Adware.Gexin.13958

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) qin####.com.www.####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) t####.c####.q####.####.com:80
TCP(HTTP/1.1) so####.51####.com:805
TCP(HTTP/1.1) so####.51####.com:802
TCP(TLS/1.0) hotfix####.aliy####.com:443
TCP sdk.o####.t####.####.com:5224
TCP c####.g####.ig####.com:5225

DNS requests:

7j####.c####.z0.####.com
a####.man.aliy####.com
c####.g####.ig####.com
c-h####.g####.com
hotfix####.aliy####.com
hotp####.wan####.ta####.com
pub-####.qin####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
so####.51####.com

HTTP GET requests:

qin####.com.www.####.com/tdata_EDT369
so####.51####.com:802/api/home/gethome
so####.51####.com:805/15160035159124/469b7a55e07f4ac194edb4ad190815f5.jpg
so####.51####.com:805/15166078116037/868c816e7ef14ed4b8ab5bfe5d362793.jpg
so####.51####.com:805/15166078721428/996f016cd94b4e50ab319c5c537543cf.jpg
so####.51####.com:805/15166079075788/b68d891f519849739e0476ad3bf48068.jpg
so####.51####.com:805/15166098722136/0f913e6307d14e1ab5dec07f6065d756.jpg
so####.51####.com:805/15166099995610/1ffe863502454430a194cf2eb9fbc63d.jpg
so####.51####.com:805/15166100241841/744827d658084511b5097989c4be9116.jpg
so####.51####.com:805/15167737881259/ae95dd7d94ed413a8fe043dcf4ab2bf7.jpg
so####.51####.com:805/15167739646214/972f62adf14e4cb091b63b01fbc70f9a.jpg
so####.51####.com:805/15203069823061/c7a164220fb54951868f906c37fb83d6.jpg
t####.c####.q####.####.com/config/hz-hzv6.conf
t####.c####.q####.####.com/tdata_Soq141
t####.c####.q####.####.com/tdata_fEV688
t####.c####.q####.####.com/tdata_ilz707
t####.c####.q####.####.com/tdata_zbA366

HTTP POST requests:

c-h####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
so####.51####.com:802/api/baiduyunApi/getbdtabid

File system changes:

Creates the following files:

/data/data/####/.jg.ic
/data/data/####/05-19_01_51_net.crelove.itro_2313
/data/data/####/05-19_01_51_net.crelove.itro_TcmsService_2340
/data/data/####/05-19_01_51_net.crelove.itro_pushservice_2380
/data/data/####/0ccac5fbc37293cd1c5166cddc6af5398ba40e9eee9f5e7....0.tmp
/data/data/####/2a9b48e6436081c51d70b67df1f152015b18cf24caa4ae4....0.tmp
/data/data/####/3184571181f1
/data/data/####/40212682be973e13961195eace6840e0ebce23a3b98be18....0.tmp
/data/data/####/63d50a6262856ae9b14c8e89b55c869b4bf318d12518752....0.tmp
/data/data/####/83826f05881466207780429327962049999efb6a3d42fa5....0.tmp
/data/data/####/86f47147d9e90a6cc603f09bddce842ede74ed2482cf7cc....0.tmp
/data/data/####/89eaea5273df20956559157bae4aae330819f07a385b69a....0.tmp
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/a99b95941a104087ec3605cd71524809bdc37aa74ad0650....0.tmp
/data/data/####/dc9baef99216f67e58895b139de3490431610a22ae88590....0.tmp
/data/data/####/dd4f1666859e7e3ab67a1397a77eb0bc7394bb14ac482cb....0.tmp
/data/data/####/disk_entries_list_image_cache_-1997294448.xml
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gkt-journal
/data/data/####/gx_sp.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/journal.tmp
/data/data/####/libjiagu171513187.so
/data/data/####/multidex.version.xml
/data/data/####/net.crelove.itro_preferences.xml
/data/data/####/notification_config.xml
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushk.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/sp_sophix.xml
/data/data/####/tcms_istied.xml
/data/data/####/tdata_Soq141
/data/data/####/tdata_Soq141.jar
/data/data/####/tdata_fEV688
/data/data/####/tdata_fEV688.jar
/data/data/####/tdata_ilz707
/data/data/####/tdata_ilz707.jar
/data/data/####/tdata_zbA366
/data/data/####/tdata_zbA366.jar
/data/data/####/user.xml
/data/data/####/userInfo.xml
/data/media/####/.nomedia
/data/media/####/2_20190519_r
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/app.db
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/gkt-journal
/data/media/####/gktper
/data/media/####/net.crelove.itro.bin
/data/media/####/net.crelove.itro.db
/data/media/####/tdata_Soq141
/data/media/####/tdata_fEV688
/data/media/####/tdata_ilz707
/data/media/####/tdata_zbA366
/data/media/####/test.log

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.ITROGeTuiPushService 24617 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
chmod 755 <Package Folder>/.jiagu/libjiagu171513187.so
getprop ro.product.cpu.abi
mount
sh
sh <Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.ITROGeTuiPushService 24617 300 0

Loads the following dynamic libraries: