Adware.Gexin.19176

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) sdk-ope####.g####.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
TCP(HTTP/1.1) amdc####.m.ta####.com:80
TCP(HTTP/1.1) sdk.o####.p####.####.com:80
TCP(TLS/1.0) 2####.107.1.97:443
TCP(TLS/1.0) qfy.innot####.com:443
TCP(TLS/1.0) dualsta####.wagbr####.ali####.####.com:443
TCP(TLS/1.0) is.sn####.com:443
TCP(TLS/1.0) c####.v####.com:443
TCP(TLS/1.2) inte####.faceu####.com:6443
TCP sdk.o####.t####.####.com:5224
TCP cm-1####.ig####.com:5225
UDP 1####.168.103.1:137
TCP zb-cent####.m.ta####.com:80

DNS requests:

7j####.c####.z0.####.com
a####.man.aliy####.com
ag####.m.ta####.com
amdc####.m.ta####.com
and####.b####.qq.com
c####.v####.com
c-h####.g####.com
cdn-sdk####.g####.com
cm-1####.ig####.com
inte####.faceu####.com
is.sn####.com
l####.tbs.qq.com
mo####.b####.com
plb####.u####.com
push-re####.qudu####.cn
qfy.innot####.com
sdk-ope####.g####.com
sdk.c####.ig####.com
sdk.o####.p####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
umengj####.m.ta####.com

HTTP GET requests:

cdn-sdk####.g####.com.####.com/tdata_DNL558
cdn-sdk####.g####.com.####.com/tdata_EDB102
cdn-sdk####.g####.com.####.com/tdata_FYI388
q####.c####.l####.####.com/config/hz-hzv6.conf
q####.c####.l####.####.com/tdata_FhD658
sdk.o####.p####.####.com/api/addr.htm

HTTP POST requests:

amdc####.m.ta####.com/amdc/mobileDispatch?appkey=####&deviceId=####&plat...
and####.b####.qq.com/rqd/async?aid=####
c-h####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####
sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
sdk.o####.p####.####.com/api.php?format=####&t=####
sdk.o####.p####.####.com/api.php?format=####&t=####&d=####&k=####

File system changes:

Creates the following files:

/data/anr/traces.txt
/data/data/####/.jg.ic
/data/data/####/1004
/data/data/####/75a1b8533aa9
/data/data/####/ACCS_SDK.xml
/data/data/####/ACCS_SDK_CHANNEL.xml
/data/data/####/ACCS_SDK_CHANNEL.xml.bak
/data/data/####/Agoo_AppStore.xml
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/DaemonServer
/data/data/####/MessageStore.db
/data/data/####/MessageStore.db-journal
/data/data/####/MsgLogStore.db
/data/data/####/MsgLogStore.db-journal
/data/data/####/MultiDex.lock
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/T-dnTDaxoRLCKfp_0Jb4iEIjme4gvKUD
/data/data/####/T-qx9WquSjg1GWWfqbiViExvuU9UZOLr
/data/data/####/T2BEG2k9OBWHf54TEZiSuU-3X64e5Tk0
/data/data/####/T3LlT5MvAo1UX3ciuqCv9kR_pGeX_hO7
/data/data/####/T3UdXUPund17o03qzYkon0p-N647iPtG
/data/data/####/T62VAKnvx0VzDFBY_KKg5E2PBXcj7-aG
/data/data/####/T6W9MIATddveXEWElLjqXUhNz_kOfMzy
/data/data/####/T98nVIlzOXWCoCzX95CtPkKZ45tRUr31
/data/data/####/T9Q880wHsDb1lCeNzKsJuUAYxDbcY-qa
/data/data/####/T9st6wMA-0NHWeQa0pDrMkRwMn5afrcm
/data/data/####/T_CGbbBDiBKF_R6Y4rFbnU7DblCiOhbq
/data/data/####/Tw2eZ6QYOxvRPNl_Y5CQLE9ZMu85z2-A
/data/data/####/TwF_Ts7sE02j7Jkl16AH-0_-Il8T87J_
/data/data/####/TwRpthxMGTdkhAzPna3YN0fMmSrlNd4e
/data/data/####/TwgmyhDhVzEmE1-2RJuM5k4NjI98rnpD
/data/data/####/TxWfZEG7TjtbnS1q-o73A0CajhVfvNqH
/data/data/####/TyS5xrf0RKXmEg4YcLLrZ0Q9lHUM5uIp
/data/data/####/TyzFvbJWdu5SHlH9l48QDEI6e38v92fC
/data/data/####/Tz7k94OWjdegQVjDK6VzUkqm9SqIUl1T
/data/data/####/TzEHDzq8OsRgGt6N-L_RdUUgj2LTFNna
/data/data/####/TzosmFQYyOy1-q0qfacL30IF8DlIpYrS
/data/data/####/accs.db
/data/data/####/accs.db-journal
/data/data/####/agoo.pid
/data/data/####/bugly_db_
/data/data/####/bugly_db_-journal
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/com.xike.yipai.xml
/data/data/####/com.xike.yipai_preferences.xml
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/dW1weF9pbnRlcm5hbF8xNTc2ODc1MjU5MjQ3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTc2ODc1MjUyMjc3;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTc2ODc1MjY3OTM5;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTc2ODc1Mjc0MDEx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTc2ODc1MjcxNTEx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTc2ODc1Mjg3ODMz;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTc2ODc1Mjk5MTEx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTc2ODc1MzA1NjQx;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTc2ODc1MzAzNzkw;
/data/data/####/dW1weF9pbnRlcm5hbF8xNTc2ODc1MzIxODcz;
/data/data/####/download_upload
/data/data/####/downloader.db-journal
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/gdaemon_20161017
/data/data/####/getui_sp.xml
/data/data/####/gx_sp.xml
/data/data/####/httpdns_config_cache.xml
/data/data/####/i==1.2.0&&3.0.8.0_1576875252511_envelope.log
/data/data/####/info.xml
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/jni_log_1576875275581.txt
/data/data/####/libjiagu805543184.so
/data/data/####/local_crash_lock
/data/data/####/message_accs_db
/data/data/####/message_accs_db-journal
/data/data/####/multidex.version.xml
/data/data/####/native_record_lock
/data/data/####/push.pid
/data/data/####/pushext.db-journal
/data/data/####/pushg.db-journal
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/security_info
/data/data/####/sys_log_1576875275581.txt
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_config.xml.bak (deleted)
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/tdata_DNL558
/data/data/####/tdata_DNL558.jar
/data/data/####/tdata_FYI388
/data/data/####/tdata_FYI388.jar
/data/data/####/tt_sdk_settings.xml
/data/data/####/ttopenadsdk.xml
/data/data/####/ttopensdk.db-journal
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_common_config.xml
/data/data/####/umeng_common_location.xml
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/umeng_message_state.xml
/data/data/####/v5kf_client.xml
/data/data/####/v5kf_client.xml (deleted)
/data/data/####/v5kf_emoticons.db
/data/data/####/v5kf_emoticons.db-journal
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/webviewCookiesChromium.db-journal (deleted)
/data/data/####/webviewCookiesChromiumPrivate.db-journal
/data/data/####/yp_app.xml
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid
/data/media/####/.0ee8b178d3b70c385d801fa56d458eb6.cuid2
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid
/data/media/####/.2e1b3b35856a9a8b9e7626ee3afd5a3c.cuid2
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid
/data/media/####/.301d574ef42563b03638c8eae19225cb.cuid2
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.cuid
/data/media/####/.31aa1b74de685d3e992b8b20b29277a6.cuid2
/data/media/####/.3da576879001c77b442b9f8ef95c09d6.cuid
/data/media/####/.3da576879001c77b442b9f8ef95c09d6.cuid2
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid
/data/media/####/.3f05ff2ee62166a5f2841b6f5991a729.cuid2
/data/media/####/.411953e3b77ceb84e2e8249e1d92b570.cuid
/data/media/####/.411953e3b77ceb84e2e8249e1d92b570.cuid2
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid
/data/media/####/.43c699cacb221ac1f982fcaeae20d859.cuid2
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid
/data/media/####/.47dcbd834e669233d7eb8a51456ed217.cuid2
/data/media/####/.494a800a9c78e905f4ab6b7d0e68904e.cuid
/data/media/####/.494a800a9c78e905f4ab6b7d0e68904e.cuid2
/data/media/####/.4999fa2ba973bf32fbaaec3713f36b35.cuid
/data/media/####/.4999fa2ba973bf32fbaaec3713f36b35.cuid2
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid
/data/media/####/.51aa6f4a72cb95868533c23b3ed46280.cuid2
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.cuid
/data/media/####/.54b53072540eeeb8f8e9343e71f28176.cuid2
/data/media/####/.595b157df788ac0a270a61af4e82461b.cuid
/data/media/####/.595b157df788ac0a270a61af4e82461b.cuid2
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid
/data/media/####/.6c017cebec8103c6a12acdf6e530cd40.cuid2
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid
/data/media/####/.7f1742e0d9ab7b82443cb870d357e085.cuid2
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid
/data/media/####/.801ab24683a4a8c433c6eb40c48bcd9d.cuid2
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid
/data/media/####/.80662e1f485e79d07ef4973f6b1b9f88.cuid2
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.cuid
/data/media/####/.8290c29bcd88cef122f67d57ccfa328e.cuid2
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid
/data/media/####/.8e8b27e522ed7bde563e85f73458fd7d.cuid2
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid
/data/media/####/.8f51db48bf0ea9f72de7a231ed8af2f0.cuid2
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid
/data/media/####/.9bf72350632fdc8eedb8dc474f164954.cuid2
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid
/data/media/####/.a274f4d4670213a9045ce258c6c56b80.cuid2
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid
/data/media/####/.b11ddc7e1671c0bd22dc89dd757508d4.cuid2
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.cuid
/data/media/####/.b8d3178fff443ffb41bc400686331bdd.cuid2
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid
/data/media/####/.c3418983f96107fb595049c67426dc08.cuid2
/data/media/####/.c9da02a7b35c2bf0d98f818c0b85e914.cuid
/data/media/####/.c9da02a7b35c2bf0d98f818c0b85e914.cuid2
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.cuid
/data/media/####/.cb4cb2401e6e43cf74a54523b8da5f02.cuid2
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.cuid
/data/media/####/.e0db8f977ad7a2f31aa5a97ab89d0c0e.cuid2
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid
/data/media/####/.e84e30b9390cdb64db6db2c9ab87846d.cuid2
/data/media/####/.e85823b4e7db1064f4301e1c74978199.cuid
/data/media/####/.e85823b4e7db1064f4301e1c74978199.cuid2
/data/media/####/.nomedia
/data/media/####/7b82c2e4569340b89a98b06ab8344218
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/aacout
/data/media/####/ae9c86b179ef4d33beb39020694c684d
/data/media/####/app.db
/data/media/####/axacount
/data/media/####/com.getui.sdk.deviceId.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/com.xike.yipai.bin
/data/media/####/com.xike.yipai.db
/data/media/####/crash-2019-12-20-1576875321279.log
/data/media/####/cusc
/data/media/####/cusc2
/data/media/####/cusys
/data/media/####/cusys2
/data/media/####/systemccu
/data/media/####/systemccu2
/data/media/####/tbslog.txt
/data/media/####/tdata_DNL558
/data/media/####/tdata_FYI388
/data/media/####/test.log
/data/media/####/wcout

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
/system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq
/system/bin/netcfg
/system/bin/sh -c getprop
<Package Folder>/files/DaemonServer -s <Package Folder>/lib/ -n runServer -p startservice -n <Package>/com.taobao.accs.ChannelService --user 0 -f <Package Folder> -t 600 -c agoo.pid -P <Package Folder> -K 1009527 -U tb_accs_eudemon_1.1.3 -L http://agoodm.m.taobao.com/agoo/report -D {"package":"<Package>","appKey":"umeng:58fea91dae1bf80b85001b11","utdid":"Xf008w2jydsDAGdzx1FYIMFc","sdkVersion":"221"} -I agoodm.m.taobao.com -O 80 -T -Z
<Package Folder>/files/gdaemon_20161017 0 <Package>/<Package>.yppushmodule.service.GTCoreService 24384 300 0
cat /sys/class/net/wlan0/address
chmod 700 <Package Folder>/files/gdaemon_20161017
getprop
getprop net.hostname
getprop ro.build.version.emui
getprop ro.product.cpu.abi
getprop ro.serialno
grep 3159
grep 4421
logcat -d -v threadtime
ls -i
ls -l
ls /sys/class/thermal
mount
ps
sh
sh -c cat /sys/block/mmcblk0/device/cid
sh -c cd /proc/sys/kernel/ && stat random
sh -c cd /sys/class/net/wlan0/ && cat address
sh -c cd /sys/class/net/wlan0/ && stat address
sh -c cd /system/bin && ls -i
sh -c cd /system/bin && ls -l
sh -c cd <SD-Card>/ && ls -i
sh <Package Folder>/files/T-dnTDaxoRLCKfp_0Jb4iEIjme4gvKUD
sh <Package Folder>/files/T-qx9WquSjg1GWWfqbiViExvuU9UZOLr
sh <Package Folder>/files/T2BEG2k9OBWHf54TEZiSuU-3X64e5Tk0
sh <Package Folder>/files/T3LlT5MvAo1UX3ciuqCv9kR_pGeX_hO7
sh <Package Folder>/files/T3UdXUPund17o03qzYkon0p-N647iPtG
sh <Package Folder>/files/T62VAKnvx0VzDFBY_KKg5E2PBXcj7-aG
sh <Package Folder>/files/T6W9MIATddveXEWElLjqXUhNz_kOfMzy
sh <Package Folder>/files/T98nVIlzOXWCoCzX95CtPkKZ45tRUr31
sh <Package Folder>/files/T9st6wMA-0NHWeQa0pDrMkRwMn5afrcm
sh <Package Folder>/files/T_CGbbBDiBKF_R6Y4rFbnU7DblCiOhbq
sh <Package Folder>/files/Tw2eZ6QYOxvRPNl_Y5CQLE9ZMu85z2-A
sh <Package Folder>/files/TwF_Ts7sE02j7Jkl16AH-0_-Il8T87J_
sh <Package Folder>/files/TwRpthxMGTdkhAzPna3YN0fMmSrlNd4e
sh <Package Folder>/files/TxWfZEG7TjtbnS1q-o73A0CajhVfvNqH
sh <Package Folder>/files/TyS5xrf0RKXmEg4YcLLrZ0Q9lHUM5uIp
sh <Package Folder>/files/TyzFvbJWdu5SHlH9l48QDEI6e38v92fC
sh <Package Folder>/files/Tz7k94OWjdegQVjDK6VzUkqm9SqIUl1T
sh <Package Folder>/files/TzEHDzq8OsRgGt6N-L_RdUUgj2LTFNna
sh <Package Folder>/files/TzosmFQYyOy1-q0qfacL30IF8DlIpYrS
stat /cache
stat /data
stat /data/app
stat /proc/sys/kernel/random
stat /root
stat random
uname -a

Loads the following dynamic libraries:

Bugly
InnoSecure
InnoSo
getuiext2
libjiagu805543184
nama
tnet-3.1

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-CFB-NoPadding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding
RSA-ECB-NoPadding
RSA-ECB-PKCS1Padding
RSA-NONE-OAEPWithSHA1AndMGF1Padding

Uses the following algorithms to decrypt data:

AES-CBC-PKCS5Padding
AES-ECB-PKCS5Padding
AES-GCM-NoPadding

Accesses the ITelephony private interface.

Uses special library to hide executable bytecode.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Adds tasks to the system scheduler.

Manages Wi-Fi connectivity.

Технології

Терміни

Навчання

Міфи

Technical information

Рекомендации по лечению

Демо бесплатно на 14 дней