Adware.Gexin.20337

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) l####.tbs.qq.com:80
TCP(HTTP/1.1) and####.b####.qq.com:80
TCP(HTTP/1.1) 1####.29.29.29:80
TCP(TLS/1.0) api.map.b####.com:443
TCP(TLS/1.0) 1####.217.168.234:443
TCP(TLS/1.0) 1####.6.173.42:443
TCP(TLS/1.0) 1####.15.61.197:443
TCP(TLS/1.0) 1####.217.20.106:443
TCP(TLS/1.0) instant####.google####.com:443
TCP(TLS/1.0) md####.google####.com:443
TCP(TLS/1.0) 1####.15.61.202:443
TCP(TLS/1.0) p####.google####.com:443
TCP(TLS/1.2) 1####.217.20.106:443
TCP(TLS/1.2) 2####.58.214.3:443
TCP(TLS/1.2) 1####.217.17.78:443

DNS requests:

and####.b####.qq.com
api.map.b####.com
instant####.google####.com
l####.tbs.qq.com
md####.google####.com
p####.google####.com

HTTP POST requests:

and####.b####.qq.com/rqd/async?aid=####
l####.tbs.qq.com/ajax?c=####&k=####

File system changes:

Creates the following files:

/data/data/####/.cl
/data/data/####/.jg.ic
/data/data/####/.jgck
/data/data/####/1002
/data/data/####/1004
/data/data/####/BUGLY_COMMON_VALUES.xml
/data/data/####/BUGLY_COMMON_VALUES.xml.bak
/data/data/####/CookiePersistence.xml
/data/data/####/CookiePersistence.xml.bak
/data/data/####/EnContactInfo.db
/data/data/####/EnContactInfo.db-journal
/data/data/####/EnXxtLogin.db
/data/data/####/EnXxtLogin.db-journal
/data/data/####/EnXxtLogin.db-shm (deleted)
/data/data/####/EnXxtLogin.db-wal
/data/data/####/EnXxtUserInfo.db
/data/data/####/EnXxtUserInfo.db-journal
/data/data/####/EnXxtUserInfo.db-journal (deleted)
/data/data/####/EnZxjxMsgExecuteDate.db
/data/data/####/EnZxjxMsgExecuteDate.db-journal
/data/data/####/SP_AROUTER_CACHE.xml
/data/data/####/SP_AROUTER_CACHE.xml.bak
/data/data/####/access_20200517213349_0000.log.tmp
/data/data/####/access_20200517213358_0000.log.tmp
/data/data/####/ad_auth.xml
/data/data/####/application_shared_prefs.xml
/data/data/####/authStatus_cn.xxt.jxlxandroid.xml
/data/data/####/bugly_db_-journal
/data/data/####/circle.db
/data/data/####/circle.db-journal
/data/data/####/classes.dex
/data/data/####/classes.dex;classes2.dex
/data/data/####/classes.dex;classes3.dex
/data/data/####/classes.dex;classes4.dex
/data/data/####/classes.dex;classes5.dex
/data/data/####/classes.dex;classes6.dex
/data/data/####/classes.dex;classes7.dex
/data/data/####/classes.oat
/data/data/####/cloud.db
/data/data/####/cloud.db-journal
/data/data/####/cn.xxt.jxlxandroid.BETA_VALUES.xml
/data/data/####/cn.xxt.jxlxandroid.BETA_VALUES.xml.bak
/data/data/####/commons_sp_file_name.xml
/data/data/####/core_info
/data/data/####/crashrecord.xml
/data/data/####/download_upload
/data/data/####/hnxxtContacts.db
/data/data/####/hnxxtContacts.db-journal
/data/data/####/hnxxtMessage.db
/data/data/####/hnxxtMessage.db-journal
/data/data/####/hnxxtMsgExecuteDate.db
/data/data/####/hnxxtMsgExecuteDate.db-journal
/data/data/####/hnxxtRecommendSMS.db
/data/data/####/hnxxtRecommendSMS.db-journal
/data/data/####/homework.db
/data/data/####/homework.db-journal
/data/data/####/jxhdZxjxMessage.db
/data/data/####/jxhdZxjxMessage.db-journal
/data/data/####/jxhdZxjxMessage.db-shm (deleted)
/data/data/####/jxhdZxjxMessage.db-wal
/data/data/####/jxtMsgExecuteDate.db
/data/data/####/jxtMsgExecuteDate.db-journal
/data/data/####/jxtMsgFile.db
/data/data/####/jxtMsgFile.db-journal
/data/data/####/jxtMsgGroupDB.db
/data/data/####/jxtMsgGroupDB.db-journal
/data/data/####/jxtPermissionUnit.db
/data/data/####/jxtPermissionUnit.db-journal
/data/data/####/libcuid.so
/data/data/####/libjiagu.so
/data/data/####/local_crash_lock
/data/data/####/log_config_table.db
/data/data/####/log_config_table.db-journal
/data/data/####/login_sp_file.xml
/data/data/####/login_sp_file.xml.bak
/data/data/####/mac.xml
/data/data/####/native_record_lock
/data/data/####/news.db
/data/data/####/news.db-journal
/data/data/####/news.db-journal (deleted)
/data/data/####/notice.db
/data/data/####/notice.db-journal
/data/data/####/operator.db
/data/data/####/operator.db-journal
/data/data/####/operator.db-shm (deleted)
/data/data/####/operator.db-wal
/data/data/####/proc_auxv
/data/data/####/push_sp_file.xml
/data/data/####/security_info
/data/data/####/tbs_download_config.xml
/data/data/####/tbs_download_stat.xml
/data/data/####/tbs_pv_config
/data/data/####/tbscoreinstall.txt
/data/data/####/tbslock.txt
/data/data/####/vodChannel.db
/data/data/####/vodChannel.db-journal
/data/data/####/vodChannel.db-journal (deleted)
/data/data/####/webCacheDbV2.db-journal
/data/data/####/xxtArrangedContacts.db
/data/data/####/xxtArrangedContacts.db-journal
/data/data/####/xxtGradeInfo.db
/data/data/####/xxtGradeInfo.db-journal
/data/data/####/xxtGradeInfo.db-shm (deleted)
/data/data/####/xxtGradeInfo.db-wal
/data/data/####/xxtModule.db
/data/data/####/xxtModule.db-journal
/data/data/####/xxtModule.db-shm (deleted)
/data/data/####/xxtModule.db-wal
/data/data/####/xxtMsgFile.db
/data/data/####/xxtMsgFile.db-journal
/data/data/####/zxjxContacts.db
/data/data/####/zxjxContacts.db-journal
/data/misc/####/primary.prof

Miscellaneous:

Executes the following shell scripts:

/system/bin/dex2oat --instruction-set=x86 --dex-file=<Package Folder>/.jiagu/classes.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes2.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes3.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes4.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes5.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes6.dex --dex-file=<Package Folder>/.jiagu/classes.dex:classes7.dex --oat-file=<Package Folder>/.jiagu/classes.oat --inline-depth-limit=0 --compiler-filter=speed
getprop
getprop ro.product.cpu.abi

Uses the following algorithms to encrypt data: