU.277043538.tmp
- /data/data/####/4nNqjbMp3yvPB0SzXsHjlf7LahY.2001898024.tmp
- /data/data/####/5.jar
- /data/data/####/5JoY6__TiFwzR7w5mRs6n0-FE-Q.-1416908528.tmp
- /data/data/####/5KwKOUw3GFo_aeJvX5HJkuz4uWE.-1703280000.tmp
- /data/data/####/6.xml
- /data/data/####/6AIZlwcu9frJxDTa-AWAFWRZcD8.1905392571.tmp
- /data/data/####/6gJ_fnI4IK4vRbHbwQOZG3zHzEE.1242672429.tmp
- /data/data/####/893-STDFgkznUcXAL9RkAPUOdk4.-788558139.tmp
- /data/data/####/8f4dt0vitTXqq3MSrG9tHXuTGVI.-1894430925.tmp
- /data/data/####/8fMaX89QzvyVBvgQUfW4QUkAZQE.704409341.tmp
- /data/data/####/CTqWOg3CWd5KjkW5tlAFOuO_jK0.1034558768.tmp
- /data/data/####/DBudiDK4666NijJ1hX5bd_Ji1KE.1761271304.tmp
- /data/data/####/EGKPS0z8MGlqGypBlhL4oYi-qXA.-532486434.tmp
- /data/data/####/GfBWNLM84a2FPj5oXcP0XS6qvPg.1584256184.tmp
- /data/data/####/GstO-g5Opn6srtMmYMlH1YoshhI.570954966.tmp
- /data/data/####/I4KbyOwl68IYw3fs0c6HR61v_gs.-189390636.tmp
- /data/data/####/Jp9QlRDXED_GrRjOzQB-Nt1r668.2143742490.tmp
- /data/data/####/L7Mh-blrGP94QNihdcpNha_XjBk.1851176448.tmp
- /data/data/####/N7NLtFHSsQ45ZWRvOshcJBDg-lA.863693334.tmp
- /data/data/####/NrxgvPPg5Jac88FLweiOByWrMew.-1829702397.tmp
- /data/data/####/QhKHxyNBtIUdSRgAiXE_8FdSyjc.2050238522.tmp
- /data/data/####/SUBOXLOG_
- /data/data/####/T97BrZXWXqUqrTYG6y61kxeAI40.-1276359787.tmp
- /data/data/####/TWP8S2OA9PCtYmGnd9lmD8iC6lk.582865391.tmp
- /data/data/####/Y5Ji9s3KvcI7vyCrWb2PHjdeP6Y.1318447860.tmp
- /data/data/####/Yz40gTfKrWV3YA7MsXpVZO76YSM.2048159495.tmp
- /data/data/####/Z8ypMEFDzV3BusX-jtcPDZz54U0.1222225434.tmp
- /data/data/####/ZorQRa-KnGczv88jaaq8nCFiAxE.-59321009.tmp
- /data/data/####/_lL3WiBhRCkPviQqPbMsjWDwFSA.-1213374235.tmp
- /data/data/####/cVr7ulLtnpvUeX6srzAQWkSvSF8.-1844726028.tmp
- /data/data/####/com.gfdgdg.rgegrere.push_sync.xml
- /data/data/####/com.gfdgdg.rgegrere.xml
- /data/data/####/dfcb8d09-88cd-4b74-b146-334c3ad782b4.jar
- /data/data/####/dso_deps
- /data/data/####/dso_lock
- /data/data/####/dso_manifest
- /data/data/####/dso_state
- /data/data/####/firll.dat
- /data/data/####/frcL-_MlUCzu82vC4z1rQLoIed0.919053380.tmp
- /data/data/####/g0EDkLUVrgOTE1tyG6MhNkx36TM.-201296944.tmp
- /data/data/####/j9ut6mIufADrulC0FdL-JH8j8-M.1524906029.tmp
- /data/data/####/k2K7lOzH_-O4GDIlBt0MRWkiUpI.1322493163.tmp
- /data/data/####/kHJ-dPrxTfRlfXKxIlbNByncCdI.-120632984.tmp
- /data/data/####/kr.xml
- /data/data/####/libjiagu.so
- /data/data/####/ofl.config
- /data/data/####/ofl_location.db
- /data/data/####/ofl_location.db-journal
- /data/data/####/ofl_statistics.db
- /data/data/####/ofl_statistics.db-journal
- /data/data/####/plugin-deploy.jar
- /data/data/####/plugin-deploy.key
- /data/data/####/ppFE1NO3ufJWVQs656elR4qCcaU.711303189.tmp
- /data/data/####/pst.xml
- /data/data/####/t_u.db-journal
- /data/data/####/update.xml
- /data/data/####/vQGQ_LhrSrkGxxdy7oYvf0o_SN4.-265429722.tmp
- /data/data/####/vbz.xml
- /data/data/####/wSP5HH_dvky8iDa18lmTS1s9M7U.-81364365.tmp
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/webviewCookiesChromiumPrivate.db-journal
- /data/data/####/zme6q5YRq5jYkmHSJ7igtzQtnz8.1892528837.tmp
- /data/media/####/.cuid
- /data/media/####/.nomedia
- /data/media/####/4403f413879c3
- /data/media/####/b.tmp
- /data/media/####/c94a9a3f22727db2083a691f27600f20.apk
- /data/media/####/conlts.dat
- /data/media/####/ller.dat
- /data/media/####/ls.db
- /data/media/####/ls.db-journal
- /data/media/####/test.0
- /data/media/####/yalioaData.db
- /data/media/####/yalioaData.db-journal
- /data/media/####/yoh.dat
- /data/media/####/yol.dat
- /data/media/####/yom.dat
Miscellaneous:
Executes next shell scripts:
- chmod 755 <Package Folder>/.jiagu/libjiagu.so
- chmod 777 /storage/emulated/0/Android/data/<Package>/files/Download/Android/azb/c94a9a3f22727db2083a691f27600f20.apk
Loads the following dynamic libraries:
- libfb
- libimagepipeline
- libjiagu
- libreactnativejni
- libreactnativejnifb
- locSDK6a
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
Uses the following algorithms to decrypt data:
- RSA-ECB-PKCS1Padding
Uses special library to hide executable bytecode.
Gains access to geolocation.
Gains access to network information.
Gains access to telephone information (number, imei, etc.).
Gains access to information about running applications.
Displays its own windows over windows of other applications.
