Adware.Gexin.1174

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connecting to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) a####.u####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(HTTP/1.1) sni.c####.q####.####.net:80
TCP(TLS/1.0) sh.wagbr####.alibaba####.com:443
TCP(TLS/1.0) i####.innoc####.com:443
TCP(TLS/1.0) r####.i####.com:443
TCP(TLS/1.0) m.i####.com:443
TCP(TLS/1.0) s.i####.com:443
TCP c####.g####.ig####.com:5225
TCP sdk.o####.t####.####.com:5224

DNS requests:

7j####.c####.z0.####.com
a####.u####.com
and####.b####.qq.com
c####.g####.ig####.com
c-h####.g####.com
i####.innoc####.com
log.u####.com
m.i####.com
mt####.go####.com
r####.i####.com
s####.u####.com
s.i####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net

HTTP GET requests:

sni.c####.q####.####.net/config/hz-hzv3.conf
sni.c####.q####.####.net/tdata_Soq141
sni.c####.q####.####.net/tdata_vxj811

HTTP POST requests:

a####.u####.com/app_logs
and####.b####.qq.com/rqd/async?aid=####
c-h####.g####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####

Modified file system:

Creates the following files:

/data/data/####/-1082882804-1336329501
/data/data/####/-10828828041560290304
/data/data/####/-1270400928-725274060
/data/data/####/-1541919973-660969008
/data/data/####/-21373507-315808725
/data/data/####/-6625786122041171958
/data/data/####/-662578614401398357
/data/data/####/-665080777-383885255
/data/data/####/-665080777588328716
/data/data/####/.imprint
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/1534168619729.log.bak
/data/data/####/1534168623923.log
/data/data/####/7378629161902842436
/data/data/####/7378629162119755883
/data/data/####/790303314269166100
/data/data/####/8573325091254566155
/data/data/####/9348996181989290751
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/QALConfigStore.dat
/data/data/####/TLS_DEVICE_INFO.xml
/data/data/####/WLOGIN_DEVICE_INFO.xml
/data/data/####/app_start_config.xml
/data/data/####/bugly_db_-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.innochina.innocraft_preferences.xml
/data/data/####/crashrecord.xml
/data/data/####/cube_ptr_classic_last_update.xml
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/f_000001
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/index
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libjiagu-695445200.so
/data/data/####/local_crash_lock
/data/data/####/multidex.version.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/qalimid_v2
/data/data/####/report_v5.msgstore-journal
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/tdata_Soq141
/data/data/####/tdata_Soq141.jar
/data/data/####/tdata_vxj811
/data/data/####/tdata_vxj811.jar
/data/data/####/tls_device.dat
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_socialize.xml
/data/data/####/umeng_socialize.xml (deleted)
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/wlogin_device.dat
/data/media/####/.nomedia
/data/media/####/1cm8tkmk70oozya19ys1t28qf0.tmp
/data/media/####/1ovu1xon02devtipew3qv6yvz0.tmp
/data/media/####/2eu8xzlvqagmh9fd2rfye5xl00.tmp
/data/media/####/2mu804q51bpcb4m4i5533sa8c0.tmp
/data/media/####/2rjt13c1rtbnhud4jdp2apmz30.tmp
/data/media/####/2uq9kfvrk1n1en7w5z3natf0z0.tmp
/data/media/####/3lkcdmynd8igmz3e3jljcuulb0.tmp
/data/media/####/3qggayki4cab7y4mqwfnfn6vx0.tmp
/data/media/####/3sdcovn3oyqg0scefuivh0ny00.tmp
/data/media/####/46aro3opdl4o5kvuiyy2d9e4a0.tmp
/data/media/####/4b6euxfxpigew7aj0vxzktexn0.tmp
/data/media/####/4bc71jk06baw2s3280k67gmfb0.tmp
/data/media/####/4k4r49bn9ikwsb9htiw8c3yay0.tmp
/data/media/####/4v5uqptu66lgok0jjb0ormdw40.tmp
/data/media/####/5120s9cj6l4zy2xytq02j4acy0.tmp
/data/media/####/547k9893iz3hi1x8oe64t68os0.tmp
/data/media/####/54bls2xdj3n3uwxcx9ujlvwrm0.tmp
/data/media/####/5czaoiflnbrzqm6k1zsggvkdj0.tmp
/data/media/####/5t7na2xfe3p0ie6qpglycg4ha0.tmp
/data/media/####/6kxhqdrwfwnvcb7rbvztetzj00.tmp
/data/media/####/76o51as1dopx0s7dv9sa0okqc0.tmp
/data/media/####/7k2ysa680laz4jm0atce999440.tmp
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/app.18.08.13.13.log
/data/media/####/app.db
/data/media/####/bdb5gc6kktl6m11fjyxmmcuy0.tmp
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.innochina.innocraft.bin
/data/media/####/com.innochina.innocraft.db
/data/media/####/f8sn7t1jzqqcaishbx5j07vy0.tmp
/data/media/####/g916g7hfx9ptw63khj7hdwz60.tmp
/data/media/####/journal
/data/media/####/journal.tmp
/data/media/####/sdk.18.08.13.13.log
/data/media/####/tdata_Soq141
/data/media/####/tdata_vxj811
/data/media/####/test.log

Miscellaneous:

Executes next shell scripts:

/system/bin/sh -c getprop
/system/bin/sh -c type su
<Package Folder>/files/gdaemon_20161017 0 <Package>/com.linewell.push.getui.GetuiPushService 25326 300 0
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu-695445200.so
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/com.linewell.push.getui.GetuiPushService 25326 300 0

Loads the following dynamic libraries: