Adware.Gexin.18701

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) aexcep####.b####.qq.com:8012
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) safebro####.google####.com:443
TCP(TLS/1.0) and####.google####.com:443
TCP(TLS/1.0) 1####.217.17.42:443
TCP(TLS/1.0) 1####.217.20.110:443
TCP(TLS/1.0) 1####.217.20.74:443
TCP(TLS/1.2) 1####.217.17.42:443

DNS requests:

aexcep####.b####.qq.com
and####.b####.qq.com
and####.google####.com
instant####.google####.com
safebro####.google####.com

HTTP POST requests:

aexcep####.b####.qq.com:8012/rqd/async?aid=####
and####.b####.qq.com/rqd/async?aid=####

File system changes:

Creates the following files:

/data/data/####/.dex2oatlock
/data/data/####/.updateIV.dat
/data/data/####/0000000lllll_0.dex
/data/data/####/0000000lllll_1.dex
/data/data/####/0000000lllll_2.dex
/data/data/####/0000000lllll_3.dex
/data/data/####/000O00ll111l_0.dex
/data/data/####/000O00ll111l_1.dex
/data/data/####/000O00ll111l_2.dex
/data/data/####/000O00ll111l_3.dex
/data/data/####/00O000ll111l_0.dex
/data/data/####/00O000ll111l_0.dex (deleted)
/data/data/####/00O000ll111l_0.dex.flock
/data/data/####/00O000ll111l_0.dex.flock (deleted)
/data/data/####/00O000ll111l_1.dex
/data/data/####/00O000ll111l_1.dex (deleted)
/data/data/####/00O000ll111l_1.dex.flock
/data/data/####/00O000ll111l_1.dex.flock (deleted)
/data/data/####/00O000ll111l_2.dex
/data/data/####/00O000ll111l_2.dex (deleted)
/data/data/####/00O000ll111l_2.dex.flock
/data/data/####/00O000ll111l_2.dex.flock (deleted)
/data/data/####/00O000ll111l_3.dex
/data/data/####/00O000ll111l_3.dex (deleted)
/data/data/####/00O000ll111l_3.dex.flock
/data/data/####/00O000ll111l_3.dex.flock (deleted)
/data/data/####/0OO00l111l1l
/data/data/####/0OO00l111l1l.lock
/data/data/####/1002
/data/data/####/1004
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/UM_PROBE_DATA.xml
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/bugly_db_yaq
/data/data/####/bugly_db_yaq-journal
/data/data/####/com.android.yufuec.BETA_VALUES.xml
/data/data/####/crashrecord.xml
/data/data/####/info.xml
/data/data/####/jni_log_1574736947903.txt
/data/data/####/jni_log_1574736960894.txt
/data/data/####/jni_log_1574736965994.txt
/data/data/####/jni_log_1574736971465.txt
/data/data/####/jni_log_1574736977037.txt
/data/data/####/jni_log_1574736982841.txt
/data/data/####/jni_log_1574736986006.txt
/data/data/####/jni_log_1574736991051.txt
/data/data/####/jni_log_1574736994024.txt
/data/data/####/jni_log_1574736997642.txt
/data/data/####/jni_log_1574737000064.txt
/data/data/####/jni_log_1574737000829.txt
/data/data/####/jni_log_1574737005652.txt
/data/data/####/libshellx-super.2019.so
/data/data/####/local_crash_lock
/data/data/####/local_crash_lock (deleted)
/data/data/####/map_record.txt
/data/data/####/native_record_lock
/data/data/####/native_record_lock (deleted)
/data/data/####/o0oooOO0ooOo.dat
/data/data/####/proc_auxv
/data/data/####/reg_record.txt
/data/data/####/rqd_record.eup
/data/data/####/security_info
/data/data/####/sys_log_1574736947903.txt
/data/data/####/sys_log_1574736960894.txt
/data/data/####/sys_log_1574736965994.txt
/data/data/####/sys_log_1574736971465.txt
/data/data/####/sys_log_1574736977037.txt
/data/data/####/sys_log_1574736982841.txt
/data/data/####/sys_log_1574736986006.txt
/data/data/####/sys_log_1574736991051.txt
/data/data/####/sys_log_1574736994024.txt
/data/data/####/sys_log_1574736997642.txt
/data/data/####/sys_log_1574737000064.txt
/data/data/####/sys_log_1574737000829.txt
/data/data/####/sys_log_1574737005652.txt
/data/data/####/tomb.zip
/data/data/####/tomb_1574736949186.txt
/data/data/####/tomb_1574736952988.txt
/data/data/####/tomb_1574736961840.txt
/data/data/####/tomb_1574736967073.txt
/data/data/####/tomb_1574736972378.txt
/data/data/####/tomb_1574736977962.txt
/data/data/####/tomb_1574736983770.txt
/data/data/####/tomb_1574736987169.txt
/data/data/####/tomb_1574736991865.txt
/data/data/####/tomb_1574736994794.txt
/data/data/####/tomb_1574736998505.txt
/data/data/####/tomb_1574737004107.txt
/data/data/####/tomb_1574737006788.txt
/data/data/####/tosversion
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_general_config.xml

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/dex2oat --dex-file=/data/user/0/<Package>/files/prodexdir/00O000ll111l_0.dex --oat-file=/data/user/0/<Package>/files/prodexdir/odexdir/00O000ll111l_0.dex --compiler-filter=interpret-only
/system/bin/dex2oat --dex-file=/data/user/0/<Package>/files/prodexdir/00O000ll111l_1.dex --oat-file=/data/user/0/<Package>/files/prodexdir/odexdir/00O000ll111l_1.dex --compiler-filter=interpret-only
/system/bin/dex2oat --dex-file=/data/user/0/<Package>/files/prodexdir/00O000ll111l_2.dex --oat-file=/data/user/0/<Package>/files/prodexdir/odexdir/00O000ll111l_2.dex --compiler-filter=interpret-only
/system/bin/dex2oat --dex-file=/data/user/0/<Package>/files/prodexdir/00O000ll111l_3.dex --oat-file=/data/user/0/<Package>/files/prodexdir/odexdir/00O000ll111l_3.dex --compiler-filter=interpret-only
/system/bin/sh -c getprop
getprop
getprop ro.product.cpu.abi
logcat -d -v threadtime
logcat -d -v threadtime -s dalvikvm art zygote zygote64 OpenGLRenderer Bugly-libunwind:S
logcat -t 1000 -v threadtime Bugly-libunwind:S
ls /
ls /sys/class/thermal