Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Gexin.2.origin
Accesses the ITelephony private interface.
Network activity:
Connects to:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) pub-####.qin####.com:80
- TCP(HTTP/1.1) m.baby####.com:80
- TCP(HTTP/1.1) p####.babytre####.com.####.com:80
- TCP(HTTP/1.1) m.me####.com:80
- TCP(HTTP/1.1) oc.u####.com:80
- TCP(HTTP/1.1) gdv.a.s####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) i####.meitu####.com:80
- TCP(HTTP/1.1) sdk.o####.p####.####.com:80
- TCP(HTTP/1.1) 2####.107.1.1:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) 2####.107.1.65:80
- TCP(HTTP/1.1) trac####.me####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) sh.wagbr####.aliyun####.com:80
- TCP(HTTP/1.1) trac####.baby####.com:80
- TCP(HTTP/1.1) api.baby####.com:80
- TCP(TLS/1.0) res####.a####.com:443
- TCP(TLS/1.0) 2####.107.1.97:443
- TCP sdk.o####.t####.####.com:5224
- TCP c####.g####.ig####.com:5227
DNS requests:
- 12.253.159.####.arpa
- 145.206.89.####.arpa
- 176.140.171.####.arpa
- 7j####.c####.z0.####.com
- a####.man.aliy####.com
- a####.u####.com
- amap####.cn-hang####.oss####.####.com
- api.baby####.com
- c####.g####.ig####.com
- c-h####.g####.com
- cu.me####.com
- g.kexi####.com
- i####.meitu####.com
- i####.meitu####.com
- i####.meitu####.com
- i####.meitu####.com
- i####.meitu####.com
- m.me####.com
- oc.u####.com
- p####.babytre####.com
- p####.babytre####.com
- p####.babytre####.com
- pub-####.qin####.com
- pv.s####.com
- res####.a####.com
- sdk.c####.ig####.com
- sdk.o####.p####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- trac####.baby####.com
- trac####.me####.com
HTTP GET requests:
- api.baby####.com/monitor_sdk_intf/hotfix/patch/get?ai=####&app_id=####&a...
- api.baby####.com/monitor_sdk_intf/hotfix/switch/get_status?ai=####&app_i...
- gdv.a.s####.com/cityjson?ie=####
- i####.meitu####.com/group1/M00/06/E6/805891720a1e4e4899ee6256a0639697.jp...
- i####.meitu####.com/group1/M00/11/C6/c6d39bda8f8e497eb77741141b54b9f2.png
- i####.meitu####.com/group1/M00/13/B3/b3568d913dbe4b07a57a1d4f00f5f9ea.png
- i####.meitu####.com/group1/M00/14/6F/d38c5b6fba4143f283a620ead74b9239.jp...
- i####.meitu####.com/group1/M00/1C/82/c20eb3305a1c4ee585e59d4c05c7d82a.jp...
- i####.meitu####.com/group1/M00/21/2D/32cc1921d2de4fdcb40311ef92e42507.jp...
- i####.meitu####.com/group1/M00/2A/1B/e03b308d31bc43d9a499adfa2ab79e4e.png
- i####.meitu####.com/group1/M00/2C/4A/987f8e44b2c34a3085233b9349584f71.jp...
- i####.meitu####.com/group1/M00/4D/D9/780ae50d2d7b4d9d835ba9210f114d22.jpg
- i####.meitu####.com/group1/M00/51/D4/82b65b09be6d46238f451a559b8b866f.jpg
- i####.meitu####.com/group1/M00/52/14/1c6cb76f528b440280b66114cb9dc9ea.jpg
- i####.meitu####.com/group1/M00/5F/4E/e5f85664e7be4cb8827ad37fc016043b.jpg
- i####.meitu####.com/group1/M00/61/A1/bb102ea982c84486954d51a1067a61fd.jpg
- i####.meitu####.com/group1/M00/62/AD/618d62e7ade04040aa504e1039e705d6.jp...
- i####.meitu####.com/group1/M00/72/14/33b6eb78e7254d6794df28147649befb.jp...
- i####.meitu####.com/group1/M00/78/FB/4afeadce786f4cc4b3d7ed08bf9fbe59.jpg
- i####.meitu####.com/group1/M00/7B/B6/924ef0c2d2d94057b670dce9201eef23.jp...
- i####.meitu####.com/group1/M00/82/46/26efb6d3cfbe4b838270c310a8304657.jp...
- i####.meitu####.com/group1/M00/84/24/ec455c15ec22471ea6384909c536edaa.jp...
- i####.meitu####.com/group1/M00/8A/70/970e238a8a71431d8a8ff813e350bd29.png
- i####.meitu####.com/group1/M00/8E/19/0f919d9cf8e34be7877fa2c7a86fff37.jpg
- i####.meitu####.com/group1/M00/92/91/b22021570e9c492d915aa54fe15f292b.jp...
- i####.meitu####.com/group1/M00/9C/54/50694ed8f3a5401b9c17143ae1d09286.jp...
- i####.meitu####.com/group1/M00/9D/2A/2b9d09a72a3c48468d4f6e072bcc8073.pn...
- i####.meitu####.com/group1/M00/9D/BC/7c9d6549bc5047fbb2b23d24a24d5846.png
- i####.meitu####.com/group1/M00/A3/5F/e5b820692e7b42a38a75a423bea315f8.jpg
- i####.meitu####.com/group1/M00/A8/32/917061e31a3c4288a8e5b6325a76668a.png
- i####.meitu####.com/group1/M00/A8/AB/efba8f0019ad4ab5a988dccbc9a38ad7.jp...
- i####.meitu####.com/group1/M00/AC/F5/3f0f48e5954d45e0986f5ac2f06a062f.jp...
- i####.meitu####.com/group1/M00/B5/46/a947f539cdbe46ba95d8a1bb516e2954.jpg
- i####.meitu####.com/group1/M00/BA/63/71743cb69b264afb886863078baba642.jp...
- i####.meitu####.com/group1/M00/BA/63/71743cb69b264afb886863078baba642.jpg
- i####.meitu####.com/group1/M00/C8/74/132b1687f4e7494983c5618b1c8d6d13.png
- i####.meitu####.com/group1/M00/CD/0A/f8d0afea99fb4ee9a49a5f760d3cd840.png
- i####.meitu####.com/group1/M00/D1/A5/41acbd0c839e4bd1aff8a5c24f989c43.png
- i####.meitu####.com/group1/M00/D4/31/f31c9e71419d427c8dfccb061d8694db.jp...
- i####.meitu####.com/group1/M00/D6/9B/5ad6deda534e4c69b74443abe6943704.jpg
- i####.meitu####.com/group1/M00/D8/43/98cc8fae54384573987df8ad82836391.jp...
- i####.meitu####.com/group1/M00/DE/89/617d55d1786d489db9fdeade235897aa.png
- i####.meitu####.com/group1/M00/EA/80/f84ad5c3f28340dea51dbb8074128802.png
- i####.meitu####.com/group1/M00/EC/C0/d1dec98e4c904246a74c05470b7a6f71.png
- i####.meitu####.com/group1/M00/ED/13/3b734fb8113a444f95a6edbb84bec6c2.jpg
- i####.meitu####.com/group1/M00/F3/E8/ce81e040246f4500b5f32f3894d8384e.jpg
- m.baby####.com/conf.do?version=####&releaseDateTime=####
- m.me####.com/mobile/app/upgrade.htm?apptype=####&appversion=####&cityid=...
- m.me####.com/mobile/fightgroup/moregroup.htm?apptype=####&appversion=###...
- m.me####.com/mobile/system/getRequestBaseInfo.htm?apptype=####&appversio...
- m.me####.com/mobile/system/getcurrenttime.htm?apptype=####&appversion=##...
- m.me####.com/newapi/cms/findHomeModuleList?agekeyids=####&ageweek=####&c...
- m.me####.com/newapi/cms/findHomeWordNavigator?cityid=####&protocol=####&...
- m.me####.com/newapi/cms/findModuleInfoList?cityid=####&curpage=####&page...
- m.me####.com/newapi/cms/findTopicHotZone?cityid=####&protocol=####&provi...
- m.me####.com/newapi/cms/findUserAgeData?birthday=####&cityid=####&protoc...
- m.me####.com/newapi/comment/itemComment?cityid=####&mt=####&promotiontyp...
- m.me####.com/newapi/item/getPriceStock?cityid=####&mt=####&promotionid=#...
- m.me####.com/newapi/item/getProdBasicInfo?cityid=####&mt=####&promotioni...
- m.me####.com/newapi/item/itemCollectService?cityid=####&mt=####&promotio...
- m.me####.com/newapi/mobile/common/close_site_notice?cityid=####&protocol...
- m.me####.com/newapi/mobile/common/querySwitch?cityid=####&protocol=####&...
- m.me####.com/newapi/topic/topicdetail/topicDetail?cityid=####&protocol=#...
- m.me####.com/newapi/topic/topicdetail/topicFloorItemList?cityid=####&cur...
- m.me####.com/newapi/topic/topicflow/findTopicListByChannelType?channelty...
- m.me####.com/newapi/tptf/tptfproductService?birthday=####&cityid=####&cu...
- p####.babytre####.com.####.com/baf_hotfix/20181122/FsCEuAA6uVwXQtmaXf1Iw...
- p####.babytre####.com.####.com/foto3/thumbs/2018/0405/97/6/114c3695df138...
- p####.babytre####.com.####.com/foto3/thumbs/2018/1015/15/8/26bc5541a309e...
- p####.babytre####.com.####.com/group1/M00/02/90/wKgyOlVUhIKAdNMVAAAl4M-2...
- p####.babytre####.com.####.com/group1/M00/54/48/f06f2400a88b44998be14548...
- p####.babytre####.com.####.com/group1/M00/5B/6D/5c0f176ddc024865b36590ff...
- p####.babytre####.com.####.com/group1/M00/6E/C2/ef88c704a2c74dc198c246c6...
- p####.babytre####.com.####.com/group1/M00/78/46/8a1eb0ac064546ddb7c78f72...
- p####.babytre####.com.####.com/group1/M00/7C/05/67c639da20564534b13facdb...
- p####.babytre####.com.####.com/group1/M00/87/67/33f67c0ffdb2481b871fde9d...
- p####.babytre####.com.####.com/group1/M00/8E/20/974ae2671bd648e3b3445208...
- p####.babytre####.com.####.com/group1/M00/8F/F1/a300578048044987903d8520...
- p####.babytre####.com.####.com/group1/M00/92/D2/017dd2e925c34321b564d01a...
- p####.babytre####.com.####.com/group1/M00/B2/D6/dd658c44abd14ff5aab2ae09...
- p####.babytre####.com.####.com/group1/M00/CF/06/e33cefc2e987490db7cfc060...
- p####.babytre####.com.####.com/group1/M00/E7/3F/3f71d03b954f491f8f3abe08...
- pub-####.qin####.com/tdata_EDT356
- sh.wagbr####.aliyun####.com/sdkcoor/android/x86/libJni_wgs2gcj.so
- t####.c####.q####.####.com/config/hz-hzv3.conf
- t####.c####.q####.####.com/tdata_Soq141
- t####.c####.q####.####.com/tdata_vxj811
HTTP POST requests:
- a####.u####.com/app_logs
- api.baby####.com/api/adv1/get_config
- c-h####.g####.com/api.php?format=####&t=####
- m.baby####.com/api/api_monitor/getMonitorUrl
- m.baby####.com/api/api_monitor/sendInfo
- m.me####.com/mobile/appbase/newestPatch.htm
- m.me####.com/mobile/community/getAppInitAdvertiseInfo.htm
- m.me####.com/newapi/price/query/byspuandsku
- oc.u####.com/v2/check_config_update
- oc.u####.com/v2/get_update_time
- sdk.o####.p####.####.com/api.php?format=####&t=####
- sh.wagbr####.aliyun####.com/man/api?ak=####&s=####
- trac####.baby####.com/warlock-collector/service/T0002
- trac####.baby####.com/warlock-collector/service/T0003
- trac####.me####.com/service/T0001
File system changes:
Creates the following files:
- /data/data/####/-3157421091129340108
- /data/data/####/-DqOnt7Pk0zg9eWRcalxDlX2IoI.1567791099.tmp
- /data/data/####/.imprint
- /data/data/####/.jg.ic
- /data/data/####/05bjxKUMGm8K3pcaQ2sGl60lBUk.-1668289638.tmp
- /data/data/####/0da1cb11adae
- /data/data/####/1d2b904cbeadfb72ed9546111a231c85.0
- /data/data/####/2089018192263454013
- /data/data/####/26wR-SKC-qfJvAoVppcYb1302WA.1448072939.tmp
- /data/data/####/3HsYRqwzqDSsQNpqGbl4GsX22XQ.1761162965.tmp
- /data/data/####/3wDXf_3FA5hayqSCVxMGS9qtn2A.-525595629.tmp
- /data/data/####/7Kq5NMSOlEez60p8fn25PwxXtJs.924736717.tmp
- /data/data/####/9-JU69R52WtWlGhH02Em-0fhLWA.-281499053.tmp
- /data/data/####/Alvin2.xml
- /data/data/####/BAF-Dns-sp.xml
- /data/data/####/BYYocRrHJ0NcY1ol3TdV7vr-N-s.-512502259.tmp
- /data/data/####/CEAp3ER9i0-ifWpVzlY8L1z9fWc.175028749.tmp
- /data/data/####/Constant.xml
- /data/data/####/ContextData.xml
- /data/data/####/DEV7NjOE0D3d1bf7-DagIxdB5f4.-1646394897.tmp
- /data/data/####/E2O1Y45hyK31vLEzI5GximoDPHQ.-1829256992.tmp
- /data/data/####/FUkE8s4AOW3TDskRay0bPGT10OA.34981132.tmp
- /data/data/####/G34NaVFN4hnrXqu2iJsMEGCQh7Y.970465196.tmp
- /data/data/####/GASu_OxQjIHqXsR_G8u9JW_HDFU.297071266.tmp
- /data/data/####/GkW8NhHiY0lIr7pmofu6caxpDfo.901467763.tmp
- /data/data/####/GvxXXPRYwL0vENYA4RMu8R5R0zY.2094023262.tmp
- /data/data/####/MYeqG2JSkh5wun-zd1ZsFoTb9QM.-1507526097.tmp
- /data/data/####/N8D9ZW63fvEhTY4klqz250InmtM.993728477.tmp
- /data/data/####/N9zbVvJipfDKMWsv9iny-YTxt-g.1098570482.tmp
- /data/data/####/Njjw4xd8QQaj-ub7mY4vRWRy0FE.-1435767915.tmp
- /data/data/####/NxsX4shpqL5yuKvOHX3LyFLNsOk.148677671.tmp
- /data/data/####/PTmCIxGf6WbhghpUuZORcbr6X6k.283083085.tmp
- /data/data/####/ToRPOQ56ovtFgjdRpB9vx63wpkg.-465579873.tmp
- /data/data/####/Tzqp5Ov_4dEVXfheE546orouJvQ.-203697643.tmp
- /data/data/####/UroQOR3IDSHAP6sg2KSurqb0c60.-1933929816.tmp
- /data/data/####/VhUjcZ_F4odUOhxMgkXQVG5XUx0.1408472771.tmp
- /data/data/####/WTU7uTfC6IPgPD29nzWYBYAEfqE.-1640013629.tmp
- /data/data/####/XNSDKStore1.0.xml
- /data/data/####/XNclientid.xml
- /data/data/####/XNmachineid.xml
- /data/data/####/X_9Qn0tdp0C5L6TEpSR7UX02ivE.-1497942520.tmp
- /data/data/####/Yf30Recp1ZmK82FsrCiopFN3fRk.-1382110111.tmp
- /data/data/####/ZDeKmzO84biiVnPssaTuujHygUk.-854818436.tmp
- /data/data/####/ZRYR5B58HcYXVxgHikcC4EQk8Ak.-2069154444.tmp
- /data/data/####/_andfix_.xml
- /data/data/####/aliclound_httpdns.db
- /data/data/####/aliclound_httpdns.db-journal
- /data/data/####/analytic.db-journal
- /data/data/####/b_monitor.db-journal
- /data/data/####/babytree-baf-hotfix-sp.xml
- /data/data/####/babytree-baf-hotfix.db-journal
- /data/data/####/baf-ad-new.xml
- /data/data/####/baf-new-ad.db-journal
- /data/data/####/bb-ad.db-journal
- /data/data/####/bb_adsdk_prefer.xml.xml
- /data/data/####/bb_analytic_prefer.xml.xml
- /data/data/####/bb_monitor_prefer.xml.xml
- /data/data/####/cLEA6yWCynG3jnzY0cSSTjb9mG8.-1505918401.tmp
- /data/data/####/com.meitun.mama_preferences.xml
- /data/data/####/d64xEzjnNFq4UsF-Bx5WuhL-MkA.-1350813826.tmp
- /data/data/####/eylLJu1WOjpfUJ2PoZb1kYVyeFI.268272119.tmp
- /data/data/####/fJoaUzgP978l78d4gy7ucpY46UM.446605680.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gx_sp.xml
- /data/data/####/hYpe_E4I8D_PVRONOOZG2JQhe8U.-1222590857.tmp
- /data/data/####/hmdb
- /data/data/####/hmdb-journal
- /data/data/####/hpz3pqG9pfZdiSuHSzhbJyS3TX8.2027913121.tmp
- /data/data/####/httpdns_config_cache.xml
- /data/data/####/iO_6XOy1fWvX5_5IBlJJuWC4h_Y.-1974765095.tmp
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/jNYT7qPE_HoZKqkz-3IYDQToz6s.-283708270.tmp
- /data/data/####/journal
- /data/data/####/journal.tmp
- /data/data/####/kKqCChz2cjotP6rx28YR9TR0AIs.-1562073546.tmp
- /data/data/####/l8HOm7p4LBA62R9VdpYdSW_wMe0.1981191239.tmp
- /data/data/####/libjiagu-434152877.so
- /data/data/####/lich_udid_prefs_2017_#@#.xml
- /data/data/####/loctemp.so
- /data/data/####/logdb.db
- /data/data/####/logdb.db-journal
- /data/data/####/meitun_statistics.db-journal
- /data/data/####/mobclick_agent_online_setting_com.meitun.mama.xml
- /data/data/####/mt_1000_ISME9754_guest9106724177231215401334384...ournal
- /data/data/####/multidex.version.xml
- /data/data/####/patch-crypto.patch
- /data/data/####/patch.dex
- /data/data/####/patch.patch
- /data/data/####/patch.properties
- /data/data/####/pref.xml
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/rhFWlVDEmABC6TQ485rTs8gg4w0.1364426124.tmp
- /data/data/####/rov7fKbRMtZEAwjyPLUYKvRDB_Y.-937001695.tmp
- /data/data/####/run.pid
- /data/data/####/s0CJuiQBXcEL-GSYQPZw3EaeQfM.-1496239774.tmp
- /data/data/####/sDo3M0v1Bci1Y6NlAEzI8RVsVbk.2027016409.tmp
- /data/data/####/setting.db-journal
- /data/data/####/tdata_Soq141
- /data/data/####/tdata_Soq141.jar
- /data/data/####/tdata_vxj811
- /data/data/####/tdata_vxj811.jar
- /data/data/####/uGzc9GKknMAWJzMcOWk83Ch9YI8.-293321105.tmp
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak (deleted)
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/data/####/xQIp79WI_fCSy0EEnZyumHn9sGg.-659075347.tmp
- /data/data/####/xnsdkconfig.xml
- /data/data/####/y7wYJS_zMwa0FsGjt5gqQSdTGtY.-377790911.tmp
- /data/data/####/yk1E6saXvQYE_bRRfuOGJeGieeY.1339255913.tmp
- /data/media/####/.lich_udid_prefs_2017_#@#
- /data/media/####/.nomedia
- /data/media/####/1543293989915.db
- /data/media/####/1543293992938.db
- /data/media/####/1543293994159.db
- /data/media/####/Alvin2.xml
- /data/media/####/ContextData.xml
- /data/media/####/alsn.db
- /data/media/####/alsn.db-journal
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.meitun.mama.bin
- /data/media/####/com.meitun.mama.db
- /data/media/####/journal.tmp
- /data/media/####/tdata_Soq141
- /data/media/####/tdata_vxj811
- /data/media/####/test.log
Miscellaneous:
Executes the following shell scripts:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.getui.GetuiPushService 24481 300 0
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- getprop net.dns1
- getprop wifi.interface
- mount
- ping -c 10 -W 2 cu.meitun.com
- ping -c 10 -W 2 img01.meituncdn.com
- ping -c 10 -W 2 m.meitun.com
- sh
- sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.push.getui.GetuiPushService 24481 300 0
Loads the following dynamic libraries:
- andfix
- api_encrypt
- bitmaps
- getuiext2
- libjiagu-434152877
- memchunk
Uses the following algorithms to encrypt data:
- AES-CBC-PKCS5Padding
- DESede
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Uses the following algorithms to decrypt data:
- AES-CBC-PKCS5Padding
- AES-ECB-PKCS5Padding
Uses special library to hide executable bytecode.
Gets information about location.
Gets information about network.
Gets information about phone status (number, IMEI, etc.).
Gets information about installed apps.
Adds tasks to the system scheduler.
Displays its own windows over windows of other apps.
