Adware.Gexin.20941

Technical information

Malicious functions:

Executes code of the following detected threats:

Adware.Gexin.2.origin

Network activity:

Connects to:

UDP(DNS) 8####.8.4.4:53
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) cdn-sdk####.g####.com.####.com:80
TCP(HTTP/1.1) hk.wagbr####.non####.####.com:80
TCP(HTTP/1.1) a.appj####.com:80
TCP(HTTP/1.1) c-h####.g####.com:80
TCP(HTTP/1.1) d####.c####.l####.####.com:80
TCP(TLS/1.0) api.hemawe####.com:443
TCP(TLS/1.0) 1####.250.179.202:443
TCP(TLS/1.2) 1####.250.179.195:443
TCP(TLS/1.2) 1####.250.179.202:443
TCP(TLS/1.2) 1####.217.19.206:443
TCP sdk.o####.t####.####.net:5224
TCP cm-1####.g####.com:5225

DNS requests:

7j####.c####.z0.####.com
a####.u####.com
a.appj####.com
ad####.m.ta####.com
ada####.m.ta####.com
api.hemawe####.com
bcfeed####.ta####.com
c-h####.g####.com
cdn-sdk####.g####.com
cm-1####.g####.com
cm-1####.g####.com
cm-1####.g####.com
sdk-ope####.g####.com
sdk.c####.g####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.com
sdk.o####.t####.####.net
wb.110.ta####.com
y####.al####.com

HTTP GET requests:

cdn-sdk####.g####.com.####.com/tdata_NAK063
cdn-sdk####.g####.com.####.com/tdata_svG098
d####.c####.l####.####.com/config/hzv9.conf
ti####.c####.l####.####.com/tdata_BAI450

HTTP POST requests:

a.appj####.com/ad-service/ad/mark
c-h####.g####.com/api.php?format=####&t=####
hk.wagbr####.non####.####.com/saveWb.json

File system changes:

Creates the following files:

/data/data/####/-3642591731642035462
/data/data/####/.jg.ic
/data/data/####/.log.lock
/data/data/####/.log.ls
/data/data/####/0a231bd8575dcf72.txt
/data/data/####/1586211371-1417040799
/data/data/####/1586211371-1417481787
/data/data/####/1586211371515855801
/data/data/####/1927912350-1576409298
/data/data/####/19279123501135031595
/data/data/####/1927912350798006996
/data/data/####/1927912350957491273
/data/data/####/1d77ea041509fe06.lock
/data/data/####/21c22f492aba3de8.lock
/data/data/####/8ef9c457b3bbb403.lock
/data/data/####/930a31b34bd52c08.lock
/data/data/####/Alvin2.xml
/data/data/####/ContextData.xml
/data/data/####/SGMANAGER_DATA2
/data/data/####/SGMANAGER_DATA2.tmp
/data/data/####/UTCommon.xml
/data/data/####/ap.Lock
/data/data/####/cc.db
/data/data/####/cc.db-journal
/data/data/####/classes.dex
/data/data/####/classes2.dex
/data/data/####/com.fmshang.xml
/data/data/####/com.fmshang.xml.bak
/data/data/####/exchangeIdentity.json
/data/data/####/exid.dat
/data/data/####/getui_sp.xml
/data/data/####/hematransport
/data/data/####/hematransport-journal
/data/data/####/init.pid
/data/data/####/init_c1.pid
/data/data/####/libjiagu.so
/data/data/####/libsgmain_315522000000.dex
/data/data/####/libsgmain_315522000000.dex.flock (deleted)
/data/data/####/libsgmainso-5.1.81.so.tmp
/data/data/####/lock.lock
/data/data/####/proc_auxv
/data/data/####/profile
/data/data/####/push.pid
/data/data/####/pushsdk.db-journal
/data/data/####/run.pid
/data/data/####/sp.lock
/data/data/####/tdata_svG098
/data/data/####/tdata_svG098.dex
/data/data/####/tdata_svG098.dex.flock (deleted)
/data/data/####/tdata_svG098.jar
/data/data/####/ua.db
/data/data/####/ua.db-journal
/data/data/####/umeng_general_config.xml
/data/data/####/umeng_it.cache
/data/data/####/ut.db
/data/data/####/ut.db-journal
/data/media/####/6c709c11d2d46a7b
/data/media/####/Alvin2.xml
/data/media/####/ContextData.xml
/data/media/####/app.db
/data/media/####/com.hippo.hematransport.bin
/data/media/####/com.hippo.hematransport.db
/data/media/####/com.igexin.sdk.deviceId.db
/data/media/####/dd7893586a493dc3
/data/media/####/tdata_svG098

Miscellaneous:

Executes the following shell scripts:

/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/app_SGLib/libsgmain_315522000000.zip --oat-fd=63 --oat-location=/data/user/0/<Package>/app_SGLib/libsgmain_315522000000.dex --compiler-filter=speed
/system/bin/dex2oat --runtime-arg -classpath --runtime-arg & --instruction-set=x86 --instruction-set-features=smp,ssse3,sse4.1,sse4.2,-avx,-avx2,-lock_add,popcnt --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --dex-file=/data/user/0/<Package>/files/tdata_svG098.jar --oat-fd=51 --oat-location=/data/user/0/<Package>/files/tdata_svG098.dex --compiler-filter=speed
chmod 755 /data/user/0/<Package>/.jiagu/libjiagu.so

Uses the following algorithms to encrypt data: